The annual review that cannot be rubber-stamped

Each vendor is reviewed on its cycle with a six-item checklist: access still accurate, BAA current with the required terms, security evidence current, subcontractors bound, no incidents, a named owner.

Try passing every item for Northgate Revenue Partners. The register refuses: its own records show a stale SOC 2 report and a subcontractor with no flow-down terms, and a reviewer cannot attest to something the record contradicts. An approval with a failed item is also refused; it has to be "approved with conditions" or "escalated", with a note.

The next review date is set from the tier and the outcome, not chosen by the reviewer. Every completed review is a permanent record of who reviewed what and when.

Conditions do not get lost in the notes. A review approved with conditions, or escalated, stays an open follow-up on the dashboard, on the vendor page and on the review schedule until a later review approves outright (Cobalt Lab Link shows one closed that way).