The continuing practice of confirming that the conditions under which a tool was authorized still hold.
Standing is a tool's most recent verdict, carried forward with the date it was set: Proceed, Caution, or Flag. A verdict is dated. Vendor language drifts, and a Proceed set today may not describe the tool six months on.
Review status is timing, not verdict. A tool can hold a Proceed standing and still fall overdue for review. An overdue Proceed is a stale read, not a safe one.
The journal records each review with the date it was performed, the standing set that cycle, and whether the vendor's language drifted since the last read. That dated history is the longitudinal record the firm's monitoring principle requires, not a notes field.
A material update is a vendor change to the governing documents. Recording one resets the clock at once, independent of cadence, and marks the tool for re-read: the read of record predates the change and no longer describes the current language. A logged review resolves the update and sets the new standing.