Step-by-Step Onboarding Guide: Third-Party Due Diligence

Getting up and running with your Third-Party Due Diligence solution

Thank you for choosing the OneTrust Third-Party Due Diligence solution to help manage your compliance and due diligence program needs.

The solution is designed to be intuitive and easy to configure and this guide will take you through each step one by one. If you have questions along the way, or at the end of your implementation, you can reach out to the team who will be happy to help.

This module is implemented to help customers focus on the risk mitigation associated with working with third parties. By leveraging the Dow Jones integration with OneTrust you can quickly screen and implement ongoing monitoring to all third parties. This solution will also provide the customer with a means to catalog a third-party inventory and manage internal and external assessments while stratifying risks.

Let’s get you started

Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support collateral on the my.onetrust.com online resource platform and this guide will direct you towards all the information you need.



Before you begin

Before you get started with your implementation, complete the following key activities which will help you accelerate your implementation:

  1. Assign Key Decision Maker

    This will be the main point of contact throughout the implementation and will make configuration/setting decisions for the module.

  2. Register for my.onetrust.com

    Register for the My.OneTrust knowledge base here. Articles found here will be referenced throughout this document. Once you register you will need to email [email protected] with a list of users who have self-registered for us to provide you all with full access.

  3. Review the Getting Started with OneTrust Articles

    All articles found here under the “Learning about the OneTrust Application” will help you gain an understanding of how to navigate your new application. This section is filled with helpful article topics that range from using the homepage to educating you on the OneTrust release process.

  4. Add Additional Admin Users

    Your OneTrust tenant will come pre-configured with only one user who is given the Site Admin role. We recommend adding other admin users to your OneTrust tenant, as needed. For more information on creating additional user accounts please reference this article. There are three additional roles created specifically for the third-party due diligence module:

    TPDD Site Admin

    Therole has been created with various permissions that allow users to help with TPDD setup, including the creation of TPDD users and configuring assessments, workflows, attributes, and automation rules. Site Admins can assign this role to the users responsible for setting up the Third-Party Due Diligence module.

    TPDD Compliance Manager

    Therole was created with existing permissions that let users manage third-party due diligence activities such as reviewing assessment responses and screening results. Site Admins can assign this role to users to quickly assign the permissions necessary for the daily management of third-parties.

    TPDD Enhanced Due Diligence Requester

    For customers who have purchased the Enhanced Due Diligence integration, therole allows a user to order their reports.

  5. Gather Existing and Potential Third-Parties

    Who are the third parties you are working with? Review your current third parties and decide if this list will be imported into the tool. Review the data points captured against your third parties and see how they fit into the existing application. OneTrust has a standard import format used for creating and updating third parties. Additional information can be found here.

  6. Understand Your Third-Party Requirements

    Consider your current onboarding and off-boarding processes. Understanding the processes, you are hoping to duplicate in the OneTrust application will lead how you work through building your inventory and testing your workflows.

    • What types of third parties will you be adding to the application? All, or are you focused on just your high-risk entities?

    • How are third parties added?

    • How are the third-party risks defined and researched today?

    • Who are the individuals who are involved in approving/rejecting third risks or assessments?

    • What is your due diligence process?

      Note:

      OneTrust recommends writing down and reviewing your process internally before configuring in OneTrust.

  7. Consider how you Assess Your Third-Parties Today

    OneTrust offers standard template assessments out of the box that are ready for your modifications. If you have existing assessments, will you be creating them from scratch within the OneTrust application? If so, gather all of those details ahead of time so that you can build them in the OneTrust assessment template builder.

Third-Party Due Diligence Configuration

For an overview of the Third-Party Due Diligence module and its features, review the Third-Party Due Diligence Knowledge Base. The steps below direct you to the most relevant way to get started as quickly as possible.

Step 1: Configure your Dow Jones Integration

Integrating with the Dow Jones database is critical for getting the most use out of the Third-Party Due Diligence application. The integration between Dow Jones and OneTrust allows you to screen and/or monitor third parties in the application. Work with your implementation team or follow the instructions in the article below to activate your Dow Jones integration:

Dow Jones integrations for Third-Party Due Diligence need to be set up from directly within the product. See the following articles in the order listed below to set up Third-Party Due Diligence integrations:

Step 2: Review Attributes

OneTrust pre-populates third-party records with attributes commonly associated with third parties. Third-Party attributes offer a way to capture and report on additional information that is important to your due diligence program.

You can add, edit, deactivate and group attributes as needed to configure the Details tab of your third-party records.

This is the logical first step of your Third-Party Due Diligence implementation, since setting up your attributes early ensures that you will have all the data fields you want to use configured in the tool by the time you are ready to import new or existing third-party records.

To begin you will want to activate the attributes found in the Default Attributes. Many of these attributes were created specifically for TPDD and are tied directly to your Dow Jones integration.

Use the below articles for further guidance:

Step 3: Define Risk Methodology

You will want to define your preferred risk scoring throughout the Third-Party Due Diligence module. There are two steps to doing this.

  1. Choosing your preferred methodology

  2. Choosing your preferred aggregation method for assessments and vendors.

Risk scoring applies throughout the application. It will impact how your assessments are scored, how third parties may move through your workflows, and how your due diligence actions are performed.

Use the below articles to configure your risk settings:

Step 4: Review & Configure Templates

There are two approaches to creating a questionnaire template in the tool:

  • Use our gallery of third-party questionnaire templates, which has our standard out-of-the-box templates. They include Business Justification Form Lite, Business Justification Form (full), and Third-Party Due Diligence Questionnaire.

  • Create a questionnaire from scratch that you have been using in your company.

You can populate third-party attributes directly from the questionnaire (assessment) using the steps outlined here.

Once all the questions have been configured, you can also:

  • Create skip or show logic which will ensure that the respondent does not have to go through all the questions, but only specific questions based on the options they select.

  • Questions, attachments, justification can be marked as mandatory for the respondents to fill out.

  • Add rules to the questionnaire based on the answers provided by the respondent.

    • Create automated risk and controls workflows

    • Add additional approvers to the assessment

    • Send follow-up assessments on submission or approval of the initial assessment

    • Auto-complete low-risk assessments

Use the below articles for further guidance:

Step 5: Configure Third-Party Workflows

Third-Party Workflows allow you to quickly view and update where a vendor stands in your due diligence process. We recommend writing down and reviewing your due diligence process internally before configuring in OneTrust.

The three default system workflows provided by OneTrust can be cloned and deactivated if you do not want to use them. Default and custom workflows help to automate and streamline third-party onboarding and evaluation across your organization.

Understanding Stage Rules and Workflow Rules:

  • Stage Rules can be added to automatically generate an action based on the details of the third party

  • Workflow Rules allow third parties to automatically advance through your third-party due diligence workflows

Use the below articles for further guidance:

Step 6: Configure Automation Rules

Automation rules help automate certain aspects of your third-party management workflow and allow you to launch assessments based on when specified criteria from the rules are met.

  • You can create automation rules on the Automation Rules menu. When you add a new rule group, you are required to enter the rule group name and organization.

  • Once you complete the required details, you can decide if you would like to enable the setting that allows the rule group to run only for items in your current organization.

  • When your new rule group is created, you can add a frequency run, configure conditions, and set actions that meet the needs of your organization.

These automation rules will work along with your third-party workflows. To understand how automation rules may help your program, review the Third-Party Automation Rules Use Cases knowledge base article.

Use the below article for further guidance:

Step 7: Import Existing Vendors

There are three ways to add a third-party to your inventory.

  1. Bulk Import: All the vendors in a spreadsheet can be bulk imported into the tool

    • Review the bulk import article below to understand the required columns. Two optional but nice-to-have columns are Primary Vendor Contact, and Business Owner.

  2. Ad-hoc using the ‘Add New’ button from your inventory page

  3. Self-Service Portal (Enterprise customers only): Business users can submit an intake form to request due diligence for a third party.

Before adding your third parties, decide if they will be going through the screening and monitoring process. Will they be monitored moving forward after your due diligence review has been completed? Are you adding them for inventory reasons? Once this is decided, ensure that you have the correct workflows to facilitate your needs.

Once you save the third-party record and it is added to your inventory, you can modify the third-party information, launch assessments, add risks, and perform other actions on the Inventory Details screen.

Use the below articles for more guidance:

Step 8: Create Linked Entities

You can add and screen related entities to a third-party using the Linked entities tab on any third-party record. Linked Entities are generally considered:

  • Affiliated Organizations

  • Beneficial Owners

  • Board Members

  • Etc.

Screening results for Linked Entities will appear on the third-party record’s screening results tab. Use the below article for further guidance:

Step 9: Launch & Manage Third-Party Assessments

Send the published questionnaires in your template gallery to internal teams or third parties as assessments.

  • Send assessments to third parties via the third-party record, using the assessments tab, automatically through workflows, using automation rules, or through the Self-Service Portal.

Test your assessments to verify that they are working as you intended. An assessment brings together all the configurations that you have done in the application. For testing, we recommend running through the end-to-end process: Add third parties, put them through your workflows, and launch the assessments as needed. Consider the process of reviewing assessments during testing to ensure you have clear internal processes defined and documented.

Use the below articles for further guidance:

Step 10: Reporting

Our reporting module is set up to pull in all the metadata based on the source data, and from there you can filter as needed. You can build custom column and PDF reports pulling this data from an assessment or an inventory (third party) record.

The default vendor management dashboards show vendors grouped by risk level, the status of any vendor related assessments and the status of expiring vendor contracts. You can build custom widgets for the information that you wish to track, again pulling in all the metadata based on the source data.

For all reporting and dashboard articles, click here. For vendor specific reporting articles, see below:

Complete!

Congratulations on completing your implementation.