What is meant by 'continuous monitoring' in TPRM?

• A. A one-time risk assessment at onboarding.
• B. Monitoring only for contract renewals.
• C. Tracking vendor invoices for cost overrun.
• D. Ongoing collection and analysis of vendor risk indicators to detect changes in risk.

Answer: (D)

Continuous monitoring in TPRM means continuously collecting and analyzing a range of risk indicators related to a vendor and using that information to detect changes in risk over time. It goes beyond a single onboarding assessment or periodic checks; it provides a live view of the vendor’s risk posture so you can spot rising or falling risk early and take timely action. This includes tracking factors such as security posture, financial health, regulatory changes, performance metrics, incident reports, and other indicators that reflect overall risk, rather than focusing on just one aspect like cost.

That’s why this option is the best: it explicitly describes ongoing collection and analysis of vendor risk indicators to detect changes in risk, which is the essence of continuous monitoring. The other choices miss the ongoing, multi-faceted, dynamic nature of continuous monitoring—one-time onboarding assessments, renewals-only checks, or simply monitoring invoices for cost overruns don’t capture the continuous, broad view of risk over time.