TPRM/TPCRM practitioner writing about evidence validation, scope, and assessment judgment.
Vendor Activity
+3
Nov 4, 2026
•
2 min read
Not every unanswered assessment question belongs to the vendor. Sometimes the customer is the authoritative source for whether a third-party relationship actually exists.
Questionnaire
Oct 28, 2026
A vendor may have AI across its product portfolio, but the assessment should start with the specific AI functionality actually being used in the relationship.
Validation
Oct 21, 2026
A current SOC 2 can show what the auditor observed, but not necessarily what your organization already knows about the vendor.
Oct 14, 2026
An active contract doesn’t tell you how much of the original vendor relationship is still operating. The current activity and data flow do.
Oct 7, 2026
A question may not fit the vendor’s environment, but that does not always mean the underlying control responsibility disappears.
Sep 30, 2026
A policy may establish what should happen. When operating evidence shows that it didn’t, the assessment has to go further.
Assessment History
Sep 23, 2026
An acquisition may change who owns the company without changing what the previous assessment actually covered.
Sep 16, 2026
A vendor extension request made me question why evidence-based assessments so often begin with another round of manual questionnaire work.
Data Flow
+2
Sep 9, 2026
No system connection doesn’t mean no data flow. Sometimes the path to the vendor runs through the people using the service.
Assessment Judgement
Sep 2, 2026
A different company name can be a clue, but the assessment still has to establish which entity owns the service and control environment.
+4
Sep 1, 2026
3 min read
I built a validator to see how much of the evidence review can be assisted while keeping the assessment decision with the assessor.
Aug 26, 2026
A completed questionnaire tells you what the third party says is true. Validation determines what you can actually stand behind.
Aug 19, 2026
A deployment label can tell you where software runs without telling you what the service can access, capture, store, or transmit.
Aug 12, 2026
Evidence quality matters. Evidence relevance matters more.
Revalidation
Aug 5, 2026
A prior assessment described a planned implementation. Revalidation showed the service had never actually been introduced.
