Third-party risk management in the public sector: why annual reviews aren’t enough
3 minute read
Melissa Underwood
August 17th, 2026
Ask any cyber, governance, or procurement lead in the public sector about supplier risk, and you’ll get the same answer. It’s not that they don’t understand it. It’s that keeping up with it, across growing supplier networks and fast-moving threats, is getting harder.
Together with Bitsight, we’ve put together a list of what we’re hearing, and why more organisations are moving towards continuous assurance instead of annual reviews.
Why isn’t a compliance checklist enough anymore?
Supplier assurance used to sit inside procurement. A questionnaire went out, evidence came back, and the supplier got approved. Job done.
That approach doesn’t hold up today. Suppliers change. Their technology changes. Their exposure to cyber threats changes too, especially as AI adoption speeds up across the supply chain.
Many organisations still rely on annual reviews or spreadsheets that go out of date within weeks. That’s not a failing on their part. It’s a resourcing problem, not a competence one.
Why are public sector teams under so much pressure right now?
Every team we speak to is stretched.
Cyber teams need to provide assurance across a growing list of suppliers. Governance and risk teams need proof that controls are actually working. Procurement teams want confidence in their decisions without holding up projects.
Budgets aren’t growing to match. Experienced cyber professionals are still hard to find and hard to keep. It’s a genuine balancing act, and most teams are doing their best within it.
What’s the real gap in most TPRM processes?
Visibility.
We often ask one simple question: how confident are you in your suppliers’ cyber posture today, not six months ago? It’s a question that tends to prompt a long pause.
Most teams know who their key suppliers are. What they lack is ongoing confidence that those suppliers are managing risk properly throughout the life of the contract, not just at onboarding.
That’s where point-in-time reviews start to fall short.
Is continuous assurance replacing annual reviews?
More organisations are moving that way, yes. Instead of relying only on questionnaires or annual check-ins, they want to know if supplier risk is changing over time, and where to focus attention now.
This isn’t about adding more work to already full plates. It’s about helping teams prioritise the suppliers that need attention, while trusting that others are performing as expected.
Does this mean buying another tool?
No. Good governance, clear processes and joined-up working across cyber, procurement and risk teams remain the foundation. Technology should sharpen the insight behind decisions, not replace the thinking.
That’s part of why we’re partnering with BitSight. They give our customers independent, ongoing cyber risk intelligence that sits alongside the governance and assurance work already in place. Rather than relying purely on historic assessments, organisations get a live view of supplier posture, helping them focus effort where it counts.
What does this mean for public sector organisations?
Third-party risk management is no longer just a compliance exercise. It’s becoming part of organisational resilience.
No organisation can eliminate supplier risk entirely. But most are looking for practical ways to see risk more clearly, reduce uncertainty and focus effort where it has the biggest impact.
That’s the direction TPRM is heading: not more process, but more confidence in the decisions being made every day.
FAQs
TPRM is the process of identifying, assessing and monitoring the risk that suppliers and third parties bring to an organisation, including cyber, operational and compliance risk.
Suppliers and their technology change constantly. An annual review only gives a snapshot, so risk can shift significantly in the months between assessments.
Continuous assurance means monitoring supplier cyber posture on an ongoing basis, rather than relying solely on periodic questionnaires or point-in-time reviews.
Not necessarily. Strong governance and process come first. Technology like Bitsight’s intelligence adds visibility to support the decisions teams are already making.
Phoenix works with public sector organisations to strengthen supplier assurance, combining governance expertise with continuous cyber risk intelligence through our Bitsight partnership.
About the author
Melissa Underwood, GRC Business Development Manager
Melissa joined Phoenix in 2021 to advise our customers on all aspects of cyber security, from technology and security solutions to services around governance, risk, and compliance.
She has experience working with some of the leading security suppliers on the market for challenges including identity security, SOC operations, and incident response and how these areas assist in the journey to reducing risk exposure and improving incident preparedness.