Vendor risk management usually exists as a one-time checkbox at onboarding and nothing afterward, which means a vendor's insurance certificate or SOC 2 report can quietly expire years before anyone notices. This workflow handles both halves: AI-assisted risk scoring when a new vendor is onboarded, and an ongoing quarterly sweep that catches expiring documentation before it becomes a genuine compliance gap.
Workflow diagram
flowchart TD
A[New Vendor Webhook] --> B[Send Risk Questionnaire]
B --> C[Response Webhook]
C --> D[AI Risk Scoring]
D --> E{Risk Tier}
E -->|High| F[Request Additional Docs] --> G[Legal Review] --> H[Wait Sign-Off]
E -->|Medium| I[Standard Approval]
E -->|Low| J[Auto-Approve]
H --> K[Merge Approvals]
I --> K
J --> K
K --> L[Store Vendor Record]
L --> M[Set Next Review Date]
N[Quarterly Schedule] --> O[Get Vendors Due]
O --> P[Split In Batches]
P --> Q[Check Cert Expiry]
Q --> R{Expiring Within 30 Days?}
R -->|Yes| S[Request Renewal] --> T[Wait 14 Days] --> U{Received?}
U -->|No| V[Escalate To Procurement]
U -->|Yes| W[Update Registry]
R -->|No| W Every branch shown here (IF/Switch outcomes) exists as a real conditional in the downloadable JSON, not a simplification for this diagram.
Risk-tiered approval, not one-size-fits-all
Not every vendor needs the same scrutiny. A software tool that never touches customer data is a different risk profile than a subprocessor handling regulated information. The Risk Tier Router splits new vendors into three paths based on the AI-generated risk score: high-risk vendors must supply insurance certificates and a current security certification before approval, medium-risk gets a standard human approval step, and low-risk auto-approves.
This matters operationally because routing every vendor through the same heavyweight review process either slows down genuinely low-risk procurement to a crawl, or, more commonly, causes teams to skip the review process entirely because it is too slow for routine purchases.
The ongoing sweep most vendor programs skip entirely
Onboarding risk assessment is the easy half. The Quarterly Review Schedule branch is the half that actually prevents compliance exposure: it pulls every vendor due for review, checks certification and insurance expiry dates, and for anything expiring within 30 days, automatically requests renewed documentation before the gap opens.
Escalate To Procurement only fires when a vendor has not responded within 14 days of the renewal request, at which point continuing to work with an uncertified vendor is a genuine decision someone needs to make deliberately, not a default that happens because nobody was tracking the date.
Node-by-node reference
| Node | Type | Role |
|---|---|---|
| New Vendor Webhook / Quarterly Review Schedule | Webhook + Schedule Trigger | Two independent entry points: onboarding vs ongoing monitoring |
| AI Risk Scoring | HTTP Request | Scores data handling, sub-processors, certifications from questionnaire answers |
| Risk Tier Router | Switch | Three-way approval path matched to actual risk, not a single flat process |
| Split In Batches | Split In Batches | Processes the vendor review queue without overloading downstream APIs |
| Expiring Within 30 Days? | IF | Catches lapsing certifications before they actually lapse |
| Documentation Received? | IF | Determines whether a 14-day silence becomes a procurement decision |
24 total nodes in the downloadable file, including sticky-note documentation embedded directly on the canvas.
Key logic, in code
Certificate expiry check
const expiryDate = new Date($json.certExpiryDate);
const today = new Date();
const daysToExpiry = Math.ceil((expiryDate - today) / 86400000);
return [{
json: {
...$json,
daysToExpiry,
expiringSoon: daysToExpiry <= 30 && daysToExpiry >= 0,
alreadyExpired: daysToExpiry < 0,
}
}];Before / after
| Metric | Before | After this workflow |
|---|---|---|
| Vendor review consistency | Ad hoc, whoever onboards the vendor | Same AI-scored criteria, every vendor |
| Expired certifications caught | Usually discovered during an audit | Flagged 30 days before expiry |
| Low-risk vendor approval time | Same review cycle as high-risk | Auto-approved, same day |
| Compliance audit trail | Scattered emails and file shares | Single registry with full review history |
Prerequisites
- n8n v1.40+ with Split In Batches support
- A risk questionnaire tool (Typeform or HubSpot Forms) with webhook delivery
- Anthropic API key for risk scoring
- Airtable PAT for the vendor registry, Slack Bot Token, Resend API key
Common pitfalls
Risk thresholds need calibration to your actual risk appetite
The default 70/40 score cutoffs are a starting point. Review your first quarter of scored vendors against outcomes and adjust.
Do not let auto-approval mean unreviewed forever
Low-risk auto-approved vendors still need to enter the quarterly review cycle. Confirm Set Next Review Date runs for every tier, including auto-approved.
Track sub-processor changes, not just the primary vendor
A vendor's own risk profile can change when they add a new sub-processor. The questionnaire should be re-sent periodically, not treated as a one-time snapshot.
Want this deployed, configured and monitored?
The template is free. Wiring in your real credentials, tuning the logic to your business, and keeping it running when an upstream API changes is what we do.
Get my free automation plan →Frequently asked questions
Can this integrate with a dedicated GRC or TPRM platform?
Yes, if it exposes an API (most modern GRC platforms do), replace the Airtable registry nodes with calls to that system while keeping the scoring and routing logic.
How is the AI risk score kept consistent over time?
Log the full questionnaire response and score reasoning alongside the score itself, so you can audit and recalibrate the model periodically against real outcomes.
What happens to a vendor that fails the high-risk review entirely?
Legal Review is a human decision point, not an automatic rejection. The workflow surfaces the concern with full context; a person decides whether to proceed, request mitigations, or decline the vendor.