The Neighborhood Watch: Using Continuous Monitoring to Increase Visibility and Effectiveness of TPRM programs

Jon Ehret, VP of strategy and risk at RiskRecon and a third-party risk practitioner since 2004, argues that continuous monitoring is the missing tool that turns a questionnaire-only vendor program into a mature one. He frames third-party risk as a tug-of-war between a business that keeps adding vendors and understaffed risk teams (a median of two people running around 249 reviews a year), and shows survey data that only 30% of practitioners trust questionnaire responses to reflect real control effectiveness. His central metaphor is the scalpel versus the Swiss Army knife: questionnaires alone are one sharp tool, but maturity comes from combining inherent-risk rating, evidence, pen-test data, a GRC platform, onsite assessments and continuous monitoring. Comparing continuous monitoring to a neighbourhood watch that looks in from the outside, he walks through use cases (triaging a portfolio, planning and validating assessments, detecting incidents between review cycles, and driving vendor remediation) with case studies from a pharmaceutical company, a retailer and an energy company. He stresses inherent-risk rating by data and record volume as the bedrock of any program.