Skip to main content
Oversight Institute
Category: Monitoring and Performance

Continuous Assessment

Simply put

In third-party and supply chain risk management, continuous assessment refers to the ongoing evaluation of a supplier or business partner over the life of the relationship, rather than a single check at onboarding. It is intended to detect changes in a third party's risk profile as they occur, so that decisions can be updated in near real time. The evidence available here does not establish a settled definition of this term as used in the risk-management field.

Formal definition

The evidence packet provided contains only sources describing 'continuous assessment' as an educational examination method, the practice of evaluating a student's progress through regular activities across a course rather than a single final exam, and does not contain any material describing continuous assessment as applied to third-party, vendor, or supply chain risk management. As a result, a precise practitioner-level definition anchored to recognized TPRM or SCRM frameworks (for example ISO 27036, NIST SP 800-161, or shared assessment approaches) cannot be sourced from this evidence. In general practice the term denotes an approach in which a third party's risk is reassessed on an ongoing or event-driven basis; where such a definition is required, it should be developed from risk-management sources not present in this packet. A key limitation to note is that 'continuous' monitoring feeds (such as external security ratings or news signals) are not equivalent to periodic in-depth due diligence, and their scope, timeliness, and independence vary by program and risk tier.

Why it matters

In third-party and supply chain risk management, a supplier's risk profile is not static. Financial health, ownership, geographic exposure, security posture, and regulatory standing can all shift after onboarding, and a point-in-time assessment captures only a single moment. Continuous assessment matters because it is intended to close the gap between what was true at onboarding and what is true today, allowing risk decisions to be updated as conditions change rather than waiting for the next scheduled review cycle.

It is important to be candid about the limits of the evidence available here. The sources provided describe 'continuous assessment' exclusively as an educational examination method, the practice of evaluating a student's progress through regular activities across a course rather than through a single final exam. None of the supplied material addresses continuous assessment as applied to vendors, suppliers, or supply chains. Practitioners should therefore treat any risk-management framing of the term as requiring corroboration from TPRM or SCRM sources not present in this packet.

Where the concept is applied in practice, its value depends heavily on the quality and independence of the underlying signals. Continuous monitoring feeds such as external security ratings or news alerts are not equivalent to periodic in-depth due diligence, and their timeliness, coverage, and reliability vary by program and risk tier. Overstating what a continuous feed can detect, or treating it as a substitute for deeper, independently verified assessment, can create a false sense of assurance.

Who it's relevant to

Third-party risk and vendor management teams
These teams are responsible for evaluating suppliers beyond onboarding and would be the primary owners of any continuous assessment program. They should be aware that the evidence here does not establish a settled TPRM definition of the term and should anchor their practice to recognized risk-management sources rather than to the educational usage documented above.
Educators and instructional designers
The evidence provided defines continuous assessment strictly as an educational examination method, evaluating a learner's progress through regular activities across a course rather than a single final exam. For this audience the sourced definitions apply directly, informing teaching and learning decisions throughout a learning period.
Compliance and assurance professionals
Those relying on assessment outputs for assurance should note the distinction between continuous monitoring signals and independently verified, in-depth due diligence. Continuous feeds vary in scope, timeliness, and independence by program and risk tier, and they should not be treated as equivalent to periodic deep assessment.

Inside Continuous Assessment

Ongoing monitoring cadence
The recurring or event-driven schedule by which a third party's risk posture is re-evaluated after onboarding, intended to reduce the staleness inherent in point-in-time assessments. It does not, by itself, guarantee real-time coverage, and its effectiveness depends on the frequency and quality of the underlying data feeds.
External signal ingestion
The collection of externally observable indicators such as security ratings, financial health signals, adverse media, sanctions and watchlist screening, and geopolitical developments. These signals are typically outside-in and inferential, and generally do not substitute for independently verified attestations or inside-out evidence.
Risk-tiered scope
The alignment of monitoring intensity to the criticality and inherent risk of each relationship, so that higher-tier vendors receive more frequent or deeper scrutiny. Depending on the risk tier, lower-priority third parties may receive only periodic checks rather than truly continuous coverage.
Trigger and alerting logic
Predefined thresholds and events (for example a control lapse, a rating downgrade, a breach disclosure, or a material corporate change) that prompt escalation or reassessment. Alert quality is constrained by data timeliness and can produce false positives or missed events.
Coverage boundary
The defined scope of what the monitoring addresses. Many continuous assessment programs emphasize information security signals but provide thinner coverage of financial, operational, ESG, or geopolitical risk, and visibility often weakens beyond the direct third party into fourth-party or Nth-party tiers.
Remediation and workflow integration
The linkage between detected changes and downstream actions such as issue management, reassessment, contractual escalation, or offboarding. Without this integration, continuous signals may accumulate without driving risk-reducing decisions.

Common questions

Answers to the questions practitioners most commonly ask about Continuous Assessment.

Does continuous assessment mean a vendor is being monitored in real time?
Not necessarily. 'Continuous' typically describes an ongoing, recurring cadence rather than literal real-time surveillance. Many programs refresh signals on a periodic or event-driven basis, and the frequency often varies by risk tier. Some data sources update frequently while others remain point-in-time, so the overall picture is closer to regularly updated than truly instantaneous. Understanding the actual refresh interval of each underlying source matters more than the label 'continuous.'
Does continuous assessment replace the need for periodic due diligence or questionnaires?
No. Continuous assessment is generally intended to supplement, not replace, structured due diligence such as onboarding assessments or SIG-style questionnaires. Continuous signals often emphasize externally observable indicators and may not capture internal controls, contractual, financial, or ESG dimensions that questionnaires and evidence review address. In many programs the two are used together, with continuous monitoring flagging changes that may trigger a deeper reassessment.
How do organizations decide which third parties to place under continuous assessment?
Many programs prioritize based on risk tier, applying more frequent or intensive monitoring to higher-criticality relationships and lighter monitoring to lower-risk ones. Factors that commonly inform this include the sensitivity of data shared, operational dependency, and the potential impact of a disruption. Applying uniform continuous monitoring across an entire vendor population is often impractical, so scoping decisions typically reflect available resources and the organization's risk appetite.
What types of signals typically feed a continuous assessment program?
Depending on the program, inputs may include external security ratings, breach or incident disclosures, financial health indicators, adverse media, sanctions and watchlist screening, and changes in ownership or geographic exposure. The relevance and reliability of each source varies, and some cover only information security while others touch financial, geopolitical, or reputational dimensions. Programs generally need to define which signals map to which risk domains rather than assuming any single feed provides comprehensive coverage.
How should alerts from continuous assessment be operationalized?
In many programs, incoming signals are triaged against predefined thresholds so that changes trigger proportionate responses, such as a review, a request for clarification, or escalation. Without defined thresholds and ownership, continuous feeds can generate alert volume that outpaces the team's capacity to act. Tying alerts to documented response workflows and, where appropriate, contractual remediation timelines helps ensure that monitoring translates into action rather than accumulating unaddressed.
What are the known limitations to account for when relying on continuous assessment?
Continuous assessment often depends on externally observable data, which may offer limited visibility into a vendor's internal controls and typically extends poorly beyond the first tier to fourth-party or Nth-party exposure. Individual signals can be noisy, delayed, or self-reported, and an external rating is not an independent verification of controls. It is generally most effective as one layer within a broader program, complementing assessments, contractual obligations, and evidence review rather than standing alone.

Common misconceptions

Continuous assessment provides real-time, complete visibility into a third party's risk.
In practice it typically relies on periodic or event-driven external signals that vary in timeliness and completeness. It reduces the staleness of point-in-time assessments but does not eliminate blind spots, and much of the data is outside-in and inferential rather than independently verified.
Continuous monitoring of external signals replaces due diligence and independent verification.
External signals complement, rather than replace, onboarding due diligence and independent evidence such as audited reports. A monitored security rating is not an attestation, and an attestation is not the same as independent verification.
Continuous assessment of a direct third party covers the extended supply chain.
Coverage generally centers on the organization's direct contractual relationships, with limited visibility into fourth-party and Nth-party dependencies. Extending assurance across multiple tiers usually requires additional mechanisms beyond monitoring the first tier.

Best practices

Tie monitoring intensity and cadence to the criticality and inherent risk tier of each relationship rather than applying a uniform approach across all third parties.
Combine external, outside-in signals with periodic inside-out evidence and independent verification, treating ratings and attestations as inputs rather than conclusions.
Define and document the coverage boundary explicitly, noting which risk domains (for example security, financial, operational, ESG, geopolitical) are and are not addressed.
Integrate detected changes into remediation, escalation, and reassessment workflows so that signals drive risk-reducing decisions instead of accumulating unactioned.
Calibrate trigger thresholds and alerting logic to manage false positives and missed events, and validate that alerts reflect timely underlying data.
Acknowledge visibility limits beyond the direct third party and supplement first-tier monitoring where fourth-party or Nth-party dependencies are material.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps