How to automate vendor onboarding at scale.
Vendor onboarding is automated at scale by removing the four manual steps that cause the delay: the initial risk check, the tiering decision, the questionnaire, and the chasing. A platform scans the supplier from the outside, assigns a tier, fills in the questionnaire from documents the supplier already holds, and follows up until it is complete. The reviewer then approves one pack.
Last reviewed by Darren Craig
How do we automate vendor onboarding at scale? Step by step
Every onboarding runs the same six steps. What changes is who does each one. The by-hand timeline is the one on our vendor onboarding audit.
| Step | By hand | What automates it |
|---|---|---|
| Intake | A request arrives by email or a procurement ticket and someone creates the supplier record. | An intake form or a procurement or ticket integration creates the record and starts the checks. |
| Initial risk check | Week 1: a questionnaire is sent and the team waits for a response before it knows anything. | An outside-in scan of the supplier’s domains, exposed services and breach history runs at intake, before anyone opens an email. |
| Tiering | Someone judges criticality by hand, often only after the questionnaire is back. | Rules on data, access and business criticality assign a tier at intake; low-risk suppliers are fast-tracked. |
| Questionnaire | Week 4: the full questionnaire is reviewed and cross-checked by hand. | Answers are pre-filled from the supplier’s SOC 2, ISO 27001 certificate and policies; the supplier confirms rather than writes. |
| Chasing | Weeks 2 to 3: follow-up emails for incomplete submissions. Weeks 5 to 6: gap remediation requests. | Automated follow-up until the questionnaire is complete, and gaps raised as tracked remediation items. |
| Approval | Weeks 7 to 8: approval documentation prepared and sign-off obtained. | One pack drafted from the evidence: tier, findings, gaps and recommendation. The reviewer approves or rejects it. |
The audit page puts the by-hand process at eight weeks from questionnaire to sign-off. Automation removes the waiting, not the decision: a person still approves every supplier.
What changes at 50, 150 and 500 new suppliers a year
The working, so you can replace our assumptions with your own.
Assume 18 internal hours per review by hand, the default in the audit calculator (whose range runs from 2 to 80 hours), and about 1,650 productive hours in an analyst year. These are assumptions, not measurements: put your own figures in the calculator.
- 50 new suppliers a year: 50 × 18 = 900 hours, about 0.5 of an analyst. Manageable by hand, but every review still waits weeks for answers.
- 150 new suppliers a year: 150 × 18 = 2,700 hours, about 1.6 analysts. This is where queues form and low-risk suppliers wait behind critical ones.
- 500 new suppliers a year: 500 × 18 = 9,000 hours, about 5.5 analysts. Not workable by hand without tiering, because most of those suppliers do not justify a full review.
Automation changes the unit of work. The team’s time stops scaling with the number of questionnaires and starts scaling with the number of approvals, and with the share of suppliers that tiering sends to full review.
Check the plan as well as the hours. RiskXchange Essentials includes 25 assessments a year, so 50 new suppliers a year needs most of them fast-tracked by tiering, or Professional, which includes 200. At 500 a year, Enterprise has unlimited assessments and unlimited vendors, from £75,000 a year. Essentials is £14,900 and Professional £31,500 (pricing).
Which suppliers can be fast tracked?
An example rule set. Adapt the thresholds to your own risk appetite and have them approved, because an auditor will ask who set them.
| Tier | Example rule | Onboarding route |
|---|---|---|
| Low | No access to your systems or personal data, low spend, easily replaced | Fast track: outside-in scan and sanctions check only; approve on a clean result |
| Medium | Limited data or system access, not supporting an important business service | Short questionnaire pre-filled from existing evidence; approve with any gaps tracked |
| High | Personal or confidential data, or network access | Full questionnaire, evidence review and contract clauses checked before approval |
| Critical | Supports an important business service or a critical or important function, or is hard to replace | Full review plus exit plan and concentration check; senior sign-off |
A supplier moves tier when its service changes. Re-run the rules at contract renewal and when the outside-in scan shows a material change.
Tools that automate vendor onboarding
Alphabetical. What each vendor’s own pages say it automates, checked 14 November 2026. We sell one of these, so test every claim in a demo, ours included.
| Platform | Intake and tiering | Questionnaire | Procurement and ticketing |
|---|---|---|---|
| OneTrust | Automated intake screening against risk rating and compliance databases; auto-approval for low-risk third parties (source) | AI ingests external risk evidence and generates questionnaire responses | ServiceNow integration listed (source) |
| ProcessUnity | An inherent risk questionnaire in the new vendor request tiers the supplier and scopes the due diligence (source) | Assessment Autofill drafts answers from documents the vendor already has (source) | Coupa, SAP Ariba, Ivalua; ServiceNow, RSA Archer, Jira (source) |
| RiskXchange | Intake agent creates the record; outside-in scan and Smart Risk Tiering at intake (The Agency) | Pre-populated from SOC 2, ISO certificates and prior questionnaires, then cross-checked against the scan (Smart Assessments) | Remediation in ServiceNow, Jira or Asana; REST API, webhooks and MCP server (Integrations) |
| Vanta | An intake form creates the vendor in Procurement status and uses its category to help auto-score inherent risk (source) | Pulls findings from vendors’ SOC 2 reports, DPAs and questionnaires (source) | Syncs procurement tickets from Jira or Asana, and Zip requests |
| Whistic | Intake captures how the vendor will be used, what it can access and how critical it is (source) | Reads vendor documents and maps the evidence to your controls, showing the source behind every answer | Not confirmed |
“Not confirmed” means we found no statement on the vendor’s own site. Ask in the demo.
Where onboarding starts and where approval is recorded
Automation only helps if it starts where requests already arrive.
Start from procurement or a ticket. The new supplier request should open the onboarding automatically, either from the procurement system (a purchase requisition or a new vendor form) or from a service desk ticket. If staff have to re-enter the request into a second tool, onboarding starts late and some suppliers never enter it at all.
Feed the tier back. The tier and the status (in review, approved, rejected) should flow back to the request, so procurement knows when it can issue the purchase order without asking.
Record the approval on the supplier record. Who approved, when, on which evidence and at which tier. That record is what an auditor samples, and for EU financial firms it is part of what feeds the DORA register of information.
In RiskXchange the intake agent creates the record and starts the scan and tiering, remediation items open in ServiceNow, Jira or Asana, and the REST API and webhooks connect the request system of your choice. See integrations.
Onboarding, answered.
How do we automate vendor onboarding at scale?
How long should vendor onboarding take?
Can low risk suppliers skip the security questionnaire?
Who should sign off a new vendor?
What evidence does an auditor expect from vendor onboarding?
Related reading.
See what your backlog is costing.
Run the onboarding audit with your own volumes, then book 15 minutes to see which of your suppliers could be fast tracked.