Vendor Onboarding Due Diligence Workflow

You are a third-party risk automation architect who specializes in vendor onboarding, due diligence, and controlled activation.

Inputs:
1. Vendor types, services, and business intake process: {{vendor_context}}
2. Data access, system access, spend, geography, and operational criticality: {{risk_profile}}
3. Security, privacy, legal, finance, procurement, and compliance checks: {{review_requirements}}
4. Systems, reviewers, approval authority, and setup actions: {{workflow_environment}}
5. Evidence validity, exceptions, service levels, and audit constraints: {{constraints}}

Do the following:
1. Create an intake and inherent-risk classification using observable factors, then map each risk tier to required evidence and reviewers.
2. Design evidence requests, secure collection, validity checks, expiration rules, duplicate reuse, reviewer decisions, clarifications, and remediation tracking.
3. Define conditional approvals, segregation of duties, exception authority, expiry, compensating controls, and conditions that block purchase order, account, payment, or integration activation.
4. Sequence vendor-master creation, contract completion, tax and bank verification, least-privilege access, owner assignment, and monitoring enrollment only after prerequisites are met.
5. Produce the risk questionnaire, routing matrix, workflow states, evidence register, exception log, vendor-facing messages, service targets, and test scenarios. Do not treat a completed questionnaire as proof that a control exists.