Vendor Assessment Overdue
A third-party vendor's risk assessment or attestation has passed its scheduled review date without renewal.
Updated Aug 12, 2026vendor-riskrisk-acceptance
- Trigger
- A vendor record's next-review date has elapsed without an updated assessment or attestation on file.
- Risk
- Vendor risk can change materially between reviews; an overdue assessment means AssurIQ can no longer assert current confidence in that vendor's controls, which affects downstream framework requirements that depend on vendor management evidence.
Prerequisites
- Confirm the vendor's criticality tier and the required review cadence
- Identify the current vendor contact for the assessment
- Confirm which framework requirements reference this vendor's assessment
Recommended fix
- Confirm the vendor's review cadence and how overdue the assessment is.
- Send the vendor an updated assessment questionnaire or request a current attestation (e.g., SOC 2 report).
- Track the request with a due date and escalate if unanswered after the first follow-up window.
- On receipt, review the response against the vendor's risk tier criteria.
- Record the new assessment and set the next review date.
Validation
- Vendor record shows a current assessment date within the required cadence
- Any changes in vendor risk tier or findings are reflected in the risk register
- Related framework requirements referencing vendor management show updated evidence
Rollback and recovery
- If the vendor cannot provide a current assessment, document the gap explicitly, apply a documented risk acceptance if appropriate, and set a follow-up date rather than leaving the item silently overdue.
Evidence generated
- Updated vendor assessment or attestation record
- Vendor risk tier confirmation or change record
- Next scheduled review date