Risk Assessments Decay: A Refresh Cadence Field Guide

Scope - What This Guide Covers

This guide tackles the challenge of keeping vendor risk profiles accurate when risk factors change faster than your assessment cycle. It's aimed at analysts responsible for reassessment scheduling, monitoring triggers, and evidence refresh workflows within active vendor relationships.

You'll find breakdowns for dynamic assessment architectures, guidance for refresh triggers, and a reference table mapping risk velocity to reassessment cadence.

Key Concepts and Definitions

Risk Velocity: The rate at which a vendor's risk profile changes due to technology shifts, organizational changes, or environmental factors. A vendor migrating to cloud infrastructure has higher risk velocity than one maintaining legacy systems.

Assessment Decay: The degradation of assessment accuracy over time. Your Q1 security review may not reflect controls that have changed by Q3, creating a gap between documented risk and actual exposure.

Refresh Trigger: An event or threshold that initiates reassessment outside the scheduled cycle. These include breach notifications, material changes to service scope, or significant deviations in continuous monitoring signals.

Monitoring Fidelity: The precision and frequency of signals collected between formal assessments. High-fidelity monitoring (daily cyber risk rating checks, weekly SLA reviews) reduces reliance on point-in-time assessments.

Requirements Breakdown

Baseline Reassessment Cadence

Your criticality classification drives minimum refresh frequency:

Critical Vendors: Annual comprehensive reassessment, with quarterly evidence validation for key controls.

High-Risk Vendors: Annual reassessment, semi-annual control spot-checks.

Moderate-Risk Vendors: Biennial full reassessment, annual questionnaire refresh.

Low-Risk Vendors: Triennial reassessment or trigger-based only.

These are minimums. Risk velocity should compress these timelines.

Continuous Monitoring Requirements

ISO 27036 emphasizes ongoing security monitoring of supplier relationships. Implement these baseline signals:

• Cyber risk rating checks (weekly for critical vendors, monthly for high-risk)
• Financial viability indicators (quarterly D&B reports or equivalent)
• Breach notification monitoring (real-time via vendor feeds or threat intelligence)
• Certificate and compliance attestation expiry tracking (automated alerts 90 days before expiration)

Trigger-Based Reassessment Events

Document these mandatory reassessment triggers in your vendor risk governance framework:

1. Breach or Major ICT-Related Incident: Full security reassessment within 30 days of notification
2. Material Change to Service Scope: Risk scoring refresh before contract amendment execution
3. Merger, Acquisition, or Ownership Change: Comprehensive reassessment within 60 days
4. Cyber Risk Rating Degradation: Two-grade drop (e.g., A to C) triggers immediate review
5. Sub-Outsourcing Introduction: Fourth and Nth Party Management assessment before arrangement becomes active
6. Regulatory Action or Enforcement: Review within 45 days of public disclosure
7. Financial Distress Signals: Going concern assessment if D&B rating drops below acceptable threshold

Implementation Guidance

Building a Dynamic Assessment Architecture

Step 1: Map Risk Velocity by Vendor Cohort

Group vendors by change frequency, not just criticality. A critical vendor with stable infrastructure may have lower risk velocity than a moderate-risk SaaS provider deploying weekly.

Consider a team managing 200 active vendors. You might classify 15 as high-velocity (monthly significant changes), 60 as moderate-velocity (quarterly changes), and 125 as low-velocity (annual or less). Your monitoring fidelity should match velocity, not just criticality tier.

Step 2: Instrument Monitoring Signals

Don't rely on annual questionnaires alone. Deploy:

• API integrations with cyber risk rating platforms for automated score ingestion
• Calendar alerts for compliance certificate expirations (ISO 27001, SOC 2, PCI DSS)
• RSS or email monitoring for vendor-specific breach disclosures
• Contract management system flags for upcoming renewal dates that trigger reassessment

Step 3: Define Evidence Shelf Life

Not all assessment artifacts age at the same rate:

• SOC 2 Type II reports: Valid until next examination period (typically 12 months)
• Penetration test results: 6-month shelf life for internet-facing services
• Business continuity test results: 12 months
• Security questionnaire responses: 12 months for stable environments, 6 months for high-velocity vendors
• Cyber risk ratings: Real-time or weekly refresh

Document these timelines in your assessment procedures so analysts know when evidence requires refresh.

Step 4: Automate Reassessment Scheduling

Build a workflow that queues vendors for reassessment based on:

• Time since last comprehensive review
• Monitoring signal changes (rating drops, certificate expirations)
• Trigger event occurrence
• Risk velocity classification

Your vendor risk platform or GRC tool should generate a monthly reassessment queue, not rely on analysts to remember cycles.

Tools and Technologies for Continuous Risk Monitoring

Cyber Risk Rating Platforms: SecurityScorecard, BitSight, RiskRecon provide continuous external security posture monitoring. Integrate these into your vendor records for weekly or daily automated checks.

Financial Monitoring Services: Dun & Bradstreet, CreditSafe, or similar for going concern assessment signals. Set alerts for rating downgrades.

Threat Intelligence Feeds: Recorded Future, Flashpoint, or industry-specific ISACs for breach and vulnerability disclosures affecting your vendor base.

Contract Lifecycle Management: Ironclad, Coupa, or similar platforms with reassessment workflow triggers tied to contract events.

Common Pitfalls

Treating Annual Reviews as Sufficient: An annual SOC 2 report tells you what controls existed during a 12-month period that ended months ago. If you're not monitoring between reports, you're flying blind.

Ignoring Low-Criticality, High-Velocity Vendors: That moderate-risk marketing automation vendor pushing weekly feature releases may introduce more actual risk exposure than your critical but stable data center provider. Don't let criticality classification override velocity-based monitoring.

Failing to Document Trigger Events: If a vendor notifies you of a breach via email and you don't log it as a reassessment trigger, your next audit will reveal a governance gap. Create a formal incident intake process.

Over-Relying on Questionnaires: SIG Core and custom questionnaires capture point-in-time attestations. They don't reflect what changed last week. Balance questionnaires with continuous monitoring signals.

Not Validating Monitoring Signal Accuracy: Cyber risk ratings can generate false positives (flagging decommissioned IP addresses) or miss insider threats. Treat monitoring signals as triggers for investigation, not as final risk determinations.

Quick Reference Table

Vendor Tier	Baseline Reassessment	Monitoring Fidelity	Common Triggers
Critical (supports critical/important functions)	Annual comprehensive; quarterly control validation	Weekly cyber rating; monthly financial check; real-time breach monitoring	Any breach, material scope change, sub-outsourcing, M&A
High-Risk	Annual reassessment; semi-annual spot-check	Monthly cyber rating; quarterly financial check	Breach, two-grade rating drop, regulatory action
Moderate-Risk	Biennial full; annual questionnaire	Monthly cyber rating; semi-annual financial check	Breach, major scope change, ownership change
Low-Risk	Triennial or trigger-based	Quarterly cyber rating; annual financial check	Breach notification, M&A
High-Velocity (any tier)	Compress baseline by 50%	Increase monitoring frequency one level	Technology migration, frequent releases, organizational restructuring

Evidence Shelf Life:

• SOC 2 Type II: 12 months
• Penetration tests: 6 months
• BCP test results: 12 months
• Security questionnaires: 12 months (stable) / 6 months (high-velocity)
• Compliance certificates: Until expiration minus 90-day buffer

Bookmark this table and reference it when scheduling your quarterly reassessment queue or responding to "How often should we review this vendor?" questions.