Third-party risk assessment is an ongoing process and requires continuous monitoring and reassessment. It is not sufficient to only conduct a preliminary due diligence review at the start of the relationship; vendors must be monitored and reassessed periodically to ensure ongoing compliance and to identify any new risks that may arise.