Hi everyone, new here and hoping for some advice. 😊
I’m helping my team evaluate OneTrust for third-party risk. We’re running into a specific problem: our vendor assessments seem to just sit in a ‘review’ status forever. The workflow feels unclear. Are we missing a step, or is there a common setup issue that causes this?
For example, we send a questionnaire to a vendor, they complete it, but then it just stays in ‘review’ and no one gets notified to move it forward. Is there a setting for auto-advancement, or does it always require manual approval? Any tips would be great.
Ah, the classic "stuck in review" limbo. I've seen this exact scenario more times than I can count, and it's almost always a workflow configuration issue, not a bug.
The key thing to understand is that OneTrust's workflow engine for Vendor Risk is highly customizable but not prescriptive. When you say "no one gets notified to move it forward," that tells me your workflow probably doesn't have a "reviewer" role or task assigned at that stage. The system sends the initial questionnaire, the vendor submits it, and then... nothing. It's likely sitting in a "Submitted" or "Under Review" status that doesn't have an automatic *task assignment* attached to it. You need to check the specific workflow stage in the OneTrust admin console. Look for a "Review" step and see if it's configured to assign a task to a person, a role (like "Risk Analyst"), or a team. If that assignment is missing, the system has no one to notify, so it just waits.
There's no true "auto-advancement" in the sense of skipping human judgment. You *can*, however, configure it so that upon vendor submission, a task is instantly created and assigned, with email notifications sent. Sometimes teams forget to enable the "Send Task Assignment Email" setting on that particular step. Also, check if there's an "Escalation Rule" set up for that task; if it's unactioned after X days, it can escalate to someone else.
My advice? Go into your assessment template's workflow diagram and trace the path from "Vendor Completes Questionnaire." Look at the very next node. Is it a task? If it's just a status gate with no outgoing connections, that's your problem right there. You'll need to wire it up to a "Review Task" node that assigns to someone. Hope that helps untangle it! 😊
Prod is the only environment that matters.
That "review" status is a static queue, not a dynamic step. The system doesn't automatically assign the review task to a person; it's just a label. You need to configure an action, like "Create Task," on the status transition from "Questionnaire Completed" to "Under Review." This task should be assigned to a specific role or individual.
Check the workflow's "On Status Change" rules. If there's no rule creating a task for the reviewer, the assessment will sit there indefinitely with no notification. It's a design gap, not a passive approval step.
Show me the benchmarks.
Exactly right. It's a bit of a gotcha if you're expecting the system to automatically prompt someone. That "On Status Change" rule is the critical piece.
One nuance I've seen teams miss is assigning that task to a specific *person* instead of a *role*. If John Smith is named directly and then leaves the company, the tasks queue up for a ghost. It's better to tie it to a role, like "Vendor Risk Analyst," and make sure that role is mapped to active users in the system. That gives you some resilience.
Keep it civil, keep it real.