Reviewing Questionnaires and Creating Issues

The Vendor Risk Management (VRM) module in KnowBe4's KCM Governance, Risk, and Compliance (GRC) platform lets you centralize your third-party risk management processes. You can prequalify risk, assess your vendors, and conduct remediation efforts all in one platform. The VRM module is available to Platinum subscriptions.

Once your vendor contact has completed your questionnaire assessment, the KCM GRC Vendor Owner (click to view example) will receive an email notification. You will review questionnaires from the applicable vendor profile, under the Vendor List area of your console.

If the vendor provided an undesirable answer to one or more questions, you'll create an "issue" to request additional information or to further discuss your concern with the vendor.

See the sections below to learn more.

Jump to:

Reviewing Questionnaires

Creating Issues

• Responding to Issues
• Issue Details
• Closing Issues

Exporting Finalized Questionnaires

Reviewing Questionnaires

Once your vendor (or another third party) finishes your questionnaire assessment, you'll receive a notification from KCM GRC. From their vendor profile (Vendor Details page), you'll review your vendor's responses and any attachments or comments they may have included. See the steps below to learn more.

1. Navigate to the vendor profile by clicking Vendor Management, then Vendor List from the navigation panel on the left-hand side of your account.
2. From the Vendor List page, click on the applicable organization's name to open their vendor profile.
3. From the Vendor Details page, click the Assigned Questionnaires tab in the middle of the screen. Then click on the questionnaire name to open it, as shown below.
   
   

   Tip:

   If you're waiting on your vendor to complete the questionnaire, you can use the Nudge Vendor button to send the vendor an additional email reminding them to complete the questionnaire.

4. From the Questionnaire Review page, you'll see the answer the vendor added or selected for each question. Incorrect answers have a red line on the left-hand side of the question. (Only the incorrect multiple-choice and Yes / No/ N/A question formats are noted. The accuracy of checkbox and free-form questions are at your discretion.)
   
5. Use any combination of the filters at the top of the page to specify the types of questions you want to view.
6. If applicable, file attachments or comments that were added by your vendor contact will be indicated by an icon on the right-hand side of the question. Click the icon to view the comment or download the attachment, as shown below.
   
7. If necessary, you have the ability to manually change the score for each of your vendor's responses. Use the Current Score field to change the answer value to any number equal to or less than the Max Score for the question.
   This is helpful if you'd like to give your vendor a partial score for their response.

If the vendor provided an undesirable answer to one or more questions, see the next section to learn more about creating issues from your VRM module.

Back to top

Creating Issues

If your vendor provided an undesirable answer to one or more questions, you'll create an "issue" for the questions in your KCM account. Creating an issue opens a line of communication specifically for each of the necessary questions. You can use issues to request additional information or further discuss your concern with the vendor. See the steps below to learn more.

1. If you're not already reviewing the questionnaire, navigate to the applicable vendor profile by clicking Vendor Management, then Vendor List from the navigation panel on the left-hand side of your account.
2. From the Vendor List page, click on the applicable organization's name to open their vendor profile.
3. From the Vendor Details page, click the Assigned Questionnaires tab in the middle of the page. Then, click on the questionnaire name to open it, as shown below.
   
4. From the Questionnaire Review page, navigate to the question for which you need to create an issue, and click the +Create Issue button on the right-hand side.
   
   

   Note:

   Once an issue has been created for a question the + Create Issue button will be disabled.
5. Use the New Issue modal window to create your issue. See below for details.
   
   1. The original question for which you're creating an issue.
   2. Use the Issue Description field to ask your vendor for more information or to describe your concern. The Issue Description will be visible in the vendor contact's KCM account. Please note, Issue Descriptions have a 1000 character maximum.
   3. Select an Issue Priority: Minor, Moderate, High, or Critical. The priority will be visible in the vendor contact's KCM account.
6. Once you've finished click Save.

After you create one or more issues, your vendor will receive one email notification. To learn more about the vendor's user experience, see our Guide for Vendor Users.

Back to top

Responding to Issues

Once your vendor has responded to your Issue, the KCM GRC Vendor Owner (click to view example) will receive an email notification. Use the link in the email or follow one of the options below to navigate to the issue and see their response.

Once you've reviewed their response and any supplemental files they may have provided, you'll have the ability to change the score you've granted for this question. See the Issue Status, Priority, & Grade drop-down below for more information.

Navigate to Issues from the Vendor List

You'll work through questionnaire issues from the applicable vendor profile (Vendor Details page). See the navigational steps below.

1. Navigate to the vendor profile by clicking Vendor Management, then Vendor List from the navigation panel on the left-hand side of your account.
2. From the Vendor List page, click on the applicable organization's name to open their vendor profile.
3. From the Vendor Details page, click the Issues tab in the middle of the page (shown below).
   
4. From the Issues tab, click on the Issue Description to open the issue.

See the Issue Details section below for information about responding to and closing issues.

Navigate to Issues from the Vendor Dashboard

As an alternative to the navigation offered above, you can navigate to your issues from the Vendor Dashboard page. This option could be helpful if you'd like to work on multiple issues at once. See the navigational instructions below.

1. Click Vendor Management from the navigation panel on the left-hand side. Then, click Dashboard.
2. Scroll down to the Vendor Issues section of the page (shown below).
   
3. Here you'll see a table containing your vendors and the open or pending issues associated with their questionnaires. Click on the number listed in the Number of Issues column to expand all of the issues for that vendor.
4. Then, click on the description under the Issue Description to open that issue.
   

   Tip:

   If you'd like to work on multiple issues, right-click to open each issue in a new tab, instead.

See the Issue Details section below for information about responding to and closing issues.

Back to top

Issue Details

Click on each drop-down to learn more about working in the Issue Details page under your VRM module.

Issue Status, Priority, & Grade

1. Status: Change the status to Pending if you're waiting on your vendor's response. Change the status to Closed once the concern has been resolved.
2. Priority: Change the issue priority (this is visible to the vendor user).
3. Current Score: Change the score you want to give for the vendor's response after working through the issue. The new score must be less than the maximum points allowed for the score.

Upload File Attachment

If your vendor contact has uploaded a file for this assessment response or issue, you will be able to download the file from this area of the page. Click the cloud icon to download the file.

Issue Description

Here you'll see the issue description your vendor is responding to. The original question is also shown here.

Vendor Conversation

Use this area to communicate with your vendor. The vendor user's responses are shown in grey. The vendor contact will automatically receive an email notification after you send a response.

Internal Communications

Use this area to leave notes for yourself, or to communicate with other colleagues working in your Vendor Risk Management module. The vendor contact (Vendor User) will not see this communication.

Back to top

Closing Issues

Once you're finished working on a questionnaire issue with your vendor contact, you'll close the issue to cease further communication.

From the Issue Status, Priority, & Grade section of the Issue Details page, click the Status drop-down menu. Select Closed, then click OK when prompted.

Back to top

Exporting Finalized Questionnaires

This section explains how you can export a CSV file containing the questions, answers, and other details of a questionnaire assessment that your vendor has completed. 

Follow the steps below to export completed questionnaires.

1. Click Vendor Management > Vendor List from the left navigation panel. Then, from the Name column, click the name of the vendor that contains the questionnaire that you'd like to export. 
2. From the Vendor Details page, click the Assigned Questionnaires tab to find the questionnaire you'd like to export. 
3. Once a questionnaire is in Pending Review status, an Export button will be available on the right-hand side (shown below). Click the Export button to download the CSV file.
   

The CSV file will contain the following details (the CSV headers are shown in bold, below): 

• question: Displays each question in the questionnaire.
  
  Note: Questions that are in the Multiple Choice or Checkbox format will have multiple rows in the CSV file. The number of rows depends on how many answer options are available for the question.
• informational: If the question is marked as "informational", this column displays "TRUE". To learn more about informational questions, please see our Creating, Configuring, and Sending Questionnaires article.
• type: The type or format of the question: "Yes/ No/ N/A", Multiple Choice ("multi"), Free Form Text ("Free form"), or "Checkbox".
• answer_options: Displays each answer option available for the question.
  • If the question type is Free Form: The field will be blank.
  • If the question type is Multiple Choice: The question will have multiple rows in the CSV file and each answer option is displayed on a separate, but subsequent row. 
  • If the question type is Checkbox: The question will have multiple rows in the CSV file and each answer option is displayed on a separate, but subsequent row. 
  • If the question type is Yes/ No/ N/A: "Yes/ No/ N/A" is displayed.
• weight: This column only applies to checkbox questions. The weight of each answer option is displayed on separate, but subsequent lines. 
• correct_answer: Specifies the correct answer for the question.
  • If the question type is Free Form: The field will be blank.
  • If the question type is Multiple Choice: The question will have multiple rows in the CSV file and each answer option is displayed on a separate, but subsequent row. The row that contains the correct answer option displays "Selected" in this column.
  • If the question type is Checkbox: Checkbox questions can have multiple "correct" answers; therefore, this column will be blank. 
  • If the question type is Yes/ No/ N/A: The correct answer is displayed ("Yes", "No", or  "N/A").
• vendor_answer: Displays how the vendor responded to the question. 
  • If the question type is Free Form: The field will contain the vendor's response.
  • If the question type is Multiple Choice: The question will have multiple rows in the CSV file and each answer option is displayed on a separate, but subsequent row. The row that displays "Selected" represents the answer that the vendor selected.
  • If the question type is Checkbox: The question will have multiple rows in the CSV file and each answer option is displayed on a separate, but subsequent row. Checkbox questions allow vendors to select multiple answers. Therefore, this column will show "Selected" for each row that contains an answer option that the vendor selected.
  • If the question type is Yes/ No/ N/A: The answer that was selected by the vendor is displayed.
• score: The original score the vendor received for the question. If an administrator has modified this original score, the updated score is displayed in the current_score column (see below).
  
  For Checkbox questions only: This column will always show the maximum possible points (Max Score) that the user can receive for the question. To find the original score that the vendor received for a checkbox question, reference the weight and vendor_answer columns, collectively. 
• current_score: If you have modified the original score that the vendor received for the question, the updated score is displayed here. If the original score has not been modified, this field will be blank. To learn more about modifying scores, please see the Reviewing Questionnaires section, above. 
• comments: If the vendor has included any comments with their questions, their comments are displayed here. 
• issue: If an issue was created for the question, the Issue Description is shown here.
  
  For Multiple Choice and Checkbox questions: The issue description is duplicated on each repeating row.
• issue_status: If an issue has been created for the question, this column will display the current status of it. Options include: "open", "pending", or "closed".

Back to top