Reassessment Should Start With What Changed

Six of the 21 third-party risk teams we spoke with in October asked about reassessments, and the questions were specific. Can the vendor confirm last year's answers instead of starting over? If we added new questions, can they answer only those? Can we see what changed since the last cycle? Does the next review date update itself when the risk changes?

They were all describing the same frustration. Most reassessments are first assessments again, with a different date at the top.

Starting from zero costs everyone

A vendor that answered 150 questions last year gets the same 150 questions this year, blank. They copy and paste what they can. The reviewer reads 150 answers to find the three that changed. Neither side learns anything from the other 147, and both of them know it.

The result is fatigue: slower responses, thinner answers, and reviews that drift from reading to skimming. A reassessment designed this way tests patience more than it tests controls.

Change is the signal

The useful questions in a reassessment are about difference. What changed in the vendor's controls, ownership, subcontractors, or certifications? What changed in how you use them: more data, new systems, a new business unit? What changed around them: a breach, an acquisition, a new regulation?

A reassessment built around change starts with last cycle's answers and asks the vendor to confirm or update them. It sends new questions only where the question set itself changed. It reads this year's SOC report against last year's. And it treats a change of scope, like using the same vendor for something new, as a reason to review now rather than waiting for the anniversary.

The calendar is a weak trigger

Annual reviews exist because time is an easy stand-in for change. It is a weak one. A vendor can change materially in a month, or not at all in three years. The calendar is still a reasonable backstop, but it should be the minimum cadence, not the plan.

The teams asking about reassessment weren't asking to do less. They were asking to stop doing the same work twice, so they could do the work that matters: noticing what's different.