> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt
> Use this file to discover all available pages before exploring further.
# How to run an assessment
> A step-by-step walkthrough of the full assessment lifecycle, from getting the vendor into Coverbase to exporting the final report.
This guide is part of the [User Guides](/user-guides/overview) collection. It follows one vendor through the whole assessment lifecycle, screen by screen. For the shorter version, see the [Assessment quick reference](/user-guides/assessment-quick-reference). For the wider analyst workflow (Radar, contracts, obligations), see the [Analyst and reviewer guide](/user-guides/analyst-reviewer).
## What's in this guide
Each part stands on its own, so you can jump to the stage you need.
Intake, or the manual New Vendor wizard.
One dialog: vendors, plan, name.
Five routes into the document set.
The panel, the tabs, the Summary.
Bulk actions and individual results.
Draft, send, reanalyze.
Per-domain reviewers and gating.
Outcome, status, reassessment date, report.
## Before you start
You will move faster with these to hand:
* The vendor name, website, and a security contact email address.
* Any evidence you already hold: SOC 2 report, policies, pen test results, certificates of insurance.
* The vendor's Trust Center URL if they publish one. Adding it to the vendor record lets Coverbase pull documents straight from the trust center later, saving a round trip.
* An Assessment Plan that matches the depth of review you need. Plans bundle the control sets, questionnaires, and collection method, so choosing the right one is most of the setup.
* Permission to create vendors and assessments. If a button described here is missing, check your role with an administrator.
## Two terms worth pinning down
**Inherent risk** is the risk a vendor introduces based on what they do: the data they touch, the systems they connect to, the scope of the engagement. It is established before any evidence is reviewed.
**Residual risk** is what remains once their controls, certifications, and documentation have been evaluated. The assessment is what moves you from one to the other.
An **Assessment Plan** is a reusable template defining what an assessment evaluates. Plans are managed centrally, so most users pick one rather than building an assessment up field by field.
***
## Part 1: Get the vendor into Coverbase
An assessment attaches to a vendor record, so the vendor has to exist first. There are two ways to get one in, and the difference between them matters more than it first appears.
* **The Intake module**: the standard path. A requester submits the vendor through a portal, answers a short set of questions, and Coverbase produces an inherent risk score as a by-product. You end up with a vendor record and a risk profile in one pass.
* **Manual creation**: the New Vendor wizard in the dashboard. Faster if you only need the record, but it does not establish inherent risk on its own.
**If the vendor is already in Coverbase.** Check whether it already carries an inherent risk score. If it does, you need neither path. Skip straight to [Part 2](#part-2-create-the-assessment) and create the assessment. Re-running intake on a vendor that already has a current risk profile just duplicates work.
### Path 1 (recommended): through the Intake module
Intake determines how much risk a vendor introduces before anyone looks at their documentation. It answers two questions: what is the use case, and what is the scope?
**Why this is the better path.** The inherent risk result drives which control sets apply and how deep the assessment goes. A consulting vendor with no system access should not be assessed like a core processor, and intake is what tells Coverbase the difference.
Intake is completed by the requester (the business owner asking for the vendor) through a portal separate from the main dashboard. It runs in three steps: **Select Vendor**, **Additional Information**, **Review Questionnaires**.
You need your organization's intake link. Opening the intake path without it returns "Unable to identify intake portal. Please use the link provided by your organization." Find the link under **Intake → Request new vendor**.
Enter the vendor name, or use **Help Me Choose** if you are still comparing options, then pick the use cases that apply. Coverbase generates these suggestions for the specific vendor, and you can add your own in the custom answer field.
Below, **Pre-Qualification** runs a quick analysis and, importantly, checks whether you are about to duplicate a vendor you already have. If it finds a match it says so plainly and offers **Not my vendor** if it has guessed wrong. It also surfaces existing vendors in good standing that might already cover the use case, along with their current use cases, services, and tags.
**Worth pausing here.** The duplicate check is the cheapest risk reduction in the whole process. If Coverbase says the vendor is already onboarded, or that an approved vendor already covers the need, that is usually the end of the request. It is also the same check that tells you whether you can skip intake entirely.
**Select Services or Product Lines** is optional. Choose the specific services you will be evaluating, or add one with **+ New Service**. Scoping here keeps the assessment focused on what you are actually buying.
The **Confirm** section follows, where you can check the details Coverbase gathered and attach any supporting documents you already hold: email threads, proposals, SOWs.
Step 2 is headed **Additional Information**. Coverbase asks roughly four questions, generated for this vendor and deliberately narrow. They cover only what cannot be determined from public sources. In practice they establish whether personal data is involved, the size of the spend, whether you are in a regulated industry, and how deeply the vendor will integrate.
Each has a few preset answers plus a free-text option if none fits.
Step 3 is headed **Review Questionnaires**. Rather than making the requester complete a long inherent risk questionnaire, Coverbase fills it in, often twenty or more responses, and tells you which ones need a human.
Three tabs across the top split the work: all responses, the ones still needing an answer, and the ones flagged for review. Work the flagged ones first.
Every response carries:
* **A confidence badge**: green *High confidence* where the evidence was clear, amber *Review this response* where it was not.
* **Reasoning**: why Coverbase chose that answer, with links to the sources it used. Expand it with **Read more**.
* **Answered / Reviewed checkboxes**: track your way through the list.
* **Select supporting documents**: optionally attach evidence to a response.
**Human in the loop.** Autofilled answers are a starting point, not a verdict. Anything flagged for review is flagged because Coverbase is not confident, and the Reasoning will usually tell you exactly what was missing.
When every questionnaire reads **All done**, the panel switches to **Ready to Submit**. A summary of the vendor and any uploaded documents sits on the right so you can sanity-check before committing.
A risk analyst reviews the submission before it becomes an assessment, and can edit responses, ask the requester for clarification, or accept it and launch the assessment. At that point the vendor exists, carries an inherent risk score, and is ready for [Part 2](#part-2-create-the-assessment).
### Path 2 (alternative): creating the vendor manually
Use this when you only need the record: a vendor being logged for administrative reasons, a supplier inherited from elsewhere, or a case where you already know the risk profile and will set it yourself.
**The trade-off.** Manual creation does not produce an inherent risk score. Until one is set, the assessment has nothing to calibrate its depth against, and the risk-domain view will have gaps. If you want that calibration, use Path 1 instead.
Go to **Vendors** in the left-hand navigation. The page has four tabs (Vendors, Services, Engagements, and Nth Parties), and you want the default **Vendors** tab. Click **+ New Vendor** at the top right. A three-step modal opens.
The search field reads *Select from existing vendors or create new…*. Start typing and Coverbase Entity Intelligence matches against its own database, labelling each result as a **Vendor** or a **Product**. Selecting a match pre-fills the details.
If there is no match, choose `Create vendor from scratch: "{your vendor}"`. Click it or press Enter.
This step is headed **Modify Vendor Details**. If Entity Intelligence had data, most fields are already populated. Otherwise click **AI Autofill** to have Coverbase search the web, then correct anything it got wrong.
Only **Vendor Name** is required, but the rest save work later:
* **Website, Description, HQ Location, Use Cases**: context the AI draws on during assessment.
* **Security Contact Email**: used when Coverbase contacts the vendor.
* **Trust Center URL**: enables **Retrieve from Trust Center** in [Part 3](#part-3-collect-the-evidence).
* **Services**: you can then assess a single service rather than the whole vendor, which keeps scope tight.
* **Vendor Contacts**: these pre-fill every document request and follow-up you send.
* **Tags**: tags can drive which control sets apply, so if you tag by tier, do it now.
* **Risk Analysts, Relationship Owners, Watchers**: ownership and notification.
Step 3 is headed **Fill in additional fields** and shows whatever custom fields your organization has defined: contract amounts, audit dates, department, SLA, and so on. None are mandatory. Click **Create Vendor** and you land on the Vendor Overview page.
**Abandoning the wizard.** Closing part-way through prompts "Discard changes?" with **Keep editing** and **Close and discard**. Discarding leaves no partial vendor behind.
***
## Part 2: Create the assessment
**Simpler than it looks.** Assessment setup is a single dialog. Control sets and questionnaires are not chosen assessment by assessment. They come from the Assessment Plan you select.
Go to **Assessments** and click **+ New Assessment** at the top right. The list shows each assessment's outcome, score, status, auto-review progress, and both risk figures.
Click **+ Add vendor…** and pick the vendor, then optionally narrow to specific services. You can add more than one vendor, and each gets its own assessment from the same plan, which is the efficient way to start a batch of annual reviews. The button reads **Create Assessments** for that reason.
This single choice determines what the assessment evaluates. The dropdown defaults to **None** and lists your saved plans. Selecting one shows a summary beneath it: how many control sets and questionnaires it carries, whether documents are collected manually or automatically, whether it targets residual risk, and who reviews it.
Read that summary before you continue; it is the fastest way to catch a plan that is heavier or lighter than the vendor warrants. **Configure** opens the plan itself if you need to inspect or change it.
Leaving the plan on **None** creates an assessment with no control sets attached, which is rarely what you want.
**Choosing a plan.** Plans built on your own control sets usually produce fewer and more relevant issues than a broad third-party questionnaire, which can run to several hundred expectations. Start with your own and add breadth only where you need it.
Expand **Customize assessment name**. Names are generated from a template rather than typed by hand (the default produces something like "2026 HubSpot initial"), and a live example shows the result as you edit. Leave it alone unless you have a reason to change it; consistent names are what make three hundred assessments searchable a year from now.
Click **Create Assessments**.
***
## Part 3: Collect the evidence
An assessment is only as good as its evidence. Open the **Documents** tab. A **Collection Mode** badge shows whether this assessment is collecting manually or automatically, and five routes are offered. They combine freely, and each card tells you how much is available before you click.
* **Import from existing vendor docs**: anything already on the vendor profile. Fastest route for a reassessment.
* **Request from vendor**: manages the assessment portal, and shows the portal's current status so you can see where the vendor has got to.
* **Request automatic collection**: switches this assessment to automatic collection.
* **Import from Coverbase Library**: curated documents Coverbase already holds for this vendor. Check the count; for well-known vendors it is often substantial.
* **Retrieve from Trust Center**: pulls from the vendor's public trust center. Only available with a Trust Center URL on the vendor record.
Below the cards, **Upload vendor documents** takes files you hold yourself.
A sixth route needs no collection at all: where a control set allows it, the AI researches the public web while evaluating a control. That evidence is filtered on publisher accountability before it can be cited, and every accepted page carries its grade and its age. See [Evidence quality and source credibility](/user-guides/evidence-quality).
The vendor gets a branded portal with a due date, your message, and a checklist of what you need: questionnaires and document requests, with required items marked. They cannot submit until the required parts are done, and progress is visible to both sides.
When they upload, analysis of the affected controls starts automatically. No handoff needed.
Analysis typically takes 20 to 30 minutes depending on document volume. A long SOC 2 report takes longer than a certificate of insurance. You do not need to keep the tab open.
The left panel tracks four stages: **Collecting Documents**, **Analyzing Controls**, **Review Results**, **Quality Control**. It also tells you what it is waiting for, which at the start is at least one document.
***
## Part 4: Find your way around the assessment
There is a lot on this page. Three areas matter.
### The left panel
Current stage, what it is waiting for, a shortcut into the work, and an **Export** menu. Below that, **Details**: assignee, inherent risk, risk target, services, and the plan the assessment came from.
### The tabs
Eleven tabs run across the top. Most of the time you need the first two, **Summary** and **Issues**. The rest carry supporting detail and the audit trail: Controls, Findings, Emails, Work Queue, Documents, Activity, Notes, Properties, and SLAs.
### The Summary tab
At the top is **Recommendation**, the human conclusion. It appears in exports, so write it properly rather than leaving it thin.
Then a band showing the **Score** as a percentage with a compliance band, how many domain reviews are complete, and **Complete Assessment**.
Then the risk domain table: **Overall Vendor Risk** plus a row per domain, each with inherent risk, residual risk, and the assigned reviewer. Domains vary by plan; a broad plan can produce nine or more, covering things like AI & Emerging Technology, Operational Resilience, Concentration & Fourth-Party Risk, and Reputational & ESG alongside the familiar Data Security and Privacy.
Rows reading "Not set" against residual risk have not been reviewed yet. Those are your gaps.
***
## Part 5: Work the issues
The **Issues** tab holds one result for every control in the assessment. It opens filtered to the results raised as issues.
### Reading the top of the page
* **Risk domain selector**: narrow to a single domain.
* **Control Score**: the score out of 100%.
* **Open Issues**: open count against the total.
* **Vendor Score**: inherent and residual risk for the vendor.
If any follow-ups exist, a bar summarizes them (how many await a response, how many are still drafts) alongside **Configure portal**, **Download workbook**, **Import responses**, and **Manage sent follow-ups**. The workbook and import options are there for vendors who would rather work in a spreadsheet than the portal.
Three toggles switch the view (all results, issues only, and open follow-ups), each with a count. **Group by** defaults to **Control Section**, so results arrive clustered by control set and section, with the reviewers for that section shown on the group header.
Each row shows the control reference, the expectation in short form, status chips such as *Missing document* or *Awaiting*, any linked findings, the weight, and the result.
Select rows, or **Select all**, and an action bar appears with everything you can do at once: **Accept risk**, **Add Finding**, **Create follow-ups** (the count comes along, so you can draft dozens in one sweep), **Delete follow-ups**, **Lock**, and **Draft new email**.
On a large assessment this is the single biggest time-saver. Bulk-drafting follow-ups for every missing-document issue takes one action rather than a hundred.
Click a row to open it. A status banner sits at the top with the actions available for that state. An open issue offers **Not an issue** and an **Action** menu; a result that has come back from the vendor reads **Response received** and offers **Mark as issue** instead.
The left column shows the control: the **Expectation** (what must be true), the **Question** as it is put to the vendor, the **Guidance** for judging evidence, which **Control Set** it came from, and its **Weight**.
Beneath it, **Evaluation** gives the score and compliance band, and a bulleted analysis explaining the verdict. Each claim carries an **Evidence** reference you can click through to. Three controls sit above it: **Correct the AI** to override the result, **Preserve** to pin a result so later runs do not overwrite it, and **Edit**.
The right column holds **Evidence**, **Follow-up**, **Findings**, **Emails**, and **Activity**, with prev/next controls so you can work straight through the list. Each piece of evidence names its source document and page, quotes the passage, and shows a preview of the page with the passage highlighted.
**Why the citation matters.** The highlighted source is what makes a result defensible. When an examiner asks why a control passed, the answer is a quoted passage from a named document on a specific page.
***
## Part 6: Run follow-up cycles
Follow-ups are drafted individually and sent together, so the vendor gets one consolidated request rather than a trickle of emails.
From a result, draft a follow-up question. **AI Autofill** writes a first pass that references what the evidence already showed and asks only for the gap, which is usually better than starting from scratch. **Use control question and response** reuses the original control wording instead.
Under **Required document types** you can name what the vendor should attach, so the request is specific rather than "please send evidence".
Saving creates a draft. Nothing reaches the vendor until the drafts are included in a follow-up questionnaire sent through the portal.
Back on the **Issues** tab, the bar shows how many drafts are waiting. Sending opens the assessment portal with a questionnaire built from your questions and notifies the vendor. **Configure portal** controls what the vendor sees; **Manage sent follow-ups** tracks what is already out.
When the vendor submits, only the controls selected for follow-up are analyzed again against the new evidence. Everything else is left alone.
A result that has come back reads **Response received**, and the analysis is rewritten to account for what the vendor said, often moving from *Not Compliant* to *Fully Compliant* where the gap was documentation rather than practice.
**Follow-up versus rerun.** A follow-up reanalyzes only the affected controls. If you have changed the plan or control sets, or want everything re-evaluated from scratch, use the rerun option from the assessment **Actions** menu instead.
***
## Part 7: Reviews and quality control
Each risk domain can carry its own reviewer, which is what lets several teams work one assessment: InfoSec on the security domains, Legal on the contractual ones, Compliance on regulatory. The **Summary** tab reports progress as a count of completed reviews.
A reviewer opens their domain with **Start review**. Domains show *Not started* until someone does, and their residual risk stays "Not set".
**Completion can be gated.** Depending on configuration, **Complete Assessment** stays disabled until the domain reviews are finished. If the button is greyed out, look at the review column rather than the score.
* Reviewers are set per domain or control set and can be changed at any time.
* Reviewers are notified when results are ready for them.
* Risk analysts and administrators can resend reminders.
* You can optionally prevent anyone who is not a risk analyst or administrator from completing assessments.
Once reviews are in, the assessment moves to **Quality Control**, the last stage on the tracker, for a final pass.
***
## Part 8: Complete and export
When the issues have been worked and the reviews returned, click **Complete Assessment** on the **Summary** tab.
The dialog asks for four things:
* **Action**: approve, reject, or whichever outcomes your organization uses.
* **Vendor Status**: where this leaves the vendor in its lifecycle, for example *Active*.
* **Next Vendor Reassessment Date**: set for you based on risk tier and the date you completed, typically a year out. Change it if this vendor needs watching sooner.
* **Recommendation**: the written conclusion that appears in exports.
**Risk Scoring Changes** expands to show how this assessment moved the vendor's scores, which is worth a look before you confirm.
Once complete, the panel reads **Complete** and offers **Export Report** in four formats: PDF, Excel, CSV, and Word.
Match the format to the audience. PDF for anything leaving the company. Excel or CSV when someone wants to sort and filter the results themselves. Word when the output needs to drop into an existing house template. The Word export is driven by your organization's branded template, and [Custom Word report templates](/reporting/assessment-report-templates) covers changing what it pulls in.
**A word on report length.** The fullest export includes every result, all document evidence, the activity log, follow-ups, and notes, and can run to hundreds of pages. Reach for it when someone has asked for the complete file. For examiners and executives, the summary-level report usually lands better.
***
## Related guides
The one-page version: steps, tips, common scenarios, and a troubleshooting table.
The wider daily loop, including Radar alerts, contracts, and obligations.
How assessment plans, control sets, scales, and reviewers are configured.
How web evidence is graded and filtered before it can be cited, and where you set the bar.
What ships in the box, and how control sets differ from questionnaires.
Email [support@coverbase.ai](mailto:support@coverbase.ai), or ask your Coverbase contact to run a live working session with your team.