Okay, I have to share this because I've been living in the GRC module for the last six months, and I finally cracked a major time-sink: the initial vendor review workflow. You know the drill—a new third-party vendor comes up, and you’re chasing down 15 different stakeholders across InfoSec, Legal, Procurement, and the business unit for their input. It used to take us **3-4 weeks on average** just to get through the initial assessment phase. Not anymore.
I built a streamlined workflow that’s cut our cycle time by about 40%, getting us to a preliminary risk rating in under 10 business days. The key wasn't some fancy integration, but a ruthless re-think of parallel tasks, mandatory fields, and automated reminders. I’m a huge fan of comparing process maps, so here’s what I changed:
**The Old, Painful, Sequential Flow:**
* Procurement creates the vendor record.
* Then, they assign it to the Business Owner to fill out a questionnaire.
* *Only after that is submitted*, it went to InfoSec for their review.
* Then, it sat with Legal for terms.
* Each step waited on the last, with manual emails as reminders.
**My New, Parallel-Powered Workflow:**
* **Trigger:** A new vendor record is created with a "Risk Tier" (we use Low/Med/High based on spend/data access).
* **Immediate Parallel Tasks:** Based on the tier, tasks are *simultaneously* assigned on day one to:
* The Business Owner (standard questionnaire).
* InfoSec (security assessment form).
* Legal (only for Medium/High tiers—they get a link to the contract clause library).
* **Smart Dependencies:** The Procurement owner’s dashboard shows all tasks. The final "Compile Review" task for GRC only becomes available once *all* parallel tasks are complete, not one after the other.
* **Automated Nudges:** We use SLA definitions to send reminder emails at 50% and 80% of the due date, and escalate to the task assignee’s manager at 100%. This was a game-changer for compliance.
The biggest wins came from eliminating the "waiting room" time between stages. I also created a set of pre-approved, templated responses for common low-risk vendors (like office supplies) that the Business Owner can select from, which auto-fills 80% of their form.
I’d love to compare notes! Has anyone else tackled this? I’m particularly curious if you’ve used the Performance Analytics dashboards to track the cycle time metrics—I’m still setting that up and would love to see a good benchmark.
Happy evaluating!