Field guide
Give supplier evidence a next review date
Keep evidence useful after onboarding with dated decisions, change triggers and a clear handover.
Create the next action at approval
An onboarding review ends with a decision made on a particular date. Record who owns that decision after the purchase, where the evidence is stored and when it will be reviewed. Set the interval to suit the service and the organisation's own risk process. This guide does not prescribe a universal review interval.
Add events that bring the review forward
List the changes that affect the reasons for approval: a different supplier entity, a new hosting location, added administrator access, a change in the data processed, an incident or a changed certificate status. Agree how the service owner will learn about those events. A calendar reminder does not replace a process for material change.
Compare changes, not just documents
At review time, compare the current service with the service that was approved. Record what changed and which earlier conclusions depend on it. Request replacement evidence for affected claims. An updated cover date does not answer whether the underlying service boundary or operating process has changed.
Keep the original decision readable
Fictional example: a team approved a support service with access limited to a test environment. A later contract adds production administration. The owner opens a new evidence review for that access, links it to the original decision and records the approval conditions. The old decision remains available with its original boundary instead of being overwritten as if it had always covered production.
Make overdue items visible
Use a short review queue containing service, owner, last decision date, next review date, trigger and open action. Escalate an overdue item through the organisation's agreed process. Preserve the distinction between evidence not yet reviewed and evidence found insufficient. The queue should tell a covering colleague what to do next without exposing the confidential evidence itself.
Sources and method
Primary references checked 4 November 2026. The workflow and fictional examples are original editorial guidance; they are not a quoted standard or an endorsement.