Annual Vendor Review

An annual vendor review is a yearly check of your important vendors to confirm they are still needed, still correctly rated for risk and still meet your requirements, using their latest security reports and legal documents.

What is an annual vendor review?

An annual vendor review is a scheduled check, once a year, of your important vendors. You confirm each one is still needed, still has the right tier and owner, and still meets your requirements. For the riskiest vendors, it is a repeat of the original vendor risk assessment with fresh documents.

It is a common control in a SOC 2 program. The SOC 2 criterion CC9.2 says "The entity assesses and manages risks associated with vendors and business partners", and its points of focus include assessing vendor performance. The criteria do not say "annual". Companies pick a schedule and write it into their policy, and the auditor then tests whether they kept it. A common choice is a full review of top-tier vendors every year and whenever their terms change in a way that matters.

Why it matters to you

Once a year is a minimum, not a plan for catching changes. A vendor can change its Terms of Service, DPA, subprocessors or pricing at any point in the year. If the change lands the month after your review, your file is wrong for eleven months.

Some changes come with deadlines you can miss in that gap: a window to object to a new subprocessor, or a notice period before an auto-renewal. Venpo caught that Snyk dropped its 5% renewal cap and added an AI training exception. The cap went in an August 2026 update and the AI exception in a September one, so a review done in July would still show the old price cap and an AI training promise with no exception.

NIST's Cybersecurity Framework expects supplier risks to be "monitored over the course of the relationship". That is why the review works best paired with continuous vendor monitoring.

What to check

A current SOC 2 report or bridge letter for each top-tier vendor.
The current DPA, Terms of Service and subprocessor list, compared with the versions you saved last year.
Whether the vendor's AI, data retention or pricing terms changed.
Whether the tier, owner and data in your vendor inventory are still right.
Whether you still use the tool. If not, start offboarding.
A dated record of who did the review and what they decided.

How Venpo helps

Venpo fills the gap between reviews. It emails you a plain-English alert when a vendor's terms, privacy policy, DPA or subprocessor list change, and keeps a change history per vendor, so your annual review starts with a list of what moved instead of a blank comparison.

Start for free

Frequently asked questions

Does SOC 2 require an annual vendor review?

The SOC 2 criteria do not name a frequency. Many companies set an annual review in their own policy, and once it is written there, the auditor tests that you followed it.

Do all vendors need an annual review?

No. A common model is an in-depth yearly review for top-tier vendors and only a tier check for low-risk ones, as long as your policy says so.

Related terms

Vendor Management Continuous Vendor Monitoring Continuous vendor monitoring means watching your vendors between formal reviews, so you learn about changed terms, new subprocessors, security problems or business trouble when they happen instead of at the next annual review. Vendor Management Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes. Vendor Management Vendor Tiering Vendor tiering is sorting your vendors into groups by how much risk they bring, based on the data they hold and how much you depend on them, so you review the riskiest ones more deeply and more often. Vendor Management Vendor Management Policy A vendor management policy is your company's own written rules for choosing, checking, watching and leaving vendors. It tells your team what to do and shows auditors and customers what you committed to. Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Security and Compliance Bridge Letter A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it.

Sources

Last reviewed October 30, 2026