What breaks when financial institutions rely on annual vendor reviews instead of continuous monitoring under DORA?

Why annual vendor review breaks under DORA

Annual review cycles assume vendor risk is relatively stable, but DORA treats operational resilience as a moving target. A supplier can change credentials, hosting, subcontractors, security posture, or service dependencies long before the next questionnaire is due. That means the institution may hold an approval on paper while the real delivery risk has already shifted.

That gap matters most for critical or important functions, where service continuity depends on knowing when a third party has drifted out of tolerance. The longer the blind spot, the more likely the institution is to detect a problem only after a security event, service degradation, or escalation threshold has already been crossed.

For a practical DORA view of why this matters, the EU Digital Operational Resilience Act (DORA) puts ICT third-party risk management, incident reporting, and resilience testing in the same operating model, not in separate annual review silos.

What annual reviews miss between checkpoints

continuous monitoring is meant to catch change, not just confirm a point-in-time attestation. The most damaging misses are often not dramatic failures, but small signals that accumulate: exposed credentials, DNS or SSL anomalies, unusual authentication patterns, new subcontracting relationships, weak service health, or signs of financial stress that can precede delivery problems.

Those signals matter because they can change the probability and impact of compromise without changing the vendor's questionnaire answers. A supplier that was acceptable at review time can become a much larger operational and security dependency a month later, especially when it supports shared platforms, managed services, or data flows that are hard to unwind quickly.

DORA's third-party focus makes that shift especially relevant for oversight of critical ICT services. NHIMG's Third-Party Risk Management Guide and DORA Guide both align with the need to treat vendor status as something to be watched continuously, not frozen at the last review date.

Where continuous evidence collection is needed, Audit Evidence and Continuous Controls Monitoring Guide shows why stale evidence is often the real failure mode, not the absence of a formal review process.

Why the governance consequence is faster than the review cycle

Under DORA, the institutional problem is not only that risk changes, but that response authority also lags. If oversight is tied to annual review, escalation may wait for the next scheduled meeting even when the supplier's exposure has already become material. That delay can slow remediation, postpone contract or control actions, and let impact spread before owners know they need to intervene.

Annual review also weakens the institution's ability to prove it is supervising critical providers actively. If a supplier problem emerges and the record only shows last year's approval, the institution may struggle to demonstrate timely challenge, timely reassessment, or timely action. That is a governance weakness as much as an operational one.

The DORA view of that dependency is reinforced by NHIMG's Financial Services Identity Security Guide, which ties financial-sector control decisions to third parties, privileged access, and regulated resilience expectations.

When review cadence is the control, the institution is often managing a calendar. When monitoring is the control, it is managing exposure.

Risk and Threat Considerations

Annual vendor reviews create a predictable blind window that adversaries and failure conditions can exploit. A supplier compromise, credential leak, subcontractor change, or service instability can mature fully between review dates, leaving the institution unaware until the issue affects production services or spreads to connected environments.

Failure mechanism: The control assumption is that the vendor's risk state remains materially stable for months at a time, so fresh indicators are not continuously consumed, triaged, or escalated.

Impact: Institutions can miss early warning signs, delay containment or vendor challenge, and discover that critical service risk has already propagated into outage, compromise, or regulatory exposure.

Practitioner Guidance

What to verify: Replace calendar-only review with a small set of live indicators that can change escalation priority, such as domain and certificate anomalies, leaked credential signals, subcontractor changes, and service-health deterioration. If the signal can affect a critical service, it should not wait for annual review.

Decision rule: If the vendor supports a critical or important function, treat continuous monitoring as the default and use annual review only as a governance checkpoint, not as the detection mechanism.

Practitioner takeaway: Under DORA, the question is not whether the vendor passed last year's review, but whether you would know this week if its risk profile changed enough to threaten service continuity.

Related resources from NHI Mgmt Group

• What breaks when organizations rely on annual vendor assessments instead of continuous supply chain monitoring?
• What breaks when organisations rely on compliance reviews instead of continuous monitoring?
• What breaks when organisations rely on vendor questionnaires instead of continuous third-party identity monitoring?
• What breaks when financial institutions rely on manual access reviews instead of governed workflows?