Operations
Build a review cycle that survives the calendar
An annual date is useful for accountability, but it is not continuous oversight. The queue should react when the relationship changes.
Use cadence as the backstop
Critical relationships may justify quarterly oversight and a full annual reassessment. High-risk vendors may need an annual review. Moderate and low-risk relationships can run on longer cycles. These dates prevent silent neglect, but they should not be the only reason a vendor returns to the queue.
Define material review triggers
- A reported breach, outage, regulatory action, or significant security-rating change.
- A contract renewal, new product, material subprocessor, acquisition, or ownership change.
- New production access, expanded data scope, or movement into a more critical business process.
- Evidence expiry, an overdue finding, repeated SLA failure, or an unresolved conditional approval.
Separate monitoring from reassessment
Not every signal requires a full questionnaire. Monitoring should create a triage decision: dismiss as irrelevant, request targeted evidence, open a finding, change the tier, or launch a reassessment. This keeps the response proportional to the signal.
Give every review an owner and outcome
A review is complete only when someone records the decision, rationale, conditions, and next cadence. Dashboards showing dates are not enough. The durable asset is the decision trail that explains why the relationship remains acceptable.