Skip to main content
Oversight Institute
Category: Monitoring and Performance

Continuous Monitoring of Active Arrangements

Also known as: Ongoing Monitoring, Continuous Monitoring
Simply put

Continuous monitoring of active arrangements is the ongoing practice of keeping watch over suppliers and other third parties throughout the life of a relationship, rather than assessing them only once at onboarding. The aim is to detect new risks or changes in a third party's status as they emerge, so the organization can respond before problems escalate. Unlike a point-in-time review, this approach treats risk oversight as a continuous process.

Formal definition

Continuous monitoring of active arrangements refers to the sustained, often automated, collection and analysis of data about third parties whose contracts or relationships are live, intended to provide ongoing operational visibility, support managed change control, and enable timely response to emerging risks and incidents. In practice it is distinct from onboarding due diligence: it addresses the interval after a relationship is established, when static, point-in-time assessments become stale as a third party's posture changes. Implementations vary in scope; some programs focus narrowly on information-security or cybersecurity signals (for example, automated scanning of an external attack surface for control weaknesses), while broader programs may extend to financial, operational, geopolitical, or ESG indicators. Coverage and cadence typically depend on the risk tier of the arrangement, and monitoring signals such as external scans or self-reported updates may not constitute independent verification of a control's effectiveness. Visibility is also frequently limited to directly contracted third parties rather than fourth-party or Nth-party dependencies.

Why it matters

A third party's risk posture is not static. A supplier assessed as low-risk at onboarding can later suffer a financial downturn, a security control failure, a change in ownership, a geopolitical disruption, or a compliance lapse. Point-in-time due diligence captures only a snapshot, and that snapshot grows stale as circumstances change. Continuous monitoring of active arrangements exists to close the gap between assessments, giving the organization a chance to detect emerging risks and respond before they escalate into operational, financial, or reputational harm.

The value of ongoing monitoring lies in timeliness. Automated approaches, such as continuously scanning a third party's external attack surface for control weaknesses, can surface issues that would otherwise go unnoticed until the next scheduled review, or until an incident forces attention. In frameworks such as FedRAMP's continuous monitoring model, the stated goals are operational visibility, managed change control, and timely attention to incidents, an orientation that translates readily to third-party oversight more broadly.

That said, continuous monitoring is not a guarantee. Many monitoring signals, including external scans and self-reported updates from the third party, indicate the presence or absence of observable conditions but do not constitute independent verification that a control operates effectively. Visibility is also frequently limited to directly contracted third parties, leaving fourth-party and Nth-party dependencies outside the field of view. Organizations that treat a monitoring feed as a complete risk picture, rather than one input among several, risk a false sense of assurance.

Who it's relevant to

Third-Party Risk and Vendor Management Teams
These teams own the lifecycle of third-party relationships and are responsible for ensuring that oversight does not lapse after onboarding. Continuous monitoring gives them a mechanism to track changes in a third party's status across the life of an arrangement and to align monitoring cadence and scope with each relationship's risk tier.
Information Security and Cybersecurity Functions
Security teams often drive the narrower, cyber-focused implementations of continuous monitoring, such as automated scanning of a third party's external attack surface for control weaknesses. They should be clear that such scanning detects observable exposure but does not, on its own, independently verify that a third party's controls operate effectively.
Procurement and Sourcing Professionals
Procurement teams manage active supplier arrangements and can use monitoring outputs to inform contract reviews, renewals, and escalation decisions. Ongoing signals about financial, operational, or geopolitical changes can help procurement respond to emerging supplier risk before it disrupts delivery.
Compliance and Risk Oversight Functions
Compliance and enterprise risk teams rely on ongoing monitoring to keep their view of third-party risk current rather than resting on a single onboarding assessment. They should account for the limits of monitoring, including its typical visibility only to directly contracted parties rather than fourth-party or Nth-party dependencies, when forming an overall risk picture.

Inside Continuous Monitoring of Active Arrangements

Ongoing Risk Reassessment
Periodic or event-driven re-evaluation of a third party's risk profile after onboarding, covering changes in financial health, operational performance, security posture, and other risk domains as they evolve over the life of the arrangement. This differs from point-in-time due diligence conducted at onboarding, which captures only a snapshot.
Performance and SLA Tracking
Measurement of the third party's delivery against contractual service levels and performance obligations. Depending on the arrangement, this may cover operational metrics but not necessarily security, financial, or ESG dimensions, which typically require separate monitoring streams.
External Risk Signals
Data drawn from sources outside the direct relationship, such as cybersecurity ratings, news and adverse media, financial distress indicators, and sanctions or watchlist screening. These signals often provide near-continuous visibility but may reflect the third party's externally observable posture rather than its internal controls.
Continued Control Validation
Verification that controls attested at onboarding remain in place, for example by refreshing questionnaires, reviewing updated assurance reports (such as a current SOC 2 report), or, in higher-risk tiers, conducting independent assessments. Self-reported attestations do not constitute independent verification.
Trigger and Event Management
Defined events, such as a data breach, material adverse change, ownership change, or a downgrade in a security rating, that prompt out-of-cycle review outside the scheduled monitoring cadence.
Monitoring Cadence by Risk Tier
Differentiated frequency and depth of monitoring based on the criticality and inherent risk of the arrangement, with critical or higher-tier third parties typically monitored more frequently and rigorously than lower-tier ones.
Nth-Party Visibility Limitations
The recognition that monitoring an active arrangement centers on the direct third party, while visibility into that party's own suppliers (fourth-party and beyond) is typically indirect and often constrained by contractual and practical limits.

Common questions

Answers to the questions practitioners most commonly ask about Continuous Monitoring of Active Arrangements.

Does continuous monitoring mean a third party is being assessed in real time at all times?
Not typically. Despite the word "continuous," most programs implement monitoring as a series of recurring or event-triggered checks rather than genuine real-time observation. The cadence and depth usually vary by risk tier, with higher-risk arrangements reviewed more frequently. Even signal feeds that update frequently (for example, security ratings or news alerts) reflect the availability and latency of their underlying data sources, so "continuous" describes an ongoing posture rather than uninterrupted, moment-to-moment coverage of every risk domain.
Doesn't continuous monitoring replace the need for periodic reassessments or point-in-time due diligence?
Not in most programs. Continuous monitoring and periodic reassessment address different limitations and are generally complementary. Continuous monitoring helps detect changes between formal reviews and can reduce reliance on stale point-in-time snapshots, but it often covers only certain externally observable or self-reported signals. Deeper evidence-based reassessment, such as reviewing updated attestations, control evidence, or independent reports, is typically still conducted on a periodic or risk-triggered basis. Treating monitoring as a substitute rather than a complement can leave domains that are not covered by automated signals unmonitored.
Which risk domains can realistically be covered by continuous monitoring?
Coverage depends on which signals a program can obtain and validate. Externally observable domains, such as certain information security indicators, adverse media, sanctions or watchlist changes, and financial or credit signals, are more commonly monitored because data feeds exist. Operational, ESG, geopolitical, and control-effectiveness concerns are often harder to monitor continuously and may still rely on self-reported updates or periodic reassessment. It is important to define explicitly which domains are in scope for monitoring and which are not, so that gaps are understood rather than assumed away.
How should monitoring frequency and depth be set across a large third-party population?
In many programs, monitoring cadence and depth are aligned to risk tiering, with higher-risk or more critical arrangements receiving more frequent and deeper review than lower-risk ones. Factors that commonly inform this include the criticality of the service, data sensitivity, dependency or concentration considerations, and the third party's prior performance. Applying uniform monitoring to every arrangement can dilute attention on the relationships that matter most, so a risk-based approach is generally preferred over a one-size-fits-all schedule.
How can an organization handle the volume of alerts that monitoring generates?
Monitoring signals frequently produce a high volume of alerts, not all of which are material. Programs commonly define thresholds, severity criteria, and routing rules so that alerts are triaged and escalated according to their potential impact on the specific arrangement. Establishing ownership for review, distinguishing informational signals from those requiring action, and documenting decisions can help avoid alert fatigue. Without such triage, meaningful changes risk being lost among low-relevance notifications.
Does continuous monitoring extend visibility beyond the direct third party into fourth- or Nth-party relationships?
Generally, visibility diminishes beyond the direct contractual relationship. Continuous monitoring most reliably covers the direct third party, while fourth-party and deeper Nth-party exposure is typically harder to observe and often depends on what the third party discloses. Some programs supplement this with contractual disclosure requirements or external data where available, but limited downstream visibility remains a common constraint. Organizations should treat monitoring of extended tiers as partial and clarify what is and is not within reach.

Common misconceptions

Continuous monitoring means real-time, uninterrupted surveillance of every third party.
In many programs, 'continuous' describes an ongoing, cadence-driven process rather than literal real-time coverage. Monitoring frequency and depth typically vary by risk tier, and some data sources refresh only periodically. External signals may be near-continuous while control validation remains point-in-time.
If due diligence was completed at onboarding, ongoing monitoring adds little value.
Onboarding due diligence is a snapshot that becomes stale as the third party's financial, operational, and security conditions change. Continuous monitoring exists specifically to detect drift and emerging risk that a point-in-time assessment cannot capture.
Receiving updated attestations or questionnaires from a third party confirms controls are effective.
Self-reported attestations and questionnaire responses are assertions by the third party, not independent verification. Depending on the risk tier, programs may need independent assessments or current assurance reports to validate that attested controls actually operate as described.

Best practices

Set monitoring cadence and depth according to risk tier, applying more frequent and rigorous review to critical and higher-inherent-risk arrangements rather than treating all third parties uniformly.
Combine multiple data sources, external risk signals, performance and SLA tracking, and refreshed control validation, rather than relying on any single input, and note which risk domains each source does and does not cover.
Define explicit trigger events (such as breaches, material adverse changes, ownership changes, or rating downgrades) that prompt out-of-cycle reassessment outside the scheduled cadence.
Distinguish self-reported attestations from independent verification, and require independent assessment or current assurance reports where the risk tier warrants stronger evidence.
Document the scope limits of monitoring, including reduced visibility into fourth-party and Nth-party dependencies, so residual blind spots are acknowledged rather than assumed away.
Feed monitoring findings back into the ongoing risk reassessment so that residual risk ratings reflect current conditions rather than the profile captured at onboarding.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.