Configure Vendor Risk Scoring, Fields, and Documents

Sprinto’s Configuration tab in the Vendors section allows you to tailor your vendor risk management framework to suit your compliance and operational needs. From defining custom scoring logic to managing metadata fields and documents, the configuration workspace ensures your vendor workflows are aligned with internal policies and industry frameworks.

1. Configure Vendor Risk Auto-Scoring

Sprinto provides a default scoring model that you can customise by editing or adding your own risk factors.

Steps:

1. Navigate to Data Library > Vendors > Configuration.

2. Under Vendor Risk Auto-Scoring, click Manage.

1. Configure the Vendor risk factors by:

   1. Enabling/Disabling the risk factor by using a toggle.

   2. Add a new risk factor value by adding value name, score and description.

   3. Edit Risk factor value, description and score.

   4. Archive the risk factor value

1. To add a new factor:

   • Scroll to the bottom and click Add Risk Factor.

• Choose a response type (single or multi-select).

• Define scoring values and click Add.

2. Enable AI-Powered Due Diligence

Sprinto AI helps you automatically evaluate security documents submitted by vendors.

Steps:

1. In the Configuration tab, locate the Automate Due Diligence using Sprinto AI section.

2. Click Manage to see details of AI-supported frameworks (e.g., SOC 2, ISO).

3. Enable Sprinto AI for supported documents.

3. Manage Custom Fields for Vendors

Custom fields allow you to capture organisation-specific metadata (e.g., business unit, compliance contact, renewal date).

Steps:

1. In the Configuration tab, scroll to Custom Fields.

2. Click Manage.

1. You’ll be redirected to Settings > Custom Fields.

2. To learn about this in detail refer to the Custom Fields document.

4. Define Shared Vendor Documents

You can predefine a list of documents that must be collected from vendors during due diligence.

Steps:

1. In the Configuration tab, find the Documents for Vendors section.

2. Click Manage.

3. Add, edit, or remove required document types.

   • Examples: SOC 2 Report, Penetration Test Report, Privacy Policy

4. Changes apply across all vendors.