What breaks when critical vendor management is only reviewed once a year?

Why Annual Vendor Reviews Leave Blind Spots

Annual review cycles create a false sense of control because they snapshot a supplier’s state at one moment and then assume continuity. That assumption breaks down when a vendor’s access model, security posture, staffing, or dependency chain changes mid-year. For a question like this, the core issue is not merely procurement process quality but whether the organisation can still see material risk after the first review has aged out. The NIST Cybersecurity Framework 2.0 is relevant here because it treats governance and oversight as ongoing functions, not one-off events. In practice, many security teams discover the gap only after a vendor has already changed something important, rather than through deliberate monitoring.

How the Failure Unfolds in Practice

When critical vendor management is reviewed once a year, the organisation typically validates paperwork instead of current conditions. That can include insurance certificates, questionnaire responses, and attestations that were accurate at the time but are no longer reliable months later. The problem is not that annual review is useless, but that it is too coarse for vendors with privileged access, hosted data, live integrations, or operational dependence. Risk moves faster than the review cadence.

In practice, weak points usually appear in four places. First, access granted to the supplier is not revalidated often enough, so dormant accounts, excessive permissions, or stale remote access remain active. Second, changes in the vendor’s own environment, such as a breach, subcontractor change, or control failure, may not be visible until well after they matter. Third, business dependence can drift, meaning a supplier becomes more critical over time without a corresponding increase in oversight. Fourth, the organisation may keep treating the vendor as low risk because the last annual score looked acceptable, even though the current reality has changed.

• Review cadence should match the vendor’s actual blast radius, not the procurement calendar.
• High-impact suppliers need event-driven reassessment when access, hosting, data handling, or ownership changes.
• Evidence should be current enough to reflect active controls, not only historical statements.
• Escalation is warranted when the vendor’s role expands faster than its assurance posture.

Where this guidance breaks down is with low-impact suppliers that have no meaningful data access, no privileged connectivity, and no operational dependency, because annual review may be proportionate there.

When Annual Review Is Too Little, and When It Is Merely Slow

Tighter vendor oversight often increases administrative effort, requiring organisations to balance assurance depth against the cost of repeated validation. That tradeoff matters because not every supplier warrants the same scrutiny. A low-risk marketing tool and a provider with production access are not comparable, even if they sit in the same questionnaire queue.

There is no real consensus that one universal cadence fits all third parties. The better practice is to vary review frequency by criticality, access scope, and change rate. A vendor should move out of an annual-only model when any of the following are true: it can reach sensitive systems, it processes regulated data, it supports business-critical operations, or its service changes frequently enough that a year is too long to trust the last assessment. Annual review can still be acceptable for limited-scope vendors, but only when the relationship is genuinely stable and well bounded.

The common mistake is to confuse documentation freshness with risk freshness. A current certificate or signed attestation does not tell you whether the supplier has developed a new exposure since the last cycle. NHI Management Group would treat that as a governance failure, not a paperwork issue, because the real question is whether the organisation can detect material change before that change becomes an incident.

Practitioner Guidance

What to prioritise: Move critical vendors onto a change-aware monitoring model, not just a calendar-based review. The first priority is the subset with privileged access, sensitive data, or operational dependency, because those relationships create the highest consequence if the vendor’s posture shifts.

What to verify: Confirm that the review process is tied to trigger events such as access expansion, ownership change, incident notification, control failure, or service scope change. If none of those events would force a reassessment, the programme is probably too static to be trusted.

What practitioners underestimate: Vendor criticality often increases after onboarding. A supplier can become embedded through integrations, exception handling, or business dependency growth, so the original rating may no longer reflect the present-day risk.

Practitioner takeaway: Annual review is only safe when the vendor’s exposure stays small and stable; once a supplier is operationally important or technically connected, assurance has to follow change, not the calendar.

Related resources from NHI Mgmt Group

• What breaks when supplier access is reviewed only once a year?
• What breaks when vendor access is not tightly controlled in critical infrastructure?
• What breaks when vendor management policies do not cover access removal?
• What breaks when compliance testing happens only once a year?