Which of the following are functions of the Vendor Risk Assessor? (Choose three.)

The Vendor Risk Assessor role (snvdrriskasmt.vendorassessor) is focused on the execution and review of vendor risk assessments. A primary function is to access and analyze the completed assessments submitted by vendors to evaluate their risk posture. If the assessor identifies any risks, control deficiencies, or non-compliant answers during their review, they are responsible for creating issues to track these findings through remediation. While a Vendor Manager typically manages the vendor profile, an assessor creating a new assessment may need to create a new vendor contact record if the appropriate individual to receive the questionnaire does not yet exist in the system.

A. Enable communications across vendors: This is not a function of a risk assessor. The VRM application manages relationships with individual vendors, not communication between them.

C. Update vendor contract deadlines: This is a contract management function, typically performed by a Vendor Manager or Contract Manager, not a risk assessor whose focus is on risk evaluation.

1. ServiceNow Product Documentation - Vendor Risk Management roles: The snvdrriskasmt.vendorassessor role is defined as having the capability to "create and update vendor risk assessments, issues, and tasks. Can view all vendor risk information." This directly supports the functions of accessing assessments (B) and creating issues (D).

Source: ServiceNow Product Documentation, "Vendor Risk Management roles," Rome release (and subsequent).

2. ServiceNow Product Documentation - Review and approve a vendor risk assessment: This document outlines the assessor's workflow, stating, "When the vendor submits the questionnaire... The vendor risk assessor can now review the vendor's responses... If the assessor finds a problem with an answer, they can create an issue, a task, or request more information." This confirms the assessor's responsibility to access completed assessments (B) and create issues (D).

Source: ServiceNow Product Documentation, "Review and approve a vendor risk assessment," Utah release (and subsequent).

3. ServiceNow Product Documentation - Create and send a vendor risk assessment: The procedure for creating an assessment requires selecting a "Vendor contact." For an assessor to fulfill their duty of creating an assessment, a contact must exist. If the necessary contact is missing, creating one (E) becomes a required supporting task to complete their primary function.

Source: ServiceNow Product Documentation, "Create and send a vendor risk assessment," Utah release (and subsequent).