TPRM Intake & Vendor Procurement Workflow Automation
Designed and built an automated Third-Party Risk Management intake workflow to improve vendor onboarding, procurement coordination, and audit readiness.
The workflow used Slack, Zapier, Trello, and Google Drive to capture vendor requests, identify whether the vendor required system access, notify the appropriate stakeholder, create a vendor review tracking card, generate an evidence folder, and link the documentation back to the workflow record.
This project was designed to solve a common TPRM problem: vendor requests often come in through informal channels, creating gaps in tracking, ownership, evidence collection, and approval visibility. By automating the intake process, the workflow helped reduce manual handoffs, improve consistency, and create a more defensible vendor review process.
Built an automated workflow that:
Captures new vendor procurement requests from Slack.
Extracts key vendor information from the request.
Identifies whether the vendor requires system access.
Filters requests so only vendors requiring system access move forward for security review.
Sends a notification to the appropriate stakeholder or approver.
Creates a Trello card to track the vendor review.
Creates a Google Drive folder for vendor assessment evidence.
Links the Google Drive evidence folder back to the Trello tracking card.
Preserves request details and timestamps for better traceability.
Many organizations manage vendor requests through email, Slack, spreadsheets, or informal conversations. That creates risk because vendor reviews can be missed, evidence can become scattered, and security teams may not be notified early enough when a vendor needs system access.
This workflow improves the process by creating a structured intake path that supports better visibility, accountability, and audit readiness.
Why This Matters to Companies
This matters because vendor onboarding is not just a procurement activity. It is a risk management activity.
When a vendor requires access to systems, data, applications, or business processes, the company needs a repeatable way to identify the risk, notify the right stakeholders, track the review, and collect evidence. Without that structure, organizations increase the risk of unauthorized access, incomplete due diligence, missed approvals, and weak audit trails.
This automation helps companies move from a reactive vendor intake process to a more controlled, risk-based workflow.
Tools Used
Slack | Zapier | Trello | Google Drive
Prompt
VENDOR REQUEST AUTOMATION ZAP - COMPLETE BUILD PROMPT,
Zap Purpose: Automate vendor procurement requests from Slack → Filter by system access requirement → Notify approver → Create Trello card & Google Drive folder → Link them together
EXACT CONFIGURATION:
Step 1 - Slack Trigger
App: Slack,
Action: New Message in Channel,
Channel: #new-process,
Listen for: All messages (include bot messages: ON, Raw text: ON),
Step 2 - Extract Vendor Name
App: Formatter by Zapier,
Action: Text → Extract Pattern,
Input: {{340627605__text}},
Pattern: Vendor Name:\s*(.+),
Output: {{340627606output0}},
Step 3 - Extract System Access Answer
App: Formatter by Zapier,
Action: Text → Extract Pattern,
Input: {{340627605__text}},
Pattern: Use prior to[^:]*:\s*(Yes|No),
Output: {{_GEN_1766543364603output0}},
Step 4 - Filter for "Yes" Only
App: Filter by Zapier,
Condition: {{_GEN_1766543364603output0}} equals "Yes" (case-insensitive),
Action: Continue (if true),
Step 5 - Send Slack DM Notification
App: Slack,
Action: Send Direct Message,
To User: Haley (or recipient username),
Send as bot: NO (from your account),
Message: "Hi (Name), heads-up regarding {{340627606output0}}. The request justlanded in my queue a few minutes ago, and it looks like they will need system access.\n\nI'm starting the security review now, but I wanted to share this ahead of time to help with your planning."
Step 6 - Create Trello Card
App: Trello,
Action: Create Card,
Board: Sanity Check,
List: New Request,
Card Name: {{340627606output0}} (vendor name only),
Description: [Full request details from original message],
Request Date: {{340627605__ts_time}} (Slack message timestamp),
Step 7 - Create Google Drive Folder
App: Google Drive,
Action: Create Folder,
Parent Folder: Vendor Assessments,
Folder Name: {{340627606output0}}/ Sanity Check,
Step 8 - Update Trello Card with Drive Link
App: Trello,
Action: Update Card,
Board: Sanity Check,
Card ID: {{_GEN_1766546117815__id}} (from step 6),
Description: Link to Google Drive folder:{{_GEN_1766546117816__alternateLink}},
Overwrite Description: YES,
KEY DATA FLOWS:
Vendor Name flows through entire Zap: Step 2 → Steps 5, 6, 7, 8,
System Access answer: Step 3 → Step 4 (filter gate),
Slack timestamp: Step 1 → Step 6 (Request Date),
Trello card ID: Step 6 → Step 8 (updates same card),
Google Drive folder link: Step 7 → Step 8 (appends to card),
IMPORTANT NOTES:
Slack channel: #new-process (C0A58SDAT7F),
Only executes if "Yes" to system access (Step 4 filter),
Google Drive folder created BEFORE updating Trello (workflow order critical),
All timestamps use Slack's native message timestamp,
DM sent to you () - change recipient as needed
