Contacts & findings

This page covers two related parts of a supplier record: contacts (the people you deal with, who receive questionnaires and access the portal) and findings (issues you raise while reviewing a supplier). Both require the supplier:update permission.

Contacts

A supplier contact is a managed person at the supplier. Contacts are the recipients of questionnaire requests and the attribution for responses, and they are what gates the questionnaire send flow — you cannot send a questionnaire to a supplier with no contact.

Add a contact

1. On the supplier's Contacts tab, click Add contact. (You can also reach this from the Add contact shortcut in the Send-questionnaire dialog.)
2. Fill in the dialog:
   • Contact name (required).
   • Email (required).
   • Job title.
   • Primary contact — toggle to mark the main point of contact.
   • Portal access enabled — on by default; controls whether this contact can log into the vendor portal.
3. Save. The contact appears with its badges, and the tab header summarises counts (e.g. "1 active · 1 portal").

Findings

A finding is an issue discovered while examining a supplier. Findings are normally raised inside a review, not from the supplier's Findings tab.

Raise a finding

1. Open the supplier's active review (via the Open active review banner or the Reviews tab).
2. Click Create finding.
3. Fill in the dialog:
   • Finding title (required).
   • Description.
   • Severity — Low / Medium / High / Critical.
   • Due at.
   • Assignee — the finding owner.
   • Remediation plan and Remediation notes.
4. Save. The finding is added to the review's Review findings panel, and the supplier's Findings tab reflects it.

A finding records its severity, status, owner, optional due date, remediation plan and notes, and has an append-only event log. It also carries a separate follow-up track — a follow-up assignee, follow-up due date, and follow-up note that are deliberately distinct from the finding's owner.

Finding status lifecycle

Transitions are guarded, not free-form:

• Dismiss and Resolve are allowed only from open, accepted, or follow_up_requested.
• Reopen is allowed only from resolved, closed, or dismissed.
• Request follow-up is allowed only from open or accepted.
• Complete follow-up is allowed only from follow_up_requested.

A closed timestamp is stamped when a finding becomes resolved, closed, promoted_to_risk, or dismissed.

When a finding is promoted to a risk (promoted_to_risk), the supplier becomes linked to that risk. See Linking risks & assets.