I was reviewing a vendor relationship that was still active, but the business activity looked very different from what it had been before.
The vendor had historically supported a broader scope. By the time I was looking at it, much of that activity had decreased, and the business description made it sound like very little of the original service was still happening.
That raised a basic question: did the vendor still need to be assessed?
I didn’t want the active contract to answer that question for me. A contract can stay in place even after the relationship changes. But I also didn’t want to make the opposite assumption and treat reduced activity as if there were nothing left to assess.
So I started with the part that was bothering me: the idea that the relationship had effectively gone dormant.
I checked internally whether the reduced activity, by itself, changed the assessment decision.
It didn’t.
That meant I still needed to understand what was actually happening now instead of relying on how the relationship was being described.
When I looked further, the vendor still had company data, and data was still being sent to the vendor through SFTP.
That gave me something much more concrete to work with.
The vendor was no longer doing everything it had done before, but the relationship hadn’t disappeared.
They still had data. Data was still moving to them.
For me, that led to two different conclusions.
First, the vendor still needed to be assessed.
Second, I couldn’t simply reuse the broader historical scope. If the relationship had changed, the assessment needed to reflect what was still happening now.
Reduced scope and no assessment are not the same conclusion.
That matters with long-running vendor relationships because the information around them can get messy.
The contract may still be active. Older records may describe services that are no longer being performed. The current business description may make the relationship sound almost dormant.
None of those tells me enough on its own.
What mattered here was what was still happening.
The vendor still had data. Data was still being sent to them. That was enough for me to know there was still a relationship to assess, even though the original scope no longer matched reality.
Cases like this also make me question how vendor relationships are tracked over time.
A vendor record may tell me very clearly that the contract is active while telling me much less about what the vendor is still doing today.
Is the original service still operating?
Has the scope been reduced?
Is only one small part of the relationship left?
If that information isn’t kept current, the assessor has to piece it together later from business answers, old records, data flows, and whatever else is available.
The contract is useful context, but it isn’t the scope.
The historical relationship isn’t the scope either.
The scope has to come from what is actually happening now.
When a vendor’s original activity has mostly fallen away, what do you verify before deciding whether the assessment should fall away with it?