02 / Vendor Management / Sprinto

Designing an AI assisted
compliance inventory.

A Vendor Management experience that connects AI assisted discovery with risk, ownership, due diligence, people, staff devices and reporting.

AI assisted discoveryVendor riskPeople and devicesEvidence and reports

One operating view for readiness, evidence and risk.

My role: Product Designer
My contribution: Vendor discovery, risk classification, due diligence, monitoring, people, staff devices and reporting workflows.
Project context: Professional experience · Vendor Management system

Overview

Help growing teams understand what they use, who owns it and where risk needs attention.

I was responsible for the Vendor Management experience at Sprinto. The work covered discovery, risk classification, due diligence, monitoring and reporting, while connecting vendors to the people and staff devices around them.

The goal was not to place more information on a dashboard. It was to turn scattered compliance signals into a clear sequence of decisions.

The objective

Create one reliable view of third party risk and the work needed to resolve it.

My responsibility

Research synthesis, information architecture, user flows, interaction design and handoff with product and engineering.

The constraint

Use automation to surface possible gaps without presenting an AI suggestion as a confirmed fact.

The public case study uses representative visuals and sanitized examples. It communicates my design approach without revealing customer or production data.

The problem

The information existed, but the relationships between it were easy to lose.

Compliance owners were working across vendor records, people, devices, assessments and reports. A dashboard could show totals, but it did not always explain which item needed attention, why it mattered or who should act next.

As a company grew, manually maintained vendor lists could also miss tools already being used by employees. That created a difficult starting point: teams could not assess a risk they did not know existed.

Northstar Compliance vendor overview with risk classification, active vendors, due diligence and breach monitoring — Vendor risk, active inventory and unfinished work brought into one readable overview.

Unknown inventory

Unrecorded services could sit outside the formal vendor review process.

Scattered context

Risk, ownership, evidence and due diligence status were difficult to read together.

Weak prioritisation

Counts showed volume, but not always the next decision or the consequence of waiting.

Manual reporting

Preparing a review meant collecting information from several parts of the product.

Research and synthesis

I followed the decisions behind the dashboard.

I combined workflow mapping, stakeholder conversations, product walkthroughs and recurring support themes. The goal was to understand how a possible signal becomes a trusted compliance record, and where context is lost between teams.

01Workflow mapping

Trace discovery, confirmation, assessment, evidence and reporting.

02Stakeholder conversations

Separate the decisions owned by compliance teams and vendor owners.

03Product review

Identify where status, ownership and evidence become disconnected.

04Concept critique

Clarify where AI can suggest and where a person must decide.

Observed

Inventory confidence

“I cannot assess a service if I do not know the team is using it.”

Status clarity

Teams scan for what is incomplete before they look at the overall score.

Interpreted

Discovery needs review

An automated signal is a starting point, not a confirmed vendor record.

Context must travel

Source, owner, risk and evidence need to remain connected.

Designed

Human confirmation

Ask a compliance owner to add, dismiss or assign every suggestion.

Actionable status

Pair each state with the reason, responsible person and next step.

A sanitized reconstruction of how observations became product principles and design tasks.

Finding 01

Visibility before scoring

The first problem was not calculating risk. It was knowing every service, person and device that belonged in scope.

Finding 02

Status needs a reason

A warning becomes useful only when the interface explains what triggered it and what action can resolve it.

Finding 03

Automation needs boundaries

AI could surface possible gaps and review evidence, while confirmation and final risk decisions remained visible human actions.

Current journeyQuestion carried into the design

Discover

A new service appears

Is this a real vendor?

Confirm

Check source and usage

Who can verify it?

Assess

Classify access and impact

Why is this risk level?

Collect

Request and review evidence

What is still missing?

Report

Share readiness and exposure

Can I trace the result?

The workflow map revealed that uncertainty was passed from one step to the next unless ownership and evidence stayed visible.

Design question
How might we help a compliance owner move from a possible risk to a defensible decision without asking them to reconstruct the context?

Product direction

Treat vendors, people, devices and reports as one connected inventory.

The system needed a shared model so users could move from a risk summary into the exact vendor, person, device or evidence record behind it.

Vendors

Discover services, classify risk, complete due diligence and monitor incidents.

People

Understand ownership, access and the employees connected to each service.

Staff devices

Surface device posture and unresolved checks that affect readiness.

Reports

Turn the inventory into evidence that teams can review and share.

Northstar Compliance all vendors table with owners, status, risk, due diligence and checks — The complete inventory keeps ownership, risk and due diligence status visible in one scan.

Detail crop of vendor ownership and due diligence status — A closer view of the status and ownership columns from the same product screen.

AI assisted discovery

Surface what the team may have missed, then explain why it appeared.

Connected sign in activity can reveal services that employees already use. Instead of adding every signal to the vendor register automatically, the experience presents a possible vendor for review, shows the discovery source and keeps the compliance owner in control of confirmation.

Northstar Compliance vendor library with searchable categories and selected vendors — A reviewable vendor library turns discovery into an intentional inventory decision.

01Detect
Find a possible vendor, person or device from connected systems.
02Explain
Show the source and the reason the record was suggested.
03Confirm
Let a person add, dismiss or assign the record before assessment begins.

Design response

Turn every status into a clear next step.

A risk label alone is not enough. The interface connects each signal with its source, owner, due diligence state and available action.

Northstar Compliance vendor due diligence page showing risk, current task and review history — The vendor detail connects risk, responsibility, the current task and previous decisions.

Vendor risk model

Move from a scheduled review to a risk score the team can understand.

The assessment experience connects the current evidence task with the rules behind the score. Compliance teams can see what is due, configure the factors that matter to their organisation and inspect how each answer changes the final risk level.

Northstar Compliance vendor risk assessment with due date, evidence status and assigned reviewer — A scheduled assessment keeps evidence, responsibility and timing in one view.

Northstar Compliance vendor risk configuration with automated scoring and due diligence settings — Configuration makes the scoring model visible before it is applied.

Northstar Compliance risk factor scoring rubric for vendor data access — The scoring rubric explains how each response contributes to vendor risk.

Designing for responsibility

One inventory.
Different decisions.

The same record needs to answer a different question for each person involved.

Compliance team

Where are the gaps?

Prioritise unreviewed vendors, incomplete assessments and open evidence requests.

Vendor owner

What do I need to provide?

Keep the request, due date and supporting context together.

Leadership

What requires attention now?

Summarise exposure and progress while preserving a path to the underlying record.

People and staff devices

Connect employee readiness to the record behind it.

People compliance is more useful when a failed check leads to the exact person, missing requirement and available action. The flow moves from the staff inventory into onboarding prerequisites, then into a detailed record that brings training, policy acknowledgement, device reporting and verification together.

Northstar Compliance staff inventory showing offboarded employees and monitoring status — The staff inventory makes scope and offboarding status easy to scan.

Northstar Compliance staff onboarding prerequisites with training, policies and device setup — A prerequisite view explains what must be configured before onboarding can begin.

Northstar Compliance staff detail with identity, onboarding, device and verification checks — The staff record brings ownership, missing information and unresolved checks into one place.

Evidence and reporting

Make the system explain its conclusion.

AI can help surface a vendor or pattern, but a compliance decision still needs traceable evidence. The design keeps source, ownership, review status and history visible so teams can understand what supports a result.

Northstar Compliance AI assisted due diligence review using selected vendor documents — AI can review selected evidence and prepare findings while the final decision stays with a person.

Show where a discovery originated.
Separate suggested records from confirmed records.
Connect each risk to its assessment and evidence.
Let every report lead back to the underlying record.

Continuous monitoring

Keep compliance useful after the first assessment.

A vendor can change after approval. Monitoring brings new findings back into the same ownership and remediation model, so teams can see what changed, understand the recommended response and return to evidence when the issue is resolved.

Signal

Separate passing resources from the few items that need attention.

Guidance

Explain the recommended sequence without hiding the underlying evidence.

Ownership

Keep the responsible person and due date beside the remediation work.

Outcome

A clearer operating model for compliance work.

The resulting direction joined discovery, review, ownership and reporting into one understandable system. It gave each role a more focused starting point while preserving the evidence needed to explain a decision.

Before

Vendor records depended heavily on a manually maintained inventory.

After

AI assisted discovery surfaced possible gaps for human confirmation.

Before

Risk status and responsibility were read in separate contexts.

After

Source, owner, assessment state and next action appeared together.

Before

Reports summarised progress without always exposing the supporting record.

After

Summary views retained a path back to evidence and activity history.

What I learned

Automation earns trust when people can inspect it.

The important design question was not whether AI could find more signals. It was whether the product could explain a suggestion clearly enough for a person to judge it. That principle shaped the discovery states, the confirmation step and the way evidence remained connected throughout the workflow.

Business impact

Connect the design decision to a measurable business result.

Give compliance teams a more complete inventory and a clearer path to risk review, reducing manual follow up and audit preparation effort.

Earlier discovery of untracked vendors and staff devices

Shorter vendor review and evidence collection cycles

Lower exposure from overdue or unowned risks

Measuring after release

Signals I would track with product, data and engineering.

These are success measures for post launch evaluation, not claimed results.

Inventory coverage: Share of discovered vendors reviewed and assigned an owner
Review cycle: Median time from discovery to a completed risk decision
AI usefulness: Share of AI suggestions accepted, edited or rejected
Audit effort: Hours spent preparing vendor evidence and reports

ROI lens

Combine review hours saved with avoided audit preparation effort and the expected cost of unresolved vendor risk.

Final reflection

Let AI surface the question. Keep the decision human.

The product direction connected automated discovery with ownership, evidence and review, so compliance teams could act without losing the reasoning behind a result.

Help growing teams understand what they use, who owns it and where risk needs attention.

The goal was not to place more information on a dashboard. It was to turn scattered compliance signals into a clear sequence of decisions.

The information existed, but the relationships between it were easy to lose.

Connect employee readiness to the record behind it.

Help growing teams understand what they use, who owns it and where risk needs attention.