Ongoing risk identification is the continuous process of finding new or changing risks throughout a third-party relationship. It goes beyond initial due diligence by tracking changes in controls, obligations, incidents, contract terms, and business context, allowing teams to detect issues that a one-time assessment would miss.
What Ongoing Risk Identification Means in Third-Party Risk Management
Ongoing risk identification is the discipline of watching a third-party relationship for change after onboarding, not treating due diligence as a one-time event. It exists because vendors, subcontractors, services, contracts, and business dependencies evolve, so the risk profile can rise or shift long after the initial review is complete.
In practice, it is the difference between a point-in-time assessment and a living view of exposure. A supplier may add new sub-processors, change hosting arrangements, alter support access, or experience an incident that changes its risk posture; ongoing identification is how those changes become visible early enough to act.
Why It Matters for Control Coverage and Assurance
The core value of ongoing risk identification is that it catches drift. Initial questionnaires, attestations, and contract review can be accurate on the day they are completed and still miss later changes in control maturity, scope, geography, ownership, or obligations. For third-party risk programs, that means the control environment has to be monitored as a relationship lifecycle, not a procurement milestone.
It also improves assurance quality. When risk signals are refreshed continuously, teams can distinguish stable suppliers from those whose operating model, incident history, or dependency chain is changing in ways that deserve review. That makes risk treatment more targeted and reduces the chance that a material issue is discovered only after it has become an operational problem.
What Changes Need to Be Tracked
Ongoing risk identification usually focuses on changes that materially alter the third party’s exposure or your dependence on it. Common examples include new incidents or near misses, changes to controls or certifications, contract amendments, new data handling practices, altered access paths, concentration in a critical service, and changes to legal, regulatory, or geopolitical context.
This is also where business context matters. A supplier may remain technically compliant while becoming more important to your operations, handling more sensitive data, or relying on a narrower set of upstream dependencies. Those changes do not always appear in an annual review, but they can materially change the risk picture.
Tools and evidence should support the process, not replace judgment. Risk signals from monitoring, attestations, news, audit results, and service reviews need interpretation against the specific relationship, the criticality of the service, and the obligations already in place.
How Ongoing Identification Supports Response and Governance
When risk is identified continuously, response can be proportionate. A newly discovered issue may require increased monitoring, a contract reset, compensating controls, escalation to the business owner, or exit planning if the relationship has become unacceptable. The point is not to generate more alerts, but to create a faster and more accurate decision loop.
It also strengthens accountability. Third-party risk is often spread across procurement, security, legal, privacy, resilience, and the business owner, so ongoing identification gives those stakeholders a shared basis for deciding when to re-assess, when to accept, and when to intervene.
For a practical governance lens on risk discovery, control review, and reassessment, NHIMG’s AI Risk Assessment Guide, Privacy-Enhancing Technologies Guide, and Anonymisation and Re-identification Risk Guide each illustrate how risk must be revisited when circumstances change, rather than assumed to remain static.
Risk and Threat Considerations
Ongoing risk identification matters because third-party risk often fails through drift, not through the original due diligence decision. A supplier can accumulate new dependencies, lose control strength, or change its operating model in ways that create exposure long after onboarding, and adversaries often benefit from those unnoticed changes.
Failure mechanism: The organisation relies on a stale snapshot of the third party, so newly introduced weaknesses, incidents, or access changes are not surfaced early enough to trigger review, mitigation, or exit planning.
Impact: That gap can lead to unrecognised exposure, delayed response, contractual non-compliance, service disruption, or a larger blast radius if the third party becomes a compromise path into sensitive data or connected systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 and SOC 2 (AICPA) define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Defines ongoing risk management as a continuous enterprise practice. |
| ID.RA-01 — Asset Vulnerability and Threat Identification | Supports continuous identification of changing exposure and threat conditions. | |
| GV.OV-01 — Oversight and Review | Requires oversight that can revisit risk posture over time. | |
| Recommendation — Build a recurring third-party risk review cadence that refreshes risk decisions when conditions change. Continuously identify new third-party risks as controls, incidents, and dependencies change. Use governance reviews to escalate material third-party drift and decide on mitigation or acceptance. | ||
| ISO/IEC 27001:2022 | A.5.19 — Information security in supplier relationships | Requires security expectations to be managed across supplier relationships. |
| A.5.20 — Addressing information security within supplier agreements | Makes contractual obligations part of ongoing supplier risk control. | |
| A.5.21 — Managing information security in the ICT supply chain | Directly addresses supply-chain changes that alter third-party risk. | |
| Recommendation — Maintain supplier security requirements and reassess them when the relationship changes. Review supplier agreements for new obligations, access changes, and security commitments. Track upstream supply-chain changes that may alter the third party’s security posture. | ||
| SOC 2 (AICPA) | CC9.2 — Risk Mitigation | Supports managing risks from vendors and other external parties. |
| Recommendation — Reassess vendor risks continuously and update mitigation plans when conditions shift. | ||
Practitioner Guidance
Why practitioners should care: Ongoing risk identification should be owned as a repeatable operating process, not an occasional audit task. The useful question is whether your program can detect material change quickly enough to re-prioritise the relationship before the change becomes an incident or governance failure.
What to watch for: The highest-value signals are usually change signals, not static scores, especially new incidents, contract changes, control regressions, service expansion, data scope growth, and increased dependency on the supplier. If those inputs are not regularly refreshed, the program is likely to overstate assurance.
Practitioner takeaway: Treat third-party risk as a living relationship, and make reassessment triggerable by change, not just by calendar.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org