Smarter Week

How to automate it

How to automate “run risk and due diligence checks on new vendors”

Here are 2 ways to spend less time on this, best first. Each comes with steps you can follow today and, for AI fixes, a prompt to copy.

60 min
typically, once a week
55%
of the time can be automated
Some setup
to set up

Fix 1 of 2

Software featureBest fix

Tier vendors and run due diligence in a vendor risk tool

Vendor risk tools send the right questionnaire by risk tier, collect certificates and insurance, and remind you when they expire, so low-risk vendors do not get the full treatment.

Typically saves about 45% of the time6 h to set up
  1. 1Define three tiers (e.g. data access, spend, criticality) and what each needs.
  2. 2Use Vanta, Drata or OneTrust vendor risk, Whistic, Mitratech Prevalent or UpGuard.
  3. 3Let vendors upload documents through the portal.
  4. 4Set expiry alerts for certificates and reports.

Tools: Vanta Vendor Risk Management · OneTrust Third-Party Risk · Whistic · Mitratech Prevalent · UpGuard

Fix 2 of 2

AI

Have AI summarize a vendor's SOC 2 report and flag exceptions

AI can read a 100-page SOC 2 or questionnaire and pull out scope, exceptions, carve-outs and the controls you are expected to run. You decide whether the risk is acceptable.

Typically saves about 45% of the time5 min to set up
  1. 1Use an AI tool approved for confidential documents (vendor reports are under NDA).
  2. 2Upload the report and use the prompt below.
  3. 3Check every exception it lists against the report.
  4. 4Record your decision and any follow-ups in the vendor file.
Prompt to copy
Summarize the attached [SOC 2 TYPE II / ISO / QUESTIONNAIRE] for [VENDOR]. Give: report period and scope, which systems are covered and excluded, subservice organizations carved out, every exception or qualified opinion with page reference, complementary user entity controls we must run, and anything relevant to our use case: [DESCRIBE WHAT DATA THEY WILL HANDLE]. Do not give an overall approve/reject.

Tools: Enterprise ChatGPT, Claude, Gemini or Microsoft Copilot (approved for confidential data) · Vanta or Drata AI document review

Who does this task

Roles in our library that list this as one of their common tasks. Each guide covers the rest of that role’s week.

Compliance managerProcurement / purchasing specialist

HourLeak · the 8-minute work audit

How many hours does this cost you?

The free 8-minute check works out where your week goes and gives you your top fixes. The team scan does the same for everyone and adds it up, so you know which leaks to fix first.

Take the free check Scan my team, $49

Answers are anonymous. Leaders only see team totals.

Other common tasks for Compliance managers