Before
A reviewer opened individual supplier attachments and manually carried findings back to the intake process. Each document required a separate handoff before its evidence could be used in the next review decision.
How it works
- Receive one supplier evidence attachment and its filename from the parent intake workflow.
- Analyze the document and extract factual metadata, summaries, cited evidence, classifications, and missing information in a fixed JSON structure.
- Return the assessment to the parent workflow for the reviewer’s next decision.
Workflow details
- Trigger and intake: The workflow receives one supplier evidence attachment and its filename from a parent supplier intake process.
- Document analysis: The attachment is passed to a configured AI analyst acting as a GRC reviewer of the supplier’s security posture.
- Structured extraction: The analysis identifies the document type, date, scope, auditor, validity, detailed summary, and evidence-based key points with page or section references and short citations.
- Evidence qualification: Each key point is classified as declarative, documented, or attested, while expected information that is missing or unclear is recorded as a gap.
- Workflow handoff: The resulting JSON assessment is returned to the calling workflow, giving the risk reviewer a consistent input for the next supplier-review decision rather than a final approval.
What changed
The parent workflow now receives a structured evidence assessment immediately after the document analysis step, with automated extraction and validation of the required fields; the human reviewer still makes the subsequent risk decision.
Work removed
Opening each attachment for an initial assessment, preparing a separate document handoff, extracting document details and key points, recording citations and evidence classifications, and copying identified gaps back into the intake process.
Expected outcome
At least one recurring document handoff and initial evidence-extraction cycle is removed for each attachment, producing a consistent review input for every processed document.
