When a vendor review becomes due again
A re-assessment does not fall off a calendar, it falls due: through expiring evidence, changes at the provider or a deadline you set yourself. Three triggers and one rhythm that holds.
Three triggers
- A piece of evidence reached its expiry date: certificate, audit report or attestation.
- The provider changed something: subprocessors, location, type of processing.
- The relationship was decided on again: renewal, incident, complaint.
Why calendar reminders do not carry
A reminder in a calendar does not know what it is about. It says "review vendor X", not which piece of evidence is missing. Moving the date therefore only moves the entry.
Second, the date is not attached to the evidence. A certificate expires on a date nobody maintains, and it is noticed only once it has lapsed. The calendar has the date, the review does not.
Third, the second run costs more than the first if nothing was kept. If the first run recorded finding, source and decision, the second one does not start from zero.
What keeps a rhythm
- Tie triggers to evidence, not to calendar entries: the expiry date is the date.
- Set an interval that matches how critical the provider is, and keep it in writing.
- Name a person who starts the run and carries the decision.
- Document the basis of the date: which piece of evidence counts and where it sits.
The second run is the telling one
The first assessment shows whether the assessment itself is right. The second shows whether the process carries: whether evidence is maintained, whether decisions can be found again and whether the review works without project mode.
Anyone who runs only the first pass cleanly has a snapshot. Anyone who plans the second has a procedure an audit can rest on.
Note
This article explains how we work. Regulatory duties and their interpretation are for your compliance function to settle.