How often should you reassess vendors? Cadence by tier

Vendor reassessment frequency depends on each vendor's tier and on your own policy: there is no single correct cadence. A common starting point is every 12 months for Tier 1 Critical vendors, stretching to 36 months for Tier 4 Low, with a lighter annual review between full assessments and event triggers that bring a review forward.

Get the cadence wrong in one direction and your team spends its year re-reviewing vendors that never change. Get it wrong in the other and an examiner finds a critical vendor whose last review predates its last breach. This post shows a common starting point, what should make you tighten or loosen it, how to anchor the clock and which events should override the calendar.

Is there a standard vendor reassessment frequency?

No. Regulators set the principle, and each organization sets the numbers. The US Interagency Guidance on Third-Party Relationships: Risk Management, issued in June 2023, does not prescribe an interval. It expects ongoing monitoring throughout the relationship, commensurate with the level of risk and complexity, and says that more comprehensive or frequent monitoring is appropriate for relationships that support higher-risk activities, including critical activities.

That leaves the cadence to you, which is both a freedom and an obligation. Your policy should state an interval for each tier, the reasoning behind it and who approved it. An examiner will test whether reviews happen on the schedule your own policy sets, so a realistic cadence you meet is worth more than an ambitious one you miss.

Cadence follows the tier because the tier already captures how much harm a vendor could do. If you have not tiered your portfolio yet, start with what vendor tiering is and how the four tiers work.

What is a common starting point by tier?

The table below is an example, not a standard. Many programs begin here and then adjust each line to their regulators and risk appetite.

The interval sets the maximum time between full reassessments. It is a ceiling, not a target. Events can and should bring a review forward, as described below.

What makes a program tighten or loosen its cadence?

Three factors move the numbers most.

• Regulated posture. Banks, credit unions, insurers and payment firms usually keep tighter maximums, especially for vendors that support critical activities or critical or important functions. A lightly regulated software company may reasonably stretch Tier 3 and Tier 4 intervals.
• Criticality and concentration. A vendor that sits under several critical services, or that relies on a provider many of your vendors share, deserves a shorter interval than its tier alone suggests.
• Evidence freshness. If a vendor publishes a new SOC 2 Type II report every year and you review each one, a longer full-assessment interval can still keep assurance current. If a vendor has no independent audit, its questionnaire answers age quickly and the interval should shorten.

Track record matters too. A vendor with open high-severity findings, repeat exceptions or a recent incident should be reviewed sooner, whatever its scheduled date.

Should the clock start from the last assessment or the latest SOC report?

Either can work. The point is to choose deliberately and record the choice.

Anchoring on the last completed assessment is simple: Tier 2 vendors come due 18 months after their last sign-off. Its weakness is that it ignores the age of the evidence the assessment relied on.

Anchoring on the latest SOC report ties the review to fresh assurance. A SOC 2 Type II report covers a period, often twelve months, and loses value as time passes after the period ends. Scheduling the review shortly after the next report is due means each assessment starts from current evidence instead of an aging one. Where the gap between the period end and your review is material, ask for a bridge letter, and remember that a bridge letter is a management statement, not auditor assurance.

Many programs use whichever date comes first: the tier interval or the expiry of the vendor's SOC coverage.

Which events should trigger an early reassessment?

Calendar cadence is only half of the design. Define triggers that force an out-of-cycle review:

1. Material change in services, data types, system access or locations.
2. Security incident or data breach at the vendor, or credible reports of one.
3. Ownership change: a merger, acquisition or significant restructuring.
4. Serious monitoring alert, such as a confirmed indicator of compromise, an enforcement action or a sharp drop in external security posture.
5. Contract renewal, which is the natural moment to confirm scope, terms and exit options.
6. New regulatory designation, for example a service that now supports a critical or important function.

A material change should reopen the tier as well as the assessment. If the vendor now holds more sensitive data or the business depends on it more, the next interval may need to be shorter.

What does the annual review between assessments cover?

The lighter annual review keeps lower-tier vendors from going dark between full assessments. It is not a repeat of the full questionnaire. A practical version asks the business owner to confirm the scope is unchanged, asks the vendor to attest that nothing material has changed and to provide refreshed key evidence (such as a new SOC report, insurance certificate or penetration test summary), checks the status of open findings and confirms the tier still fits. Any "yes, something changed" answer turns the light review into a full one.

How VendRisk360 handles this: in the VendRisk360 vendor lifecycle, each customer sets the cadence for each tier in its own policy, and the platform tracks every due date from either the vendor's SOC report coverage or the tier cadence. Owners are reminded before the due date and overdue reviews escalate. With continuous monitoring, a confirmed signal such as a disclosed breach can bring the next reassessment forward instead of waiting for the scheduled date.

Frequently asked questions

How often should critical vendors be reassessed?

Most programs fully reassess Tier 1 Critical vendors at least every 12 months and monitor them continuously in between. Heavily regulated organizations sometimes go further for their most critical providers. Whatever the interval, write it into policy, meet it consistently and let events such as a breach, an ownership change or a material change in scope bring the review forward.

Do regulators require annual vendor reassessments?

The US interagency guidance on third-party relationships does not set a fixed interval. It expects ongoing monitoring commensurate with the risk and complexity of each relationship, with more frequent or comprehensive monitoring for those supporting critical activities. Each organization sets its own cadence by tier, and examiners test whether the program follows the schedule its own policy defines.

What is the difference between a reassessment and an annual review?

A reassessment is a full review of the vendor's controls on current evidence, at the depth its tier requires. An annual review is lighter: the business owner confirms the scope, the vendor attests that nothing material has changed and provides refreshed key evidence, and open findings are checked. If the annual review reveals a material change, it should become a full reassessment.

What events should trigger an early vendor reassessment?

Common triggers are a material change in services, data or access; a security incident or breach at the vendor; a merger, acquisition or other ownership change; a serious confirmed monitoring alert; contract renewal; and a new regulatory designation such as supporting a critical or important function. A material change should also reopen the vendor's tier.