Cadence belongs on the risk register, not only in a quote
A sweep is point-in-time assurance: it tells you the room was clean on the day. The period between inspections is the residual exposure your risk register already accepts when the control is scored. Setting cadence is therefore the same decision as setting residual risk — how long are you willing to let a successful placement run before the next verification — and it should be written next to the owner, likelihood and treatment.
That framing is what makes the schedule board-ready. Audit and risk committees do not need a product tier; they need a documented exposure window, a named owner, and evidence that verification ran on time. Re-inspection after a find or suspicion converts an unbounded window into a bounded one, which changes damage assessment and, where personal data is involved, notification analysis.
Tiering that survives budgets and committee scrutiny
Tier one — the board room, the deal room, and executive offices facing live competitive, litigation or state-linked threat — commonly runs quarterly, with pre-meeting checks before the most sensitive sessions. Tier two — sensitive but lower-tempo spaces such as legal and HR rooms — commonly runs semi-annually. Tier three spaces are covered by trigger events only. Align tiers to principal-risk locations and information classes already on the register, not to floor plates.
Event-driven inspections do disproportionate work in every tier: before board and results meetings, during M&A activity, after renovations or office moves, and after contentious departures. An organisation that can afford only a small programme should buy trigger-event coverage of tier one before it buys calendar coverage of anything else — and should say so explicitly in the register treatment.
Reporting the rhythm to the board
Write the tiering and its rationale into the TSCM policy, mirror the agreed cadence in the risk register entry, and put a standing line in the committee pack: coverage this period, exceptions, and days since last inspection of tier-one spaces. Revisit annually against the threat picture — new litigation, competitors, jurisdictions, premises — so the board can confirm the exposure window still matches appetite.
For a plain-language explainer of typical market frequencies (quarterly, semi-annual, event-driven) outside the risk-register framing, see the TSCM Partners article linked below. Keep this page for programme design and board evidence; use that article when someone only needs the general "how often" answer.