Contrata Engage: follow up with suppliers without closing the risk too soon

A supplier replies to your request and attaches a recovery test. The requested file has arrived, but the risk question may still be unanswered. Does the test cover your service? Was it measured against the agreed target? Who decides what happens if it was not?

Contrata Engage brings supplier requests, replies, attachments and follow-up questions into the wider provider workspace. The assistant handles follow-ups and preparation while the team reviews evidence and makes the decisions. Those are the boundaries described in Contrata's public product overview.

For a small risk team, a useful starting point is one unresolved question, one service and a clear point for human intervention. The example below shows that discipline. It is fictional and explains a workflow, not a screen-by-screen tutorial or a promise that every step is automatic.

Give the conversation a specific objective

Consider a fictional insurer reviewing Harbour Claims, its claims-platform provider. The agreement records a two-hour recovery target. The team needs to understand what the latest test demonstrates for this particular service. The two-hour figure is an invented example, not a regulatory minimum or a recommended target.

An opening request such as “send your business continuity documents” is too broad for that job. A more useful request asks for the latest recovery-test result covering the claims service, the target used, the test scope and any unresolved actions. Name the arrangement and explain which question the evidence should answer.

Before launching an engagement, check the recipient, service scope and opening message. Contrata's documented Engage workflow includes reviewing an opening draft and deliberately launching it. The same documented workflow provides for human takeover and resuming AI replies. Confirm the available controls in your own deployment rather than assuming this conceptual example reproduces its interface.

Do not send a large questionnaire again just because one answer is incomplete. Our guide to collecting missing evidence through targeted follow-ups covers how to narrow a request without losing the original assessment context.

Follow the reply, not just the attachment

Harbour Claims sends a test report using a four-hour target. The file is useful, but it does not explain the difference from the agreement. Record both the evidence received and the question still open.

The next message should identify the exact discrepancy: the agreement says two hours, while this test uses four. Ask whether the test relates to the same service and whether the target has changed. Request the relevant explanation or change record. Avoid replacing that question with a generic “please provide more information” reminder.

In the fictional reply, the supplier explains that four hours was a proposed change. No approved change record has been supplied. That clarification improves the team's understanding. It does not establish that the proposed target is acceptable or that the existing commitment was met.

Original conceptual illustration. The provider, service and timings are fictional. This is not a product screenshot.

Keep the original supplier wording and attachment available for the reviewer. A paraphrase can accidentally turn “proposed” into “agreed”. Contrata's public description includes supplier messages and original files linked to the relevant assessment; the team still needs to check that the correct material has been selected. Contrata product overview

Hand over when clarification becomes a decision

The supplier has now explained the discrepancy. Further automatic reminders asking for the same test will not decide whether the organisation can accept a different recovery target.

This is the point for the service owner or authorised risk reviewer to take over. They need the agreement, test result and supplier explanation together, along with the service context. They may need operational or legal input before deciding on further evidence, remediation or escalation. The example does not prescribe which decision they should make.

For teams designing AI-assisted workflows, it is useful to define this boundary before the first engagement. NIST's voluntary AI Risk Management Framework 1.0 calls for clear responsibilities for human-AI arrangements and oversight under Govern 3.2. It is a governance reference, not an Australian legal requirement or a certification of Contrata. NIST AI RMF Core

Make the handover explicit. Who now owns the open question? What must they review? What communication should wait for their decision? Human takeover should prevent a conversation from implying agreement that the organisation has not given.

Keep evidence collection separate from risk closure

At the end of the example, the supplier has replied, the test is available and the proposed change is understood. The target mismatch remains open. A useful handover records both facts instead of collapsing them into “complete”.

If the authorised reviewer later makes a decision, record its basis and any remaining conditions. Use the guide to writing a decision another reviewer can challenge to preserve that reasoning. For the broader operational question, check recovery beyond the system restart: a platform returning is not necessarily the end of the business recovery task.

Engage is useful when supplier communication produces evidence the team can act on. In a demonstration, bring one real, suitably redacted follow-up scenario and ask to see the request, reply, attachment, clarification and human handover together. Check what happens when the supplier's answer is incomplete, not only when everything goes to plan. Explore Contrata's capabilities.