Strategy
From point-in-time to point-of-change
How third-party risk moves from annual reviews to change-driven checks.
Read article ↗The form looks cheap
A security questionnaire is easy to budget for. Send a spreadsheet, wait, file the answers. The visible cost is a few hours of a vendor’s time and a few of yours.
The real cost arrives later, and it isn’t on anyone’s budget line. It shows up when an answer from last spring is quoted in an incident review, when a reviewer spends a morning on questions that never applied, or when a renewal is approved because the form was “complete.”
Where the cost hides
- Answers drift from reality.A questionnaire records what was true — or believed — on the day it was filled in. Vendors change hosting, add subprocessors and rotate staff all year. The form doesn’t.
- Claims arrive without proof.“Yes, MFA is enforced” reads the same whether it was tested yesterday or assumed by someone in sales. Without evidence attached, every answer carries equal, unearned weight.
- Reviewers read what doesn’t apply.A generic form asks a payroll provider and a marketing plug-in the same questions. Most of a reviewer’s time goes to confirming irrelevance.
- Completion is mistaken for assurance.A finished form is easy to report. It says nothing about whether the risk changed — which is the thing leadership actually asked about.
A complete questionnaire tells you the vendor answered. It doesn’t tell you the answer is still true.
What to ask instead
The fix isn’t a longer form. It’s fewer questions, tied to what the vendor actually touches, with each answer labelled by how it’s known.
- Ask about the connection, not the company.What data does this vendor reach, through which identity, from where? Start from the access path and the relevant questions follow.
- Ask for evidence, not assertions.A configuration export, a current certificate, a log sample. Where evidence isn’t available, record the answer as a claim — not as a fact.
- Mark what’s known, assumed and unknown.Unknowns aren’t failures. Hiding them is. A short list of named unknowns is more useful than a long list of unverified yeses.
- Re-ask when something changes.A new integration, a breach notice, a change of hosting region. Tie review to change instead of to the calendar.
Side by side
| Static questionnaire | Change-driven review | |
|---|---|---|
| Trigger | Calendar date | A change in access, data or vendor |
| Scope | Same form for every vendor | Questions that fit the connection |
| Answers | Self-reported | Labelled observed, claimed or unknown |
| Output | A completed file | Named risks with owners |
Where to start
Pick one vendor whose access you’d struggle to explain in a sentence. Write down what it connects to, how, and with whose credentials. Then mark each statement as something you’ve seen, something you were told or something you don’t know.
That short description is already a better starting point than last year’s form — and it’s exactly the kind of input a review should begin with.