Which of the following is the PRIMARY reason to perform periodic vendor risk assessments?

While vendor risk might inform risk appetite, it's not the primary reason for periodic assessments; the focus is on assessing the vendor's actual risk posture, not setting internal appetite.

Periodic vendor risk assessments primarily aim to monitor the ongoing effectiveness of the vendor's security and operational controls because a vendor's control failures can directly expose the engaging organization to significant risks, such as data breaches or service disruptions. This continuous monitoring ensures that the vendor maintains the agreed-upon security posture over time, adapting to new threats and changes.

Verifying a vendor's financial viability is a component of due diligence and contract management, but it's not the primary focus of a risk assessment which centers on operational and security controls.

Assessing a vendor's risk mitigation plans is part of the initial assessment, but periodic assessments are more about verifying the implementation and effectiveness of those plans rather than just their existence.