Third-Party Renewals
Written by Michelle Henley
Updated at May 16th, 2024
Table of Contents
Third-Party Due Diligence engagements allow for an expiration date to be applied to both the validation and business justification aspects of a Third-Party engagement. By applying an expiration date, tenants can easily identify Third-Parties who should be reevaluated and reapproved.
Tenant Configuration
When a Third-Party engagement is fully approved, the system will set a predefined expiration date that has been selected by the tenant. Up to six different expiration periods can be pre-selected in one month increments and are based on the overall Engagement Risk Score up to one decimal point. For example, a risk score of 0-1.2 can allow for an expiration date of 60 months, 1.3-2.0 risk score can be set to 36 months, and 2.1-3.0 for 24 months and so on…
Auto-Calculated Expiration Period
Once expiration periods are configured for your organization, the system will set the predefined date to an engagement when it's either Approved or Approved with Conditions.
When an approver approves the request, the Auto-Calculated Expiration Period is displayed in the Approver modal.
Note: Expiration periods are only added to new engagements created after the release of this feature in November 2023.
The Auto-Calculated Expiration Period and Expiration Date is recorded during the last approval step within the request history along with the Approval Action.
Adjusting the Expiration Date
Approvers with the Adjust Expiration Date privilege can manually adjust a predefined expiration date by changing the date while they are approving an engagement.
Within the Approval modal, the calculated expiration date is displayed.
To edit, click the Pencil icon.
Enter the new desired expiration period. (Note: Increments are in months.)
Click the Green Checkmark to save the new Expiration Period.
The adjustment to the new Auto-Calculated Expiration Period is recorded within the request history along with the Approval Action during the current approval step (and the final approval step).
Displayed Expiration Date
The calculated date is displayed in the Submissions, Approvals, and Shared with Me tab in the column to the left of Status called Expiration Date.
Additionally, the calculated date is also displayed on the Third-Party profile card under the Engagements tab in the Expiration Date column to the left of Status.
Email Notification
When an engagement reaches the expiration date, and a renewal has not already been started, the submitter and all editor collaborators are sent an email notification that their engagement has expired along with instructions on how to renew the engagement. Approvers and any final approver collaborators will also be cc'd on the email notification.
| On Expiration Date | Alert: Expired Third-Party Engagement |
“Dear {{user_full_name}},: {{organization_official_name}’s approved engagement {{request_formatted_id}} has EXPIRED.
{{organization_official_name}} cannot be used for this engagement until renewal due diligence has been initiated and approved. Please click Renew next to the engagement in Your Recent Due Diligence Activity table to initiate the engagement review renewal. |
Please do not reply to this message. |
Expired Status
On the expiration date, the status of the engagement will be changed from Approved or Approved with Conditions to Expired
Note: The status will change to Expired even if the renewal engagement is initiated prior to the expiration date.
Note: Engagements with Expired status cannot be updated (except to reassign the submitter). Follow the instructions below to Renew the engagement.
The request history will also record that the engagement is expired along with a timestamp.
Lastly, any approved countries operation and/or approved scope that have expired will be removed from the Third-Party profile card once the set date is reached (unless those countries are approved in other engagements).
Submitting a Renewal Engagement
As soon as a engagement is either Approved or Approved with conditions users have the option to renew the engagement prior to the expiration date or after the expiration date.
Note: The original submitter, along with any assigned editor collaborators, approvers, or approver collaborators can renew the engagement. If an approver or collaborator (editor or approver) initiates the renewal, that user becomes the submitter of the new engagement.
From the submission table, click on the Oval Icon to the far right.
Select Renew from the dropdown list.
A popup will ask the user to confirm that they would like to renew the engagement. Click, Confirm.
When Confirm is selected, a pre-populated Business Rationale Questionnaire BRQ is replicated based on the original BRQ and is populated into a new engagement on behalf of the current submitter. The new BRQ is assigned a new request ID and saved to the user's Draft submissions.
The request history of the original engagement wil record that it has been renewed.
The request history of the new engagement will record that the submission imported responses from the previous request ID.
If any changes to the BRQ have been made since the last submission of the engagement, the most current version of the BRQ will be used in the renewal engagement.
- Any questions removed since last submission will be removed in the renewal engagement.
- Any new questions added since last submission will be added, but will be blank.
- Any existing questions will be prepopulated with previous answers.
Things to Note Upon Submission:
- As soon as a renewal engagement is saved to draft, the Renew button is removed from the Submissions table. If the draft renewal is deleted, the Renew button is once again available on the Submission, Approvals, and Shared with Me tables.
- Screening will run again unless already running with Ongoing Screening and the results from prior screenings are also displayed.
- Renewal engagements can still be updated after submission, the same as any other TPM engagements.
- Existing Master Data cannot be edited while creating a renewal engagement.
Renewal Engagements - Due Diligence Questionnaire
If a Due Diligence Questionnaire (DDQ) was completed in the original approval engagement, when an approver sends a new DDQ to the Third-Party, the DDQ will be pre-populated with the previous answers. When the Third-Party logs into the system they will see the previous DDQ along with the new DDQ.
However, if no DDQ has been completed in the original engagement, the answers in the DDQ for the renewal engagement will be blank.
If any changes have been made to the Due Diligence Questionnaire (DDQ) since the last submission of the engagement, the most current version of the DDQ will be used in the renewal engagement.
- Any questions removed since last submission will be removed in the new DDQ.
- Any new questions added since last submission will be added, but will be blank.
- Any existing questions will be prepopulated with previous answers.
Approving Renewal Engagements
If any changes have been made to the approval flow since last submission, the renewal engagement will be subject to the most current version of the approval flow.
Re-evaluate Expiration Date if Risk Score Changes
Automated Tasks for Third-Party Renewals
Automated Tasks for Third-Party Renewals
Once configured, when a TPM engagement is Approved or Approved with Conditions, an automated task will be created by the system and will be assigned to the submitter.
Note: A 1-2 minute delay may exist between the time the request is approved and when the task is created.
The automated task will be assigned from System User and an email notification is sent to the submitter to let them know that an automated task has been assigned to them. The email will contain a link to access the task.
Additionally, the automated task is tied to the original Request ID and can be accessed within the request by clicking on the Tasks tab.
The title of the task will be Third-Party Renewal and the Due Date of the task will match the expiration date of the engagement.
Automated tasks are also displayed in the Tasks section of the Gateway under My Tasks.
When an automated task is created, the Task History records the action based on when it was auto-created.
Reminder Emails
Automated tasks are included in reminder emails once they are within 90 days of the task due date.
Updates to Engagements or Tasks
- If the expiration period of an engagement changes after full approval, through an update to the engagement, the existing task is updated with the new expiration period.
The update is also logged in the Task History.
- If an approved engagement is updated and reapproved, but the corresponding automated task is already marked as completed or canceled, the task is restarted and the due date is updated to correspond with the updated engagement.
The update is logged in the Task History by System User.
- If the submitter is reassigned after the approval of an engagement, the corresponding automated task has to be manually reassigned to the new submitter.
Task Admins
-
Users with the Edit All Tasks privilege (Task Admin) can update any field within automated tasks, including the assigned from and due date fields.
- If the task has been updated by the Task Admin and the engagement is updated and reapproved, any changes made by the Task Admin will remain unchanged. Only the due date of the task will update to correspond with the updated engagement.