Procurement Supplier Sanctions Screening Refresh Lag

A supplier was screened when first onboarded, but the relevant sanctions data has changed since then. Procurement supplier sanctions screening refresh lag measures how long an in-scope record waits for rescreening after a defined trigger.

This is an operational risk measure, not a single global legal timetable, so determine applicable jurisdictions, counterpart type, transactions and screening duties with qualified compliance owners, bearing in mind that the U.S. and UK source examples used here are not universal obligations in every country. Define refresh triggers as a list update, supplier ownership change, new country exposure, contract renewal or a scheduled periodic review, since a generic last-screened date can conceal why a refresh became due.

Use the current authoritative data source required for that jurisdiction: OFAC offers a sanctions-list service for U.S. lists, while the UK changed its source for designations in 2026. The UK government says its UK Sanctions List became the only source for UK designations from January 28, 2026, replacing the former OFSI consolidated list, and stale source selection can make a refresh meaningless.

Capture legal entity names, registration identifiers, known aliases and relevant owners under the approved policy, because screening only a trading name may miss a distinct entity. Do not treat a fuzzy name match as proof the supplier is sanctioned; route potential matches for qualified review using identifiers and context.

Conversely, a no-match status may reflect poor data, an outdated list or a technical failure, so keep the source version, query time and system health in the evidence. Define when the lag starts (list publication, internal feed receipt or a supplier change confirmed by a trusted record), and state the choice and its limitations.

Define when it ends as successful screening with disposition of potential matches, not merely a queued batch job, because a failed sync should leave the supplier open. If one list update affects thousands of suppliers, record each in-scope entity and the overall batch completion, since an average can hide a single critical vendor.

Prioritise upcoming payments and shipments under the legal and risk policy, because a supplier with no planned activity can have a different operational urgency from one being paid today, and keep purchase orders, receipts and payment controls aligned so a procurement green status does not quietly override a pending sanctions investigation. When the vendor has several legal entities or sites, screen those within the applicable policy, as a parent company screening may not substitute for an operating subsidiary.

If ownership data is missing, mark the review incomplete rather than silently assuming no relevant owners, while respecting privacy and local requirements, and for a genuine match follow legal advice and prescribed restrictions, since this glossary metric does not decide whether to freeze, block or disclose anything. If a prior match is cleared, retain the reviewer, rationale and evidence, so repeated false positives can be handled efficiently without deleting their history, and keep the source timestamp and change history when a list provider revises records or delists an entity, so a prior decision can be reconstructed.

Define the denominator as supplier-trigger events requiring a refresh, or active suppliers due by the reporting cut-off, without counting duplicate system notices as independent events. Show overdue high-risk entities and the oldest unresolved potential match separately from overall lag, check feed failures and rule changes because a dashboard showing yesterday as the last update may be falsely reassuring, audit selected cases against source-list version, supplier identity, screening result and reviewer disposition since a checkbox labelled screened is not enough, and use the measure to shorten unreviewed exposure and maintain an honest audit trail, not to generate automatic accusations from approximate name matches.