Which statement accurately describes the visibility and audit history of actions and communications in the Vendor Risk Management application?

The ServiceNow Vendor Risk Management (VRM) application is designed to maintain a complete and auditable history of all risk-related activities. Vendor Risk Issues, along with their associated communications and activity history, are linked to the vendor company record, not to a specific vendor contact. This ensures that if a vendor contact changes (e.g., an employee leaves the vendor company), the entire historical record remains intact and accessible to the new, authorized contact through the Vendor Assessment Portal. This persistence is critical for continuous risk monitoring, compliance, and audit purposes.

A. Interactions are visible from both the Vendor Assessment Portal (for vendors) and the platform UI (for internal assessors and managers), not only the portal view.

B. Losing critical audit history when a contact changes would be a major design flaw and violate compliance requirements. The system is designed for data persistence.

D. The Vendor Assessment Portal is the primary interface for vendors to interact with assessments and issues, so visibility is explicitly provided there, not only in the platform view.

1. ServiceNow Product Documentation - Vendor portal for vendor contacts: This document outlines the capabilities of the vendor portal, stating that vendor contacts can "View and respond to issues." The functionality is tied to the vendor entity they represent, ensuring that any authorized contact for that vendor can access the relevant historical data. (ServiceNow Product Documentation, Quebec Release, "Vendor portal for vendor contacts," Section 1).

2. ServiceNow Product Documentation - Vendor Risk Management data model: The underlying data model shows that the snvdrriskasmtissue table is related to the vendor assessment, which in turn is related to the vendor company (corecompany table). The vendor contact (snvdrriskasmtvdrcontact) is an associated record, but the primary relationship for historical data is with the vendor company, ensuring data persistence beyond individual contact changes. (ServiceNow Product Documentation, "Vendor Risk Management data model," Table relationships diagram).

3. ServiceNow Product Documentation - Vendor risk issues: The documentation on managing vendor risk issues details the lifecycle and tracking of issues. The process is centered around the vendor as an organization, and the activity stream (Activities formatter) on the issue form captures all updates, ensuring a permanent audit trail regardless of which contact or internal user performs the action. (ServiceNow Product Documentation, "Vendor risk issues," Section 2, "Issue form").