Third-party profiles (3P Profiles)

Use the third-party profile (3P Profile) to view all details of a third-party and perform actions including:

• Manually add a third-party. See Adding a third-party.

• Perform initial review of a third-party on 3P Monitor. See Reviewing, adjudicating, and remediating GDC and media hits.

When you select Dashboard then Third Party Management on the left menu, the following tabs display:

• Third Party List tab: Filter a list of third-parties.
• Record Detail tab: Review the 3P Monitor and escalate for investigation, if needed. You can also review more information on the third-party.

• Pending Review tab: Identify records that require review.

Third Party List tab

The Third Party List tab shows a list of third-parties which can be filtered by the criteria shown. Select to set the search field A field is a way to input information, often a question., for example, on Company, Profile #, Owner, and so on. Complete other filters, as needed. Select Reset View to clear filters or searches. You can select a column to change the display order.

You can select the AP button to review only approved third-parties. The filter options show: Options: Approval: Approved. You can select Reset View at any time to remove the filter.

You can select the Add Profile button to add a profile. See Adding a third-party.

Record Detail tab

Select a 3P Profile to see the Record Detail tab for the third party. You may view the organization, point of contact, and other profile details. Select the Risk rating The risk assessment history which changes over time based on the risk model assigned and other factors. Details include how the relationship is categorized, the services provided, the country risk, due diligence questionnaire responses, and custom fields. value to view the risk assessment history which changes over time based on the risk model Created for different third-party types and categories within the type to apply separate evaluation criteria to diverse types of third parties. Four factors make up a risk model: country, type and category, DDQ questions, and third-party custom field questions. assigned and other factors.

The Record Detail tab has the following sub tabs.

• Summary tab: The Summary tab covers entity details including address and points of contact. On the right, select Edit Record to make changes. Select Update Record to save the changes. As described in Custom Fields later, Administrators can set up custom fields Custom fields can be created to use in risk models. for any information that is not captured on this tab.
  

• Engagements tab: Lists the engagements associated with the third-party.

• Training tab: Manage the training for individuals. See Training.

• Due Diligence tab: Review monitoring and questionnaire status Third-party Status used for searching, for example, Active or Inactive. Approval Status is a subset of the Status. See Approval Status. Case Status used for searching, for example, Only Open Cases or Only Closed Cases..
  If there are multiple screenings, a red number on the right represents the screening results that have not been reviewed. A blue number represents results that need remediation.)

  • Select Review 3P Monitor to view if the company is on a watch list or a sanctions list, media red flags, and so on. Review individual results, and mark as True Match A hit is about the Subject entity or individual to be remediated via remediation actions and reasons. or False Positive, and enter reasons and notes. Select Escalate to order further investigation on the third-party. For step-by-step details, see Reviewing, adjudicating, and remediating GDC and media hits.

  • Select Invite | Re-invite to invite the third-party to complete a questionnaire for the first time or to send a questionnaire again. Selections are offered. To create questionnaires, see Using Form Builder for questionnaires.

• Documents tab: View documents related to the profile, such as contracts or emails. Select Add New to upload a document for the third-party. (Documents added are specific to the 3P Profile, the 3P Engagement A 3P Profile may have one or more 3P Engagements so different business units in your organization can apply differnt risk and compliance program configurations for the 3P Profile. Cases are assigned to 3P Engagements., or a case Assigned to a third party profile related to a questionnaire sent for response, due diligence investigation, or other action. depending on where they are added.)

• Compliance Checklist tab: Use this tab to track how much of the compliance process is completed. Items like database check, questionnaire sent, and others are shown as Not Complete, In Progress, or Complete. The threshold of completion percentage is achieved. After you change statuses for individual items, select Save.

• Workflow A series of tasks generated based on an event or form submission. tab: View the workflows and the workflow status.
  To add a personal filter, select the plus button, select Add Filter, then drag items to filter to the right. Select Save changes.
  To view or update a workflow, select a workflow link. For more information, see: Completing a workflow task, Using workflows, and, for administrators, Using Workflow Builder

• Gifts tab: View and audit gift and hospitality records. Select to change the information that is displayed. Select Add New to add a record. Enter the detail then select Add.

• Connections tab: Associated 3P Profiles Third-pary profile (3P profiles) which may have associated engagements and cases. or individuals display on the Connections tab. You can perform the following:

  • Select the Add Profile Association button to add a Profile Association. Identify the entity to link to and select the relationship of the company to the current profile: Parent, Affiliate, Subsidiary, or Partner.

  • Select the Add Other Association button to add a Person or Entity association. Select the Type The type of third party, for example, Channel Partner, Vendor, Supplier, or DO NOT ENGAGE. of connection, Person or Entity, then complete the details. Select Include in 3P Monitor if you want the person or individual included in searches. For example, a consultant may be classified as an Entity. On the Connections grid, the 3P Monitor column is Yes if the name of the Person or Entity is included in 3P Monitor searches. Select Save.

    On the grid, 3P Monitorcolumn is Yes if the name of the Person or Entity is included in 3P Monitor searches.
    If you enter a name that is already in the system, you will be able to select an existing user name and third-party association or continue to create a new record.
    If you have engagements enabled, associations added for an engagement are labeled with an E.
    

  • Internal Assessment (Custom Fields) tab: View the custom fields. Custom fields are managed by your Administrator. For details about custom fields for Administrators, see Setting fields and lists

  • Notes tab: View notes added, such as an approval comment.

  • Audit Log tab: View the details of each action taken including the date, event, user, reference identifier, and details. If you have the correct rights, you can view all actions taken in the system. See Managing audit logs.

  • Email Log tab: View each 3P Profile and 3P Engagement email, the date, the sender and receiver, subject, and a reference number.

Pending Review tab

The Pending Review tab consolidates records that require a review, and the status has not been updated.

Action buttons

These action buttons are available from the Record Details tab, as applicable for a third-party or engagement.

Third-parties:

ATP to select only approved third-parties (ATP) on the Third Party List tab. This button is available when viewing the list of third-parties.

Add Engagement to enter a 3P Engagement for the 3P Profile to separately track workflow, risk, and more (if engagements is enabled).

Add Profile to add a new 3P Profile. This button is available when viewing the list of third-parties.

Escalate to order further investigation on the third party or Save to save your work on the 3P Monitor. This button is available on the 3P Monitor window.

Both third-parties and engagements:

Add Case to enter third party or engagement information and order an investigation. This button is available when viewing the Record Details tab.

Merge to merge two existing third party profiles or engagements. Identify the duplicate and choose which to retain and which to eliminate. When a third-party (with or without engagements) is retained and merged with another third-party (with or without engagements), any engagements are merged. An engagement can be retained and merged with a third-party with engagements.

An engagement cannot be retained and merged with a third party with no engagements. In other words, a third-party profile with one or more engagements cannot be eliminated to be merged into an engagement. For details on merging engagements, see Adding an engagement and case.

Print to print the information to your downloads folder in PDF format. This button is available when viewing the 3P profile details.

Status to set the approval status The status of the third party approval, for example, Pending, Approved, Denied for Compliance Reasons, and so on. Approval Status is a subset of Status. See Status. of a third party or engagement such as Pending, Approved, Denied, and so on and enter an explanation. Your organization may automate the renewal cycle based on the approval date, DDQ Due Diligence Questionnaire which can be sent to third parties for response. Questions can be added to a risk model to use in determining the overall risk rating for a third party. submission date, or other date. Or, your organization may set manual processes.

Renewals

Your organization may automate renewals or set a manual process.

• Automated renewals: Your organization may automate the renewal cycle based on the approval date, DDQ submission date, or other date. Any other date to use for renewal (but not a system-supplied field) should be added as a custom field to make it available to the workflow.
• Manual renewal process: Your organization may set manual processes. Renewal notifications that can be configured to automatically send letting an internal owner The organization's point of contact for the third-party to receive notifications, such as if a DDQ was sent to third-party point of contact. The internal owner is useful, for example, if your organization has a process for assigning third-parties based on location. or business sponsor know that the third-party is ready for renewal. Administrators set the renewal rules. See Managing renewals.