Third-party risk questionnaires are failing on volume and cycle time

At a glance

What this is: SecurityScorecard argues that third-party risk questionnaires do not fail uniformly, with intake, periodic, attestation, and event-driven workflows each breaking for different operational reasons.

Why it matters: IAM, vendor risk, and security teams need to distinguish questionnaire types because the right control model for a fast intake review is not the same as the one needed for recurring evidence tracking or urgent incident-driven assessment.

Context

Third-party risk management often fails when teams treat every questionnaire as the same control. In practice, intake requests, recurring assessments, certifications, and urgent event-driven reviews have different ownership, evidence, and timing requirements, so a single workflow model creates queues rather than governance.

This matters for identity and access programmes because vendors increasingly operate through shared access, federated integrations, and machine-to-machine dependencies. If the review process cannot distinguish between a low-friction intake check and a high-trust certification decision, risk ownership becomes diffuse and exceptions accumulate.

The pattern is typical of mature but overloaded TPRM programmes: the challenge is less about one broken questionnaire and more about misaligned operating models across the vendor lifecycle.

Key questions

Q: What breaks when third-party risk management stays questionnaire-based?

A: Questionnaire-only programmes miss real-time drift, hidden sub-processors, and changes in access scope. They also encourage false confidence because the evidence is old by the time it is reviewed. The failure is not just inefficiency; it is that the control model assumes vendors remain stable long enough for periodic assurance to work.

Q: Why do periodic vendor assessments so often become a bottleneck?

A: Periodic assessments become a bottleneck because they combine large control sets, manual evidence review, and weak scoping discipline. When teams do not limit the review to changed controls, they repeat the entire exercise every cycle. That turns assurance into a queue-management problem instead of a risk decision.

Q: How can security teams tell whether attestation evidence is still reliable?

A: They should verify three things: the control scope, the expiry date, and whether the evidence actually covers the service or environment being reviewed. A certificate or report is not perpetual trust. Once it ages out or no longer matches the service in question, it should trigger renewed review rather than automatic acceptance.

Q: When should a vendor trigger a fresh assessment outside the normal cycle?

A: A fresh assessment is warranted when a vendor changes access methods, receives privileged support rights, gains new data exposure, or is involved in an incident or regulatory inquiry. Those events change the risk profile even if the annual review is not due yet. Event-driven assessment keeps assurance aligned with actual operational change.

Technical breakdown

Why third-party questionnaires break into four control paths

Questionnaires are often grouped as if they were one process, but they actually serve different governance functions. Intake questionnaires establish risk tiering before access begins, periodic assessments verify ongoing control health, attestations reuse external evidence such as SOC 2 or ISO 27001, and event-driven questionnaires respond to a trigger such as a breach or regulator inquiry. Each path needs different routing, ownership, and evidence rules. When programs collapse them into one queue, they create avoidable backlog and inconsistent decisions.

Practical implication: Map each questionnaire type to a separate workflow, owner, and service level so the process matches the control objective.

Why recurring assessments become the slowest control point

Recurring assessments are slow because they combine framework mapping, evidence collection, review, and exception handling. First-time assessments can span hundreds of controls, and later reviews still depend on change scoping, which many programs cannot operationalise at scale. The result is not just delay but stale assurance, where the business continues onboarding or renewing vendors while the control review trails behind. That gap is a governance failure, not a staffing inconvenience.

Practical implication: Separate full-assessment logic from delta-assessment logic and define which evidence can be safely reused across review cycles.

How attestation management turns into hidden risk

Attestations and certificates reduce questionnaire volume only if teams know what the document proves, what scope it covers, and when it expires. A SOC 2 report or ISO 27001 certificate is evidence, not automatic clearance. Without expiry tracking and scope validation, organisations can over-trust old documents or apply them to services they do not actually cover. That creates a false sense of control and weakens vendor governance.

Practical implication: Track certificate scope, validity, and expiry separately from the vendor record so evidence is not treated as perpetual assurance.

Threat narrative

Attacker objective: The practical attacker objective is not a single exploit but the creation of assurance gaps that let risky third parties remain connected longer than the programme can justify.

1. Entry begins when a business or security team opens a third-party intake, event-driven, or periodic assessment and routes it through an overloaded review queue.
2. Escalation occurs when delayed routing and weak evidence handling allow vendors to retain access, renew contracts, or avoid re-review while control changes go untested.
3. Impact is stale third-party assurance, with exceptions, expired evidence, and unresolved risk decisions cascading into broader vendor exposure.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Questionnaire sprawl is a governance design problem, not a document problem: third-party risk teams fail when they route all assessments through one operating model. Intake, periodic review, attestation reuse, and incident-driven follow-up each answer a different control question, so treating them as interchangeable creates backlog and weak decision quality. Practitioners should design the workflow around the assurance decision, not the form.

Cycle time is the real control signal: recurring assessments that sit at six weeks to three months are already drifting away from the pace of vendor change. That lag means the program is certifying yesterday’s posture while the vendor environment continues to evolve, which is especially risky where SaaS integrations and machine credentials are in play. Practitioners should measure how long assurance remains current, not just how many questionnaires are issued.

Attestation reuse needs explicit governance: a SOC 2 report or ISO 27001 certificate is only useful when scope, expiry, and control coverage are validated. Otherwise, the programme quietly turns external evidence into permanent trust. That is a familiar failure mode in IAM-adjacent vendor oversight, where access decisions outlive the evidence that justified them.

Third-party access and third-party evidence are converging risk domains: the same vendors that need questionnaires may also hold API keys, SSO trust, or service credentials. This makes the article relevant beyond TPRM paperwork, because poor assessment design can leave NHI and delegated access unchecked. Practitioners should align vendor review with actual access pathways, not just procurement milestones.

Assessment backlog creates exception debt: when urgent or recurring questionnaires pile up, teams begin to accept workarounds, temporary approvals, and manual overrides. Over time that becomes a durable control gap, because exceptions are no longer exceptional. Practitioners should track exception aging as a first-class governance metric and treat it as evidence of control failure.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.

What this signals

TPRM governance fails when assessment type and operating model are misaligned: teams that treat intake, periodic review, attestation, and event-driven response as one queue will keep generating backlog. The better control is to align workflow, ownership, and service level to the decision being made, not to the questionnaire format.

Assessment cycle time has become a security control in its own right: when recurring reviews drift into multi-week or multi-month windows, assurance starts to trail vendor change. For identity-heavy vendor relationships, that lag can leave access pathways and evidence chains out of sync.

Third-party evidence should be time-bound, scoped, and tied to actual access paths: certifications are useful only when they are validated against the service, the privileges granted, and the date they expire. That is the practical line between efficient governance and inherited risk.

For practitioners

• Segment questionnaires by control purpose Separate intake, periodic assessment, attestation review, and event-driven response into distinct workflows with different owners and service levels.
• Automate evidence reuse rules Define which certifications, reports, and signed attestations can be accepted, for how long, and for which services or business units.
• Track cycle time as a risk metric Measure time to complete each questionnaire type and flag recurring reviews that exceed your acceptable assurance window.
• Tie vendor review to actual access paths Require a fresh review when a vendor gains SSO access, API credentials, or privileged support channels, not only at contract renewal.
• Escalate overdue exceptions Review open exceptions on a fixed cadence and require explicit risk acceptance when remediation or evidence collection slips past policy.

Key takeaways

• Third-party questionnaires fail for different reasons depending on whether the task is intake, recurring assessment, attestation review, or incident response.
• Recurring assessments are the clearest bottleneck, with cycle times that commonly stretch into weeks and sometimes months.
• The effective fix is not more questionnaire volume control, but tighter governance over workflow design, evidence reuse, and exception handling.

Key terms

• Third-party risk management: Third-party risk management is the process of identifying, assessing, monitoring, and reducing risk introduced by external vendors and service providers. In identity terms, it governs who outside the organisation can reach systems or data, how that access is approved, and when it must be removed.
• Questionnaire Routing: Questionnaire routing is the assignment of a questionnaire to the correct owner, workflow, and review path based on its purpose and urgency. It is a governance control as much as an administrative step, because poor routing creates backlog, inconsistent decisions, and missed escalation points.
• Attestation: Attestation is verifiable evidence about a workload’s execution context, such as where it is running, who started it, and whether it matches policy. In agent governance, attestation can be used to bootstrap enrollment and to justify access decisions that need to change as the workload behaves differently.
• Exception Tracking: Exception tracking is the process of documenting changes that do not follow the normal approval workflow, such as emergency production fixes. It preserves auditability by recording the person, timing, reason, and deviation so reviewers can understand why standard procedures were bypassed.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for security and identity practitioners who need to connect governance decisions to access risk across modern environments.