Create a small supplier assurance and third-party risk appli — Specification
Product overview
A comprehensive third-party risk management (TPRM) and supplier assurance platform. The application enables procurement teams to onboard vendors, suppliers to self-manage profiles and compliance certificates via a mobile-friendly portal, and risk reviewers to evaluate cyber, privacy, financial, and operational risks. It supports structured approval workflows for business owners, remediation tracking, automated expiration alerts, and robust audit logging.
Problem statement
Procurement and security teams struggle to manage third-party risk due to fragmented email threads, untracked compliance certificates, and manual risk assessment processes. This leads to unmitigated vendor risks, missed certificate expirations, and lack of auditability in vendor engagement approvals.
Target users & roles
- Procurement Team Member — Responsible for initiating vendor onboarding, monitoring compliance registers, and reviewing overall supplier performance reports.
- Supplier Representative — External user responsible for maintaining their company profile, uploading compliance certificates, and responding to remediation plans.
- Security & Compliance Reviewer — Internal risk specialist who evaluates cyber, privacy, financial, and operational risks, assigns scores, and defines remediation plans.
- Business Owner — Internal sponsor of a supplier engagement who reviews risk assessments and formally approves or rejects vendor engagements.
- Administrator — Manages system access, configures risk assessment templates, and monitors system-wide audit logs.
User journeys
Supplier Onboarding and Risk Assessment Lifecycle
- Procurement Team Member logs in and triggers an onboarding invitation by entering the Supplier's name and primary contact email.
- Supplier Representative receives an email invite, registers on the mobile-friendly portal, completes their profile, and uploads their SOC2 certificate.
- Security & Compliance Reviewer is notified, reviews the uploaded SOC2 certificate, fills out the risk assessment template, and assigns scores for cyber and privacy risks.
- Business Owner reviews the completed risk assessment score on their dashboard and approves the engagement.
- System logs the approval in the Audit Log and sends an automated confirmation to the Procurement Team Member.
Functional requirements
FR-01: Supplier Onboarding and Profile Management
Allows procurement teams to invite new suppliers and enables suppliers to maintain their profile information and upload compliance certificates to ensure a centralized repository of vendor data.
Acceptance criteria:
- Given a Procurement Team Member is on the Onboarding screen, when they submit a supplier name and valid email address, then an invitation token is generated and an email is sent to the supplier.
- Given a Supplier Representative accesses the portal via an invitation token, when they complete the profile form and upload a PDF certificate with an expiration date, then the certificate status is saved as 'Pending Review'.
FR-02: Multi-Dimensional Risk Scoring
Enables Security & Compliance Reviewers to evaluate and score suppliers across cyber, privacy, financial, and operational risk dimensions to calculate an overall risk rating.
Acceptance criteria:
- Given a Security & Compliance Reviewer is assessing a supplier, when they input scores of 80, 70, 90, and 80 for cyber, privacy, financial, and operational risks respectively, then the system calculates and displays the overall risk score as 80.
FR-03: Engagement Approval Workflow
Provides Business Owners with a structured workflow to approve or reject supplier engagements based on completed risk assessments, ensuring accountability.
Acceptance criteria:
- Given a Business Owner is viewing a pending engagement with a completed risk assessment, when they click 'Approve' and enter an optional approval comment, then the engagement status transitions to 'Approved' and the decision is locked.
FR-04: Remediation Workflow and Collaboration
Allows reviewers to assign remediation plans to suppliers for identified gaps, supporting comments and evidence attachments to track resolution progress.
Acceptance criteria:
- Given a Security & Compliance Reviewer creates a remediation plan with a due date, when the Supplier Representative uploads a PDF evidence file and adds a comment, then the plan status updates to 'Under Review' and the reviewer is notified.
FR-05: Expiring-Document and Reassessment Notifications
Automatically monitors certificate expiration dates and scheduled reassessment dates, sending proactive notifications to prevent compliance gaps.
Acceptance criteria:
- Given a certificate with an expiration date exactly 30 days in the future, when the daily notification job runs, then an email alert is dispatched to both the Supplier Representative and the assigned Procurement Team Member.
FR-06: Searchable and Filterable Registers
Provides a centralized, high-performance register of all suppliers, certificates, and assessments with advanced search and filtering capabilities.
Acceptance criteria:
- Given a Procurement Team Member is on the Supplier Register, when they type a supplier name in the search bar and filter by status 'Active' and risk level 'High', then the list updates in real-time to display only matching records.
FR-07: CSV Import/Export and Performance Reporting
Enables bulk data operations and executive reporting by allowing users to import supplier lists via CSV and export registers and performance reports.
Acceptance criteria:
- Given an Administrator uploads a valid CSV file containing supplier names and emails, when they click 'Import', then the system creates supplier records for all valid rows and displays a summary of imported and failed records.
- Given a Procurement Team Member is on the Performance Report screen, when they click 'Export CSV', then a CSV file containing all supplier performance metrics is generated and downloaded.
Screen / page inventory
- Procurement Dashboard & Register — Central workspace for procurement teams to monitor vendor compliance, search the supplier register, and initiate onboarding.
- Elements: Onboard Supplier Button (opens modal for name and email), Search and Filter Bar (filters by status, risk score, and certificate status), Supplier Data Table (displays supplier name, overall risk score, active engagements, and certificate status), Export CSV Button (downloads current filtered view)
- Mobile-Friendly Supplier Portal — Responsive interface for suppliers to manage their profile, upload certificates, and view remediation tasks.
- Elements: Company Profile Form (fields for address, contact info, and business details), Certificate Upload Widget (drag-and-drop area for PDFs with title and expiry date inputs), Remediation Tasks List (displays open remediation plans, due dates, and status), Collaboration Panel (allows posting comments and uploading evidence files)
- Risk Assessment Workspace — Dedicated screen for Security & Compliance Reviewers to evaluate risk dimensions and document findings.
- Elements: Risk Scoring Panel (numeric inputs for Cyber, Privacy, Financial, and Operational risks), Evidence Viewer (side-by-side view of supplier-uploaded certificates), Remediation Plan Creator (form to define remediation tasks, owners, and due dates), Internal Comments Section (for reviewer-only collaboration)
- Engagement Approval Hub — Interface for Business Owners to review risk assessments and execute engagement decisions.
- Elements: Engagement Details Card (displays contract value, scope, and associated supplier), Risk Summary Widget (visual breakdown of cyber, privacy, financial, and operational scores), Approval Action Buttons (Approve / Reject with mandatory comment field on rejection), Audit Trail Timeline (shows history of assessments, edits, and comments)
Data model
User
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
email |
string | Unique, indexed, validated email format. |
role |
string | Enum: 'procurement', 'supplier', 'reviewer', 'business_owner', 'admin'. |
name |
string | Full name of the user. |
is_active |
boolean | Soft-delete flag. ASSUMED: Users are soft-deleted to preserve audit logs. |
Supplier
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
name |
string | Unique legal name of the supplier. |
status |
string | Enum: 'invited', 'onboarding', 'active', 'suspended'. |
created_at |
datetime | Timestamp of creation. |
SupplierUser
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
user_id |
foreign_key->User | References the User entity. |
supplier_id |
foreign_key->Supplier | References the Supplier entity. |
Certificate
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
supplier_id |
foreign_key->Supplier | References the Supplier entity. |
title |
string | Name of the certificate (e.g., SOC2 Type II). |
file_url |
string | S3 or secure storage URL of the uploaded document. |
expiry_date |
datetime | Expiration date of the certificate. |
status |
string | Enum: 'pending', 'approved', 'expired', 'rejected'. |
Engagement
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
supplier_id |
foreign_key->Supplier | References the Supplier entity. |
business_owner_id |
foreign_key->User | References the User entity (must have role 'business_owner'). |
title |
string | Name of the engagement/project. |
estimated_cost |
decimal | ASSUMED: Cost tracking is required for engagement approvals. Nullable. |
currency |
string | ASSUMED: USD default. ISO currency code. |
status |
string | Enum: 'pending_assessment', 'pending_approval', 'approved', 'rejected'. |
RiskAssessment
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
supplier_id |
foreign_key->Supplier | References the Supplier entity. |
engagement_id |
foreign_key->Engagement | References the Engagement entity. Nullable if general supplier assessment. |
reviewer_id |
foreign_key->User | References the User entity (must have role 'reviewer'). |
cyber_score |
integer | Value from 0 to 100. |
privacy_score |
integer | Value from 0 to 100. |
financial_score |
integer | Value from 0 to 100. |
operational_score |
integer | Value from 0 to 100. |
overall_score |
integer | Calculated average of the four dimensions. |
status |
string | Enum: 'draft', 'completed'. |
version |
integer | ASSUMED: Optimistic locking version field to prevent concurrent overwrite issues. |
RemediationPlan
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
risk_assessment_id |
foreign_key->RiskAssessment | References the RiskAssessment entity. |
description |
string | Details of the remediation requirements. |
due_date |
datetime | Deadline for the supplier to resolve the issue. |
status |
string | Enum: 'open', 'under_review', 'resolved', 'overdue'. |
Comment
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
author_id |
foreign_key->User | References the User entity. |
risk_assessment_id |
foreign_key->RiskAssessment | References the RiskAssessment entity. Nullable. |
remediation_plan_id |
foreign_key->RemediationPlan | References the RemediationPlan entity. Nullable. |
body |
string | Text content of the comment. |
created_at |
datetime | Timestamp of creation. |
AuditLog
| Field | Type | Notes |
|---|---|---|
id |
string | Primary key, UUID format. |
user_id |
foreign_key->User | References the User entity who performed the action. |
action |
string | Description of the action (e.g., 'Approved Engagement', 'Uploaded Certificate'). |
entity_type |
string | The name of the modified entity (e.g., 'Engagement', 'Certificate'). |
entity_id |
string | The ID of the modified entity. |
timestamp |
datetime | Timestamp of the action. |
Business rules
- The overall_score of a RiskAssessment must be calculated as the mathematical average of cyber_score, privacy_score, financial_score, and operational_score, rounded to the nearest integer.
- An Engagement cannot transition to 'Approved' status if its associated RiskAssessment overall_score is below 50, unless there is at least one active RemediationPlan with status 'resolved' or 'under_review'.
- A Certificate's status must automatically transition to 'expired' when the system current_date is strictly greater than the certificate's expiry_date.
Permissions
| Role | Capabilities |
|---|---|
| Procurement Team Member | create:Supplier; read:Supplier; read:RiskAssessment; read:Engagement; import:Supplier; export:Supplier |
| Supplier Representative | read:Supplier; update:Supplier; create:Certificate; read:Certificate; update:RemediationPlan; create:Comment |
| Security & Compliance Reviewer | read:Supplier; create:RiskAssessment; update:RiskAssessment; create:RemediationPlan; update:RemediationPlan; create:Comment |
| Business Owner | read:Supplier; read:RiskAssessment; update:Engagement; create:Comment |
| Administrator | create:User; read:User; update:User; delete:User; read:AuditLog |
Integrations
(none)
Non-functional requirements
- Performance: The Supplier Register search and filter queries must return results in less than 500ms under a concurrent load of 100 users.
- Security: All uploaded certificates and evidence files must be encrypted at rest using AES-256 and scanned for malware upon upload.
- Mobile Responsiveness: The Supplier Portal must achieve a minimum score of 90 on Google Lighthouse Mobile Usability audits.
Edge cases
- A Certificate expires while a Risk Assessment is actively in 'draft' status: The system must flag the assessment with an 'Outdated Evidence' warning banner and block the reviewer from transitioning the assessment to 'completed' until a new certificate is uploaded or an override is authorized.
- Two reviewers attempt to update the same Risk Assessment concurrently: The system must use the 'version' field to perform optimistic concurrency control, rejecting the second submission with a conflict error and prompting them to refresh.
- A Supplier Representative user is deleted or deactivated: The system must soft-delete the user record (setting is_active to false) to preserve all historical audit logs, comments, and uploaded certificates associated with that user.
Out of scope
- Direct integrations with external business registries or credit bureaus (e.g., Dun & Bradstreet) for automated financial scoring.
- Automated vulnerability scanning or penetration testing of supplier domain names.
Assumptions & open items
Assumed:
- Users are soft-deleted (using the is_active flag) to preserve historical audit logs and data integrity.
- Risk scores are numeric values from 0 to 100, where 100 represents the lowest risk (highest assurance) and 0 represents the highest risk.
- Engagement cost tracking is required to assist Business Owners in evaluating risk-to-value ratios during approval.
- The system uses optimistic concurrency control via a version field on the RiskAssessment entity to prevent concurrent overwrite issues.
- Notifications are delivered via email and in-app alerts, using standard SMTP protocols.
Coverage notes
- Functional requirements: 7 (with acceptance criteria: 7)
- Open assumptions: 5 (unresolved/conflicted: 0)
- Entities in data model: 9
- Screens: 4, Roles: 5, Journeys: 1