A vendor is assessed and responds to a question which impacts one of the Controls applied to them. When is the Control Status updated?

The status of a control is updated when the vendor formally submits their responses to the questionnaire. This action transitions the Vendor Risk Assessment's state to "Responses Received." Upon entering this state, the ServiceNow platform automatically triggers business rules that process the vendor's answers. These rules calculate the risk ratings and update the compliance status of any associated controls based on the provided responses. This allows the risk assessor to review the updated control status and proceed with the assessment, such as generating issues or finalizing the review.

B. This is incorrect because the "Finalizing with Vendor" and "Closed" states occur after the responses have been reviewed. The control status must be updated before this stage to inform the finalization process.

C. This is incorrect because simply saving a response does not trigger the update. The system waits for the formal submission of the entire assessment to process all answers cohesively.

D. This is incorrect because answering all questions is not the trigger. The vendor must explicitly submit the completed assessment, which changes its state and initiates the update process.

1. ServiceNow Product Documentation: Process a vendor risk assessment. In the section detailing the assessment workflow, it states, "When the vendor submits the questionnaire, the state of the assessment changes to Responses Received. The risk ratings are calculated, and the compliance of the controls is updated." This directly confirms that the "Responses Received" state is the trigger.

2. ServiceNow Product Documentation: Vendor Risk Assessment states. This document outlines the assessment lifecycle. The "Responses Received" state is defined as the point where the assessment is returned from the vendor and is ready for review by the assessor, implying that all calculations and updates based on vendor input have been completed.