Your Vendor Risk Score Freezes at Onboarding. Your Vendor Doesn't.

Every mature third-party risk programme has a moment it considers the vendor "assessed." A questionnaire comes back, a screening tool runs, a risk score gets calculated, a tier gets assigned, and the vendor moves into the portfolio with a defensible file behind it. That moment is real, and it matters. What most programmes quietly assume next is that the file stays true until the next scheduled review — in twelve months, or whenever a renewal happens to trigger one.

It doesn't. A vendor's bank account can change six times in three years. Its ownership structure can shift after an acquisition nobody flagged. A director can also turn out to be an employee in accounts payable. A certificate of insurance can lapse quietly in month eight of a twelve-month cycle. None of that shows up in the file that was closed at onboarding — it shows up, if it shows up at all, in the transactional systems where the vendor actually operates: the ERP, the procurement platform, the payment run, the contract repository.

Continuous vendor and third-party assurance is built for exactly that gap — the distance between the vendor a risk team assessed once and the vendor that is actually transacting with the business every day since. It extends the vendor intelligence a TPRM programme already has into ongoing monitoring of vendor-master data and transactional behavior, so the risk score isn't just accurate on the day it was calculated.

The Point-in-Time Trap

Gartner's Predicts 2026: Third-Party Cybersecurity Risk Management Evolves for the AI Era names the underlying problem directly: third-party questionnaires remain point-in-time, self-reported assessments. They capture what a vendor claims at a specific moment — not how their posture evolves, how controls drift, or how new risks emerge after onboarding. Gartner also flags a subtler failure mode arriving alongside AI adoption: as vendors increasingly use generative AI to complete questionnaires and risk teams increasingly use AI to analyze the responses, the errors on both sides can compound into what the analysts call output degradation — a growing disconnect between what the paperwork says and what is actually true.

This isn't an argument against due diligence. Onboarding screening, sanctions checks, and questionnaire-based assessment still do the job they were built for — establishing who a vendor is before the relationship starts. The problem is treating that snapshot as though it holds indefinitely. Gartner's own forecast is that by 2028, half of third-party cyber risk programmes will have shifted their center of gravity toward continuous monitoring, freeing up the resources currently spent re-running due diligence on a calendar rather than in response to what's actually changing. The COSO Internal Control–Integrated Framework's monitoring component has argued for this same ongoing-evaluation principle for years, well before "continuous monitoring" became an AI-era buzzword.

The same logic applies well beyond cybersecurity questionnaires. A vendor's financial health, ownership structure, contract status, and transactional behavior inside a client's own ERP all drift continuously too — and none of it waits politely for the next annual review to surface. This is where continuous vendor and third-party assurance connects two things that most TPRM stacks keep separate: the vendor intelligence gathered at onboarding, and the vendor's actual behavior in procurement, payments, and contract systems afterward.

What Actually Changes After Onboarding

Vendor master data is one of the least glamorous corners of enterprise risk, and one of the most exploited. In a 2026 interview with a global procurement technology executive at SAP, fraud-prevention specialists described what they call the "80% rule" — the overwhelming majority of vendor fraud happens at onboarding or at the moment bank details are modified, not at the payment step itself. By the time a fraudulent payment is released, the exploitable moment has already passed unnoticed, often months earlier.

The same conversation surfaced what its participants called an overconfidence gap: a large majority of finance and procurement leaders say they trust their vendor master data, while a comparable majority admit they do not monitor it continuously. That combination — high confidence, low verification — is precisely the condition under which a "low and slow" change to a bank account, an address, or an ownership record sits unnoticed in the master file for years, discovered only by accident or after the loss has already occurred.

Regulators are responding to the same pattern from the payments side. Nacha's fraud-monitoring and account-validation rule changes reached full effect in 2026 across two phases — the first, covering the largest originators and processors, effective March 20, 2026; the second, extending the requirement to all remaining ACH originators and third-party senders, effective June 19, 2026. Together they require a risk-based process confirming that a receiving account genuinely belongs to the intended payee before funds move, and they expand the definition of fraud covered under the rules to include false-pretenses payments. None of that is achievable from a due-diligence file that was accurate the day it was filed — it depends on the vendor master record being continuously verified against what's actually on file at the bank.

This is precisely where continuous procure-to-pay and vendor-master controls and continuous vendor and third-party assurance meet, though they solve adjacent problems. P2P monitoring watches the transaction — the invoice, the payment run, the three-way match. Continuous vendor and third-party assurance watches the vendor record itself and the relationship around it — the ownership, the related parties, the contract status, the concentration exposure — connecting that record back to what's actually happening in procurement and payments rather than treating the two as separate systems of record.

What Continuous Vendor and Third-Party Assurance Actually Does

Continuous vendor and third-party assurance extends Crest.Digital's existing TPRM and vendor intelligence capabilities into client-specific monitoring of the vendor master file and the behavior around it. It doesn't replace onboarding due diligence, sanctions screening, or the annual reassessment cycle — it sits on top of them, watching for the things that change in the months between reviews and connecting vendor intelligence with what's actually happening in the client's own systems.

Consider a global manufacturing enterprise running a shared-services procurement function across several regions. A critical-tier vendor passed onboarding due diligence eighteen months ago with a clean file. Since then: its registered director has changed twice, a new beneficial owner shares a surname with a mid-level employee in the client's own procurement team, its liability insurance certificate lapsed five months ago without a renewal on file, and its share of total category spend has crept from 12% to 34% as competing suppliers were quietly consolidated out. None of these facts, individually, would trigger the next scheduled review. Together, they describe a vendor whose actual risk profile has moved substantially since the day it was last assessed — and a concentration position that turns a single-supplier disruption into a material operational risk.

That is the pattern continuous assurance is built to surface: not a single dramatic red flag, but the accumulation of smaller changes that only become visible when someone — or something — is actually watching the vendor record continuously, across every system that touches it, rather than re-reading the same onboarding file on a fixed schedule.

An 8-Point Framework for Continuous Vendor and Third-Party Assurance

None of this requires replacing an existing TPRM platform, procurement system, or ERP. The framework below describes where an agent adds an ongoing monitoring layer across systems that already hold the relevant data, most of which was never designed to talk to each other.

Point eight deserves particular attention because it's the one most annual-cycle TPRM programmes miss structurally. Concentration risk doesn't arrive as an event — it accumulates gradually, category by category, as competing suppliers are consolidated or fall away, until a single vendor quietly becomes a single point of failure nobody explicitly decided to accept. Sphera's 2026 supply chain risk research found that supplier viability issues — financial and operational stress at the supplier itself — remain the single largest category of supply chain risk events, up roughly 10% year over year, with the large majority of organizations reporting at least one material disruption in the past twelve months. A continuous monitor that tracks concentration as a moving number, not a once-a-year calculation, is what turns that into an early warning rather than a retrospective explanation.

Building the Programme: A Six-Step Delivery Playbook

Crest.Digital delivers continuous vendor and third-party assurance as a configurable "Risk Automation Pod" rather than a bespoke software build — a shared underlying stack of integration connectors, rules engine, evidence repository, and dashboards, customized around a specific vendor population, its systems, and its existing TPRM and procurement workflows.

Starting with critical and high-spend vendors rather than the entire portfolio matters for the same reason it matters everywhere else in agentic risk deployment: the validate step needs a manageable, consequential sample to prove the agent's exception logic holds up against what an experienced vendor risk analyst would independently flag, before extending coverage to the long tail of lower-tier vendors where volume, not stakes, is the challenge.

Who Still Decides

Continuous monitoring inevitably raises the question of what happens when the system flags something serious — a bank-account change on a vendor about to be paid, a related-party connection nobody disclosed, a certificate that's been lapsed for months. The agent's role stops at detection, correlation, and evidence assembly. A named risk, procurement, or vendor-management owner still decides whether a payment is held, a relationship is escalated, or a reassessment is triggered — the same human-in-the-loop principle that runs through Crest.Digital's agentic AI work across the platform.

What changes is the volume and consistency of what gets checked. No vendor risk team, however well-resourced, re-verifies bank details, ownership records, and certificate status across an entire critical-vendor population every week — it isn't a staffing problem so much as a structural one, the same limitation Crest.Digital has covered on the audit side with agentic internal audit and on the transactional-controls side with continuous procure-to-pay monitoring. Continuous vendor and third-party assurance applies the same principle to the vendor record itself: an agent that checks continuously and flags what actually deserves a person's attention, rather than a person trying to check everything and inevitably checking most of it never.

That evidence trail matters as much as the detection itself. If an agent flags a vendor exception and a reviewer decides not to act on it, the reasoning behind both the flag and the decision needs to be reconstructable later — the same discipline addressed directly in why AI agents need audit trails and in the accountability question of who owns an agent's output inside a GRC workflow. And it extends the same argument Crest.Digital has made about vendor due diligence more broadly: a questionnaire response tells you what a vendor claimed, not what changed. Continuous vendor and third-party assurance is the mechanism that keeps watching for the second part, long after the questionnaire has been filed away.

Frequently Asked Questions