DDQ season is now year-round
In 2025 the DDQ volume showed a clear seasonal peak — Q4 renewal cycles, January onboarding. A year later the seasonality has flattened. What changed and what it means for capacity planning.
A year ago, DDQ volume across the platform showed a clean seasonal curve. Q4 was the peak — renewal cycles concentrated DDQs into October, November, and early December. January was a secondary peak as new-fiscal-year buyers onboarded new vendors. July and August were the trough, almost no volume.
The 2026 cut is different. The curve flattened. Peak-month volume is only about 1.4x trough-month volume, down from 2.8x in 2025. DDQ season is now year-round.
What the data looks like
Normalized DDQ volume across the platform, monthly index where 100 = the annual mean:
| Month | 2025 | 2026 |
|---|---|---|
| January | 128 | 112 |
| February | 104 | 107 |
| March | 88 | 98 |
| April | 71 | 92 |
| May | 64 | 89 |
| June | 58 | 86 |
| July | 46 | 84 |
| August | 54 | 93 |
| September | 96 | 104 |
| October | 142 | 116 |
| November | 168 | 123 |
| December | 118 | 98 |
The 2025 low-months (June/July) have risen substantially. The 2025 peak-months (October/November) have softened but are still the highest. The shape is a gentle curve instead of a seasonal spike.
What changed
Three factors, in order of visible effect.
Vendor risk programs decoupled from renewal cycles. In 2025, many buyers ran DDQs as part of annual renewal. Now, mid-size and enterprise buyers run continuous vendor risk monitoring — a DDQ can trigger any time a subprocessor is added, a regulatory scope shifts, or a compliance framework updates. Volume smooths across the calendar.
AI governance review cycles run on their own clock. The AI-governance questions noted in the vendor risk patterns post — now in about 40% of DDQs — often arrive as out-of-cycle addenda, four times a year instead of once.
Mid-market buyers now run formal vendor risk programs. In 2025 this was largely an enterprise practice. By 2026, many mid-market buyers have adopted formal vendor risk tooling (OneTrust, Whistic), and the first thing that tooling does is send DDQs to the existing vendor base — distributed across all months as buyers onboard the tooling.
What it means for capacity planning
Three practical changes:
Staff for the median, not the peak. The 2025 plan — contractors or overtime for October/November — overstaffs the rest of the year. A team sized for the 112-index August is closer to right than one sized for a 140-index October.
Plan for an evergreen queue depth. In 2025 the queue emptied in summer. In 2026 it doesn’t. DDQ tooling, KB hygiene, and SME scheduling all assume a non-zero steady-state backlog.
Shorten the “we’ll get to it” tolerance. An August 2026 DDQ is competing with ten others and needs the full DDQ playbook process from intake.
The Q4 peak hasn’t gone away
The November peak is still the peak — just smaller relative to the rest of the year. A Q4 readiness plan still matters (see Q4 DDQ surge preview), but it’s “run our normal process at higher throughput” instead of “mobilize a war-room only in October.”
The takeaway
DDQ volume is now a flat curve, not a spike. Staff accordingly. The old seasonal playbook was written for a world that no longer exists.