Due Diligence and Ongoing Monitoring

Should we do a vendor background check for existing vendors annually or only when engaging with the vendor?

The frequency in which you review vendor due diligence depends on your TPRM Program specifications. For low or moderate risk vendors, it is not necessary to run a background check annually so long as initial due diligence was complete.

Our organization reevaluates low-moderate risk vendors every 2-5 years, or whenever there is a change in the service agreement.