Operations & Compliance package
Adding a supplier or flagging it for review pulls a fresh risk rating, sets the tier and next review date, and sends high-risk suppliers to procurement.
About this package
Supplier risk review keeps your supplier register's risk ratings current. It runs whenever a row in the Suppliers data table is created, or updated with "Review requested" ticked, and fetches the supplier's financial score, cyber score, ESG flags and sanctions screening from your risk-intelligence provider.
The Supplier risk decision table combines those scores with the supplier's criticality and annual spend into a risk tier, a review cadence and a recommended action. The workflow writes the tier, scores and next review date back to the row and clears "Review requested", so its own update does not start another review. High and critical suppliers go to procurement as a User Task to accept the risk, agree a mitigation plan or plan an exit, with a five-day SLA; the business owner is told when the supplier is flagged and when it is decided.
Adapt the Supplier risk rules to your risk appetite, the reference to your provider's API, and the Suppliers columns to your register.
Starts when a row is created or updated in a data table (see What's included).
Starts when something changes: a data-table row is created or updated, or a task changes state.
The flow
Supplier added or flagged
A new Suppliers row, or an update with "Review requested" ticked, starts the review. Other updates end at once, which stops the workflow re-triggering itself.
Get the risk rating
The risk-intelligence API returns financial and cyber scores, ESG flags and the sanctions screening result.
Apply the risk rules
The Supplier risk decision table turns the scores, criticality and spend into a tier, a review cadence and a recommended action.
Update the register
The tier, scores, last assessed and next review dates are written to the row and the review flag is cleared.
Procurement review
High and critical suppliers go to procurement to accept, mitigate or exit, with the plan and next review date; the business owner is emailed.
Forms
The inputs a caller passes when it starts a run, and the forms people complete when the process needs a decision.
User Task
Review {{risk_tier}} risk supplier {{name}} ({{supplier_id}})
From your code
Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.
REST
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
-H "Authorization: Bearer $USERTASKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"workflow_id":"<workflow id>","variables":{"data_event_type":"updated","data_table_name":"Suppliers","row":{"supplier_id":"SUP-104","name":"Tailspin Components","category":"Manufacturing","criticality":"high","annual_spend":480000,"country":"SG","owner_email":"supply.chain@example.com","review_requested":true,"risk_tier":"Medium","financial_score":55,"cyber_score":60,"esg_flags":"Labour audit overdue","sanctions_hit":false,"last_assessed":"2026-03-03","next_review_date":"2026-09-01","review_status":"Review overdue"},"supplier_id":"SUP-104","name":"Tailspin Components","category":"Manufacturing","criticality":"high","annual_spend":480000,"country":"SG","owner_email":"supply.chain@example.com","review_requested":true,"risk_tier":"Medium","financial_score":55,"cyber_score":60,"esg_flags":"Labour audit overdue","sanctions_hit":false,"last_assessed":"2026-03-03","next_review_date":"2026-09-01","review_status":"Review overdue"}}'CLI
usertasks workflows inputs <workflow id> # the start form: keys, types, required
usertasks workflows run <workflow id> --input data_event_type=updated --input data_table_name=Suppliers --input row='{"supplier_id":"SUP-104","name":"Tailspin Components","category":"Manufacturing","criticality":"high","annual_spend":480000,"country":"SG","owner_email":"supply.chain@example.com","review_requested":true,"risk_tier":"Medium","financial_score":55,"cyber_score":60,"esg_flags":"Labour audit overdue","sanctions_hit":false,"last_assessed":"2026-03-03","next_review_date":"2026-09-01","review_status":"Review overdue"}' --input supplier_id=SUP-104 … --waitWhat's included
| Type | Name | Details |
|---|---|---|
| Email template | Supplier flagged high risk | Tells the supplier's business owner that a high-risk rating is with procurement for review. |
| Email template | Supplier risk decision | Sent to the business owner with procurement's decision on a high-risk supplier. |
| Data table | Suppliers | Your supplier register. Adding a supplier, or ticking "Review requested", starts a risk review; the workflow writes the risk tier, scores and next review date back and clears the flag. |
| Integration | Risk intelligence | |
| API reference | Get supplier risk rating | GET /risk-ratings/{{supplier_id}} — Current risk rating for a supplier from your risk-intelligence provider: financial health, cyber posture, ESG flags and sanctions screening. |
| Decision table | Supplier risk | 8 rules — Risk tier, review cadence and recommended action from the risk-intelligence scores, the supplier's criticality and annual spend. First matching rule wins. |
| Workflow | Supplier risk review | 25 steps — When a supplier is added or flagged for review: gets the risk rating, applies the Supplier risk rules, writes the tier and next review date back, and sends high-risk suppliers to procurement. |
Suppliers · 6 sample rows
Supplier IDSupplierCategoryCriticalityAnnual spendCountryBusiness owner emailReview requestedRisk tierFinancial scoreCyber scoreESG flagsSanctions matchLast assessedNext reviewReview statusMitigation plan
Requirements
Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.
Integration “Risk intelligence”Required
Workflow “Supplier risk review” assigneesRequired
Install
Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.
curl -fLO https://usertasks.com/gallery/supplier-risk-review-1.0.0.utpkg
usertasks packages inspect supplier-risk-review-1.0.0.utpkg # offline: checksum, hashes, signature
usertasks packages install supplier-risk-review-1.0.0.utpkg --dry-run
usertasks packages install supplier-risk-review-1.0.0.utpkg # prompts for each requirement
usertasks packages install supplier-risk-review-1.0.0.utpkg --keep-incomplete --yes # in CI; finish with:
usertasks packages complete supplier-risk-review -f values.yamlVerify the download
shasum -a 256 supplier-risk-review-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.
Versions
Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work
More packages
Operations & Compliance
Monthly SOC 2 / ISO 27001 evidence run: automated controls are pulled from your systems, owners of manual controls are asked for a link, all logged for the auditor.
Needs:REST APIAssigneesEmail
Operations & Compliance
A daily check of your contract register: owners are reminded 60, 30 and 7 days before each notice deadline and asked to renew, renegotiate or terminate.
Needs:AssigneesEmail
Operations & Compliance
Handle access, erasure and other privacy requests: statutory deadline, identity check, search of CRM, billing and support, erasure, and a DPO-approved reply.
Needs:REST APIAssigneesEmail