The timing and frequency of ongoing monitoring typically depend on the vendor's risk tiering. In my current role, once a vendor onboarding process is initiated, we conduct an inherent risk assessment to determine the level of risk the vendor introduces to the engagement.
Our assessment considers several factors, including:
Service dependency and criticality
Type and sensitivity of data shared
Concentration risk, transaction risk, and reputational impact
Based on this assessment, vendors are categorized into material, medium, low, or zero-risk tiers. We then request due diligence documentation aligned with the vendor's risk level and initiate an SME review once the documents are received. After the SME review is completed, the process proceeds to the contracting phase.
In short, the ongoing monitoring cadence is risk-based:
Material risk vendors: annual review
Medium risk vendors: biennial review
Low risk vendors: triennial review
This approach ensures that ongoing monitoring activities remain proportionate to the risk exposure and that higher-risk vendors receive more frequent scrutiny.