Personally, I rate my vendors based on risk tiers. Tier 1 is reviewed annually, tier 2 is reviewed every two years, etc. If you're quite firm on doing annual reviews at the same time, you'll have to insist that the information they're providing to you is the most current and reported. Obviously there are online resources you can use (for example, if you're in the UK, you can pull financials from Companies House). When I was doing regulatory CDD, it was acceptable to collect information that was still valid within the past 12 months. But if you're doing reviews in 4Q24 and you're still given financial numbers from YE23, sometimes the only thing you can really do is take the vendor's word for it that what they're providing you is most accurate. One would hope that a company's financials wouldnt stray too far from what it was previously :)