The standard vendor onboarding questionnaire gets completed, filed, and referenced approximately never again. It answers a question that mattered on the day it was submitted — does this vendor meet our bar today — and stops answering anything the moment that vendor's environment changes, which for most vendors is constantly.The Assumption the Questionnaire Quietly MakesA point-in-time assessment assumes a vendor's risk profile is stable enough that one snapshot represents the relationship for its duration. That assumption rarely survives contact with reality: vendors get acquired, change subprocessors, suffer their own incidents, or simply let a control lapse once nobody is asking about it anymore. None of that shows up in a questionnaire filed two years ago.What a Tiered, Ongoing Programme Looks LikeVendors tiered by what they actually touch: a payment processor and a stationery supplier do not warrant the same depth of scrutiny or the same review frequency.A trigger list, not just a calendar: a breach disclosure, a subprocessor change or a significant contract renewal should prompt a re-assessment regardless of where the vendor sits in the annual cycle.Evidence over attestation where the tier justifies it: a self-reported answer is a starting point for a low-risk vendor and rarely sufficient on its own for a critical one.A named internal owner per vendor relationship: so a lapsed control has someone accountable for chasing it rather than a shared inbox nobody checks.“A vendor risk programme measured by questionnaires sent is measuring effort. A vendor risk programme measured by what changed since the last review is measuring risk.”Sizing the Effort to the ExposureNone of this means treating every vendor like a critical one — that collapses under its own weight within a quarter. It means being honest about which handful of vendors could actually hurt the business if something went wrong, and spending the ongoing attention there instead of spreading it evenly across a vendor list where most of the risk sits in a small fraction of the names.Share this articleX (Twitter)LinkedInFacebookCopy Link
ISMSJul 31, 2026An ISMS Is a System, Not a BinderISO 27001 certifies an information security management system — an operating system for decisions, not the folder of policies produced to pass the audit that certifies it.
ComplianceAug 28, 2026Continuous Assurance Without the Audit-Season ScrambleMost compliance programmes run fine for eleven months and then spend the twelfth reconstructing evidence for controls that were supposed to be operating the whole time.
Incident ResponseJul 3, 2026The Incident Response Plan That Only Works on PaperA well-written incident response plan that has never been rehearsed is a hypothesis about how the organization will behave under pressure, not a tested capability.
