What are some of the purposes of a Vendor Risk Issue? (Choose two.)

A Vendor Risk Issue is a record created within ServiceNow's Vendor Risk Management application to document and manage findings discovered during an assessment process. Its primary purposes are to track the lifecycle of these findings. This includes creating and monitoring remediation tasks to close identified compliance gaps or control deficiencies. Alternatively, if a business decision is made not to remediate, the issue record facilitates the formal process of documenting and approving the acceptance of the associated risk.

A. Log access-related incidents for the vendor portal: This is incorrect. Access-related incidents are typically managed through the Incident Management or Security Incident Response applications, not as GRC Vendor Risk Issues.
B. Indicate vendors that need further assessment: This is incorrect. The need for further, more detailed assessments is primarily determined by the vendor tiering assessment, which categorizes vendors based on their inherent risk.

1. ServiceNow Product Documentation - Issues in Vendor Risk Management: "Issues are created to document and track any findings that are discovered during the vendor risk assessment process. After an issue is created, you can assign it to an individual or group to be remediated. You can also request an exception or accept the risk." This statement directly supports both tracking remediation (D) and accepting risk (C).

Source: ServiceNow Product Documentation, "Vendor Risk Management," section on "Issues in Vendor Risk Management."

2. ServiceNow Product Documentation - Remediate a vendor risk issue: This document outlines the process where, "After an issue is reviewed and moved to the Analyze state, you can create remediation tasks to resolve the issue." This directly supports option (D) as a core purpose.

Source: ServiceNow Product Documentation, "Vendor Risk Management," section on "Remediate a vendor risk issue."

3. ServiceNow Product Documentation - Request an exception for a GRC issue: While part of the core GRC platform, this process is integral to VRM issue management. It states, "If you determine that it is not possible to bring a control into compliance... you can request an exception." This process, which includes risk acceptance, is managed through the issue record, supporting option (C).

Source: ServiceNow Product Documentation, "GRC: Issue Management," section on "Request an exception for a GRC issue."