What you'll build
A vendor risk exception workflow for compliance and procurement teams. A requester flags a vendor that's failing a compliance check, such as a missing SOC 2 report or an expired certificate of insurance, and explains why the business needs to proceed anyway. A compliance officer reviews the request in a Kanban pipeline, and the moment they approve it, Formaloo automatically generates a branded, signed-looking PDF audit record and emails it straight to the requester. No one has to remember to export a document after the fact. The record exists the second the decision is made.
When to use this
A vendor fails a security or compliance check (SOC 2, insurance, DPA, security questionnaire) but the business still needs to onboard or continue working with them
Your compliance or legal team needs a defensible, timestamped paper trail for every exception granted, not a verbal approval buried in a Slack thread
An auditor asks for proof of who approved a risk exception, when, and why, and you want that answer to be one click away instead of a scavenger hunt through email
Finance or procurement is blocked on a purchase order until compliance signs off on a known gap, and that sign-off needs to travel with the PO as documentation
You're tired of manually exporting and emailing approval documents every time someone signs off on an exception
Part 1 — Build the exception request form
This is where you capture the request itself: which vendor, what compliance gap they're failing, why the business wants to proceed, and how long the exception should last. Build it with Magic Create so the fields, including the admin-only ones, are generated for you in seconds.
1. Open Magic Create: From your Formaloo homepage, click Magic Create.
2. Describe the form: Paste a prompt describing a vendor risk exception request form. Include the public fields (vendor name, requester name, requester email, which compliance requirement is failing with options for missing SOC 2 report, expired certificate of insurance, no signed data processing agreement, failed security questionnaire, or other, a free text field for describing the gap if "other" is chosen, business justification, estimated annual spend, how long the exception should last, a file upload for supporting documentation, and a yes/no acknowledgment that the exception will be re-reviewed at expiration). Describe the admin-only fields explicitly: a Status dropdown (Submitted, Under review, Approved, Rejected, Expired), an Assignee field, and an internal compliance notes field.
3. Generate and verify: Click Create. Your form should look like this, Magic Create will have generated most of it. Verify each field and field ID matches the vendor risk exception field table, and confirm the Status, Assignee, and internal notes fields are marked admin-only.
💡 Want internal fields like Status and Assignee invisible to the person filling out the form? Admin-only fields are the mechanism for that. See what are admin-only fields and how they help.
4. Add the reference number field: Add one more field, a Formula field, not shown to submitters, that generates a unique reference number by combining the vendor name with the row's submission number (for example, "VRE-" plus the row ID). This is what identifies the exception on the PDF and in the approval email.
5. Require the acknowledgment field: Open the "Do you acknowledge this exception will be re-reviewed when it expires?" field and set it to required, so the form can't be submitted until the requester answers yes.
6. Publish the form: Click Publish in the island bar at the top of the editor.
Part 2 — Create the PDF template for the audit record
This is the document that makes the whole workflow worth building. Instead of a compliance officer typing up a memo after every approval, Formaloo assembles a clean, branded PDF straight from the submission data the moment it's approved.
💡 Want every form submission to generate a polished, branded document automatically? This is the foundational guide to building a PDF template from a submission. See how to create PDF templates to turn responses into documents.
1. Open PDF templates: Click your profile icon, go to Apps and Integrations, and open Custom PDF Template.
2. Add a new template: Click Add New Template and switch the editor to HTML view.
3. Build the document: Paste in your PDF layout: a header with the document title and the reference number, an approved status badge, a vendor and request details section, the compliance gap section, the business justification in an inset block, and an approval line showing who approved it and when.
4. Pipe in the data: Reference each field with its @field_id, for example @vendor_name, @requester_name, @compliance_gap, @business_justification, @reference_number, and @exception_duration, so every generated PDF is unique to that submission.
💡 Want to pull a submitter's own answers into a document like this? Answer piping is how Formaloo passes data into templates using @field_id variables. See how to use answer piping in Formaloo.
5. Name and save: Give the template a name like "Vendor risk exception approval" and click Save.
📖 Want each generated PDF personalized to that specific submission rather than a generic copy? See how to generate custom PDFs using templates.
Part 3 — Generate the PDF and send it the moment an exception is approved
This is the core of the automation. One On Update rule watches for the Status field changing to Approved, and when it fires, it does two things back to back: it generates the PDF, and it emails that PDF straight to the requester. Nobody has to remember to do either step manually.
💡 Want a rule to fire whenever an existing record changes, like a status flipping to Approved? On Update is the trigger for that. See what is On Update logic and how it works.
1. Open Advanced logic: In the form editor, open Advanced logic in the settings panel on the right side, and go to the Logic tab.
2. Open Magic Logic: Click Magic Logic in the top right corner of the Logic panel.
3. Describe the rule: Write a plain-text prompt describing the automation: when Status is changed to Approved, generate a PDF using the Vendor risk exception approval template, and send the approval email to the requester's email address with that PDF attached. Also describe the companion rule: when Status is changed to Rejected, send the decline email to the requester's email address.
4. Generate and review: Click Generate Rules. Review the AI's preview of both rules and approve them.
5. Create the email templates: Before saving, make sure your "Exception approved" and "Exception declined" email templates exist, so the rule has something to attach to.
6. Finalize and save: Once both rules reference the right templates, click Save in the top right corner.
📖 See how to send custom PDFs with email notifications for how the PDF gets attached to the outgoing email rather than just saved to the row.
7. Confirm where the PDF lands: Once a request is approved, open the response row in the form's responses view. The generated PDF appears attached to that row, alongside the email log showing it was sent.
Part 4 — Add the workflow to a compliance review portal
A portal gives compliance officers a pipeline to work from instead of a flat spreadsheet, and gives requesters a place to check on their own requests without pinging compliance directly.
💡 Want to give clients, applicants, or teammates their own space to submit and track requests? This is the foundational guide to building a portal and controlling who can see it. See how to create a portal and manage users' access.
1. Activate the portal: From your project's Settings, click Activate Portal, then Manage User to open the Setup Wizard, and connect a user directory.
2. Set up roles: Add a compliance officer role and a requester role so each group lands on the right pages when they log in.
3. Restrict requesters to their own records: On the "My exception requests" page, turn on Allow users to view only their data so each requester sees only what they've submitted.
4. Restrict the Kanban view by assignee: On the compliance officer's assigned-work pages, restrict data by the Assignee field so each officer sees only the requests routed to them.
5. Add a PDF templates reference page: In a Reports group, add a page documenting the "Vendor risk exception approval" PDF template you built in Part 2, the sections it exports (vendor and request details, compliance gap, business justification, approval line), and the full HTML code behind it, so anyone on the compliance team can see exactly what feeds the audit record without opening the form editor.
6. Add an email templates reference page: On the same page, document all four templates from Part 3, their subject lines, and when each one fires: submission confirmation ("We've received your exception request for @vendor_name," sent on submit), new request assigned ("Review needed: exception request for @vendor_name," sent when a request is assigned), exception approved ("Your exception for @vendor_name has been approved," sent when Status changes to Approved, PDF attached), and exception declined ("Update on your exception request for @vendor_name," sent when Status changes to Rejected).
7. Publish the portal: Share the portal link with your compliance team and requesters.
Note: You can set a custom domain on your portal, available on the Business plan or via the Brand removal add-on.
What you now have
A vendor risk exception workflow where nothing depends on someone remembering a manual step. Requests come in with the context compliance needs to make a real decision, not just a yes or no. The moment an officer approves one, a signed-looking, audit-ready PDF exists and lands in the requester's inbox automatically, with a reference number that ties it back to that exact decision. If an auditor ever asks who approved an exception for a given vendor and why, the answer is a filtered table view away instead of a week of digging through inboxes.
What's next
Sync approved exceptions to a spreadsheet for quarterly audit reviews If your audit or risk committee prefers working from a spreadsheet, mirror every approved exception there automatically instead of exporting manually before each meeting. → How to connect and sync your forms to Google Sheets (one-way)
Lock the portal down to your own compliance domain If this portal shouldn't be reachable by anyone outside your organization, restrict sign-up to your company's email domain instead of relying on a private link alone. → How to limit who can sign up to your portal by email domain
Route different compliance gaps to different reviewers automatically As the volume of exception requests grows, assign missing-SOC-2 cases to your security lead and insurance-related ones to legal, instead of one officer reviewing everything. → How to automatically assign submissions to the right team member or team
Ready-to-use templates
Don't build this from scratch, we've already put it together for you.
Employee request workflow — Internal request routing for HR and ops teams. The same status-driven, on-approval pattern applies directly to a vendor risk exception queue.
Scholarship & grant application with scoring and approval — A multi-reviewer approval workflow with automated decision emails. Swap the scoring criteria for compliance-gap fields and the pattern carries over.
Patient intake & consent workflow for healthcare — Pairs conditional intake logic with a generated PDF consent document and an admin Kanban pipeline, the same three pieces this workflow relies on.
Don't have a form yet? Create one in seconds with Magic Create, describe what you need and Formaloo builds the form for you.
Learn more how-tos
See the broader pattern behind any approve/reject workflow This exception workflow is one flavor of a much more general shape: a status field, routing logic, and decision-triggered notifications. → How to build a dual-approval request workflow
Turn approved data into other kinds of documents The same piping-into-a-PDF technique used here for an audit record works just as well for contracts and proposals generated from a form submission. → How to turn form responses into proposals and contracts
See this pattern applied to a consent-heavy healthcare workflow Another example of pairing conditional intake logic with an auto-generated PDF and a role-based portal, worth a look if your workflow will grow beyond a single approver. → How to build a patient intake and consent workflow for healthcare clinics