Admin Configuration Guide
Audience: Admins building and operating the Assessments module day-to-day
This is the working reference for building assessment templates, the different ways an assessment gets created, sharing and restricted access, and completion/notifications. See the Legal and Compliance Guide for the compliance context behind these settings, and the Technical Implementation Guide for the API and entity-trigger mapping detail.
Assessment Templates
A template is the reusable definition of what an assessment asks - a set of sections, each containing questions. Templates are managed from the Templates tab on the Assessments list itself (alongside the list of assessments), which supports filtering, grouping, and a source column so you can tell at a glance where a template came from (built manually, generated from a document, or a standard template Relyance provides).
Standard templates are available out of the box for common assessment types, including AI model intake and AI risk assessment - a starting point you can use as-is or customize rather than building a template from scratch.
Sections and questions
- Sections group related questions, can include their own description and an info tooltip for additional context, can be marked internal (hidden from external-facing/respondent views, for content your own team needs but a vendor respondent shouldn't see), and can be created, cloned, deleted, and reordered.
- Questions support several types, including free text, single/multi-select, and matrix (grid) questions. Matrix questions can also be configured as entity triggers with question mapping - see the Technical Implementation Guide for what that mapping does.
- Questions can carry an Additional Information element, giving respondents richer context alongside the question itself, beyond the base question text.
- Both question and section description fields support rich-text formatting, including an HTML source-editing mode for precise control over the underlying markup - see the Technical Implementation Guide for exactly what's supported and how sanitization works.
Template change tracking
Assessments record when the template they were built from has since been updated, so you can see the history of template changes applied to a given assessment - useful for understanding whether an assessment reflects your current question set or an older version of the template.
Creating assessments
An assessment is a template instantiated against something specific. There are several entry points:
- Manually, from the template library - pick a template and create a standalone assessment.
- From a ROPA / processing-activity record - create an assessment directly from the ROPA list, individually or via bulk actions across multiple records at once. Processing Activity Assessments are enabled by default.
- Against an AI model - create an assessment scoped to a specific AI model.
- Against a cataloged AI use case - AI Use Cases is a full assessment entity, with the same template and mapping support as any other entity type. A dedicated AI Use Cases area (Beta, select customers) lets you catalog your organization's AI use cases, generate assessments directly against one, view an audit trail of changes, and export a compliance package for each one.
- Programmatically, via the Assessment Workflow API - trigger a workflow that creates a vendor, creates an assessment against it, and shares it with stakeholders in a single call. See the Technical Implementation Guide.
- From an uploaded document - from the template list, click Upload, name the assessment, choose its type, and select a file (PDF, DOC, and similar) instead of building a template from scratch. You'll see progress feedback while Relyance processes the upload and a notification when the generated template is ready (or an error if the file couldn't be parsed); the result opens and edits like any other template.
Example: an AppSec-triggered vendor security review. A security team wires the Assessment Workflow API into vendor intake: the moment a new vendor needs review, a single call creates the vendor record, creates a security assessment scoped to it, and shares it with the vendor's security contact - no one on the team has to manually create the vendor, find the right template, or send the invite. See the Technical Implementation Guide.
Example: an AI governance review before launch. Before an internal AI tool goes live, a governance team logs it as an AI Use Case, runs the standard AI risk assessment template (or a custom one) against it, and - once complete - exports a compliance package for that use case. If the use case changes later, Attestations' Needs Review status and the Audit Log keep the original review honest rather than letting it go stale.
Managing the assessments list
The assessments list groups related assessments and auto-collapses groups by default, with expand/collapse-all controls and pagination for large volumes. Columns can be reordered, and your column order persists across the Inventory, ROPA, AI Governance, and Assessments grids. Bulk delete lets you remove multiple assessments at once; per-row actions (edit, delete) are available from the list itself.
Assessments dashboard
A dedicated dashboard surfaces SLA settings and status history across your assessments, so you don't have to open individual records to see where things stand. Every figure on the dashboard is clickable and opens the underlying records it counts, rather than being a static number.
Sharing & restricted access
Assessments can be shared with internal owners and invited external stakeholders. Where an assessment is restricted, access is gated by the specific email address(es) it was shared with - matching is case-insensitive, so Jane.Doe@Vendor.com and jane.doe@vendor.com are treated as the same recipient. Comments attached to individual questions let reviewers raise and resolve issues inline.
A generic shareable link (for example, one posted to an internal wiki rather than sent to a named stakeholder) isn't yet guaranteed to associate the completed assessment back to a specific entity - that reliability is still rolling out for generic links. If you need Attestations (below) to work for a vendor, processing activity, AI model, or AI use case, create the assessment directly against that entity rather than distributing it as a generic link, until your account team confirms generic-link mapping is available.
Completing assessments
Some assessment types gate the Complete action behind a prerequisite - for example, an assessment tied to a Data Processing Agreement won't move to Complete until that document has been uploaded. Assessment notifications are available to all customers; where Attestations (below) are enabled, a completed assessment can also flip to a Needs Review status if the entity it concerns changes afterward, so it doesn't go stale silently.
Attestations: pre-filling and pushing answers back
Where your account has Attestations enabled, assessments connect two-way to the vendor, product, processing activity, AI model, AI agent, MCP server, or AI SaaS vendor record they're run against:
- Template questions show their predicted target field and entity type before you even create an assessment from them, so you know up front what each question will read from or write to.
- On open, an assessment against an existing entity pre-fills every mappable question from what Relyance already knows, with a pre-fill banner that walks you through each auto-filled answer and clearly marks it as pre-filled rather than human-entered.
- On completion, you get an item-level before/after preview of exactly what will change on the source entity, and must confirm before anything is applied - nothing pushes silently.
- Every entity page gains an Attestations tab, alongside the existing Findings tab - Findings is what Relyance observed via scan or integration; Attestations is what a human told it via an assessment or contract. The two are kept structurally separate so you can always tell which is which for a given field.
- Each entity shows its overall discovery source, and each individual field shows which source most recently set that specific value; clicking into an Attestation opens a drawer linking to the exact assessment question (or contract clause) that produced it.
- If the entity changes after the assessment completed, the assessment moves to Needs Review, with a delta list showing exactly what changed per field - old value, new value, source, and timestamp. You can accept or override each change individually, and completing the review returns the assessment to Completed.
- If two sources disagree on the same field, you see what was overwritten and by which source, rather than a silent overwrite.
See the API Reference for the underlying API.
AI Assistant in Assessments
Distinct from Attestations (which pre-fills from data Relyance already holds about an entity), the AI Assistant answers assessment questions directly - matrix, multiple-answer, toggle, personal-data-type, and vendor questions - by reasoning over available context rather than only mapping to a known field. Its answers are flagged in the UI so you always know what it filled in versus what a human entered. An agent drawer, available on every assessment page, lets you follow the AI Assistant's reasoning as it works, with results reloading live, and you can ask it to find relevant assessments and templates.
Permissions
Any user with access to a given assessment can view its Audit Log; export permissions follow the same access rules as viewing the assessment. Broader access to creating, editing, and completing assessments is governed by your organization's role configuration in Relyance.