From Annual Reviews to Continuous Vendor Risk Monitoring

Periodic reviews mean there is a time gap between each assessment. During that time, a vendor’s risk exposure may increase. Your team may not become aware of it. Instead, we should be continuously assessing vendors and performing an assessment when a material change occurs. An assessment can be triggered at various stages, for example, during vendor onboarding, based on a predetermined schedule, after a breach, etc. The author explains this process as a five-part process: onboarding and evaluating vendors based on the risk exposure; assessing the vendors; continuously monitoring the vendors and risk areas; taking corrective action with support of the vendor; and reporting on it. This process explains the continuous nature of the risk assessment process to various stakeholders.