Vendor findings
TPRM → Findings
A finding is a gap identified in a vendor assessment. It carries a severity, a domain, an owner and a due date, and it has its own lifecycle independent of the assessment that raised it.
Lifecycle
open → in_remediation → remediated → verified_closed
with accepted for gaps you knowingly carry and overdue applied
automatically once the due date passes while the finding is still open.
The distinction that matters:
- Remediated is the vendor's claim that they fixed it.
- Verified closed is your confirmation that they did.
Only you can move a finding to verified closed. A vendor saying "done" does not close anything.
Working a finding
Record the remediation plan, the owner on your side, and the due date. Evidence the vendor supplies attaches to the finding, so the closure decision and what it rested on sit together.
Overdue and escalation
Overdue findings surface on the TPRM dashboard and in the reports, counted per vendor. A vendor with several overdue findings is a renewal conversation, not just a list entry.
Accepting records who accepted it and when. Use it when the business has consciously decided to carry the gap — not as a way to clear the list.