Vendor due diligence in one afternoon

IF YOU READ NOTHING ELSE

Match the depth of checks to what the vendor touches.

Check existence, lists, owners, documents and payments, in that order.

Treat every bank-detail change as suspicious until called back.

One file per vendor, kept current until renewal.

Who this guide is for

This guide is for procurement, finance, legal and vendor-risk teams, and for founders who have to do these checks themselves. It sets out a practical order of work for checking a new supplier: confirm the company is real, screen it and its people, understand who owns it, review the documents that matter and protect payments. It also covers keeping files current and reporting to management. The aim is a consistent file you can show an auditor or a customer in minutes, built in an afternoon for most vendors.

Start with risk, not paperwork

Not every vendor needs the same depth. A stationery supplier and a payroll processor carry very different risks. Rate each vendor by what it touches: your money, your customers' data, your systems, your reputation, or your regulatory obligations. The higher the rating, the deeper the check.

Step 1: Is the company real and in good standing?

Check the company register for its legal name, registration number, status and registered address. Compare with what the vendor told you. Check its website and domain: how old it is, whether the name matches, and whether contact details are consistent.

Step 2: Lists and integrity

Screen the company and its key people against sanctions, exclusion and debarment lists, and look for adverse media. If you work with government funds or in healthcare, exclusion checks are especially important.

Step 3: Who owns it?

For important vendors, find out who owns and controls the company. Screen the owners too. Where public records stop, ask the vendor.

Step 4: The documents

Security: a SOC 2 report or ISO 27001 certificate. Check the period, the scope and any exceptions.

Data protection: a data-processing agreement covering instructions, security, subprocessors, breach notice, audit and deletion.

Insurance: certificates with limits and expiry dates that meet your requirements.

Contract: renewal, liability, termination and price-change terms.

Step 5: Payments

Verify bank details when you set the vendor up, and treat any later change request as suspicious until confirmed by a call to a number you already hold. Payment-change fraud is one of the most common and costly attacks on accounts payable.

Step 6: Keep it current

Watch important vendors for list changes, diarise document expiry dates, and repeat the review at renewal. Keep everything in one file per vendor so you can show it when asked.

A worked example

A finance team onboards a new payroll provider. It confirms the company is registered and active, screens it and its directors, and maps its owners as far as public records go. It reads the provider's security report and notes one exception on access reviews, reviews the DPA and finds the breach-notice period missing, checks the insurance certificate expires in two months, and sets the bank details with a call-back. The ranked to-do list for the vendor has three items: explain the access-review exception, add a breach-notice period, send the renewed certificate. Everything is in one file.

Common mistakes

Same checks for every vendor regardless of risk.

Accepting a security report without reading the exceptions.

Not diarising document expiry dates.

Changing bank details on an email request.

Evidence scattered across inboxes.

Checklist

Rate the vendor's risk first.

Existence, lists, owners, documents, payments.

One ranked list of follow-ups.

One file per vendor.

Monitor until renewal.

A deeper look: risk tiers for vendors

A simple three-tier model works for most teams. Tier 1 vendors touch money, customer data or critical systems: full checks, documents and monitoring. Tier 2 vendors matter but with limited access: lists, registry and key documents. Tier 3 vendors are low-risk suppliers: lists and registry only.

Write the tiers down, assign each vendor at onboarding, and revisit the tier when the relationship changes, for example when a supplier gets access to customer data.

A deeper look: reading a security report

When a vendor sends a SOC 2 report, check the type (Type I or Type II), the period covered and its end date, the systems in scope, the auditor's opinion, and the list of exceptions. Look at the complementary user entity controls: things you are expected to do for the controls to work. An old report, a narrow scope or unexplained exceptions are reasons to ask questions.

Questions people ask

What if a vendor will not share documents? Decide whether the relationship is still acceptable, record the decision and any compensating controls.

How often should we re-check vendors? Tier 1 continuously for lists and yearly for documents; lower tiers less often.

Who signs off? Name an owner for each vendor relationship and an approver for exceptions.

Do small vendors really need a file? Yes, but a short one. A registry check, a list screen and a verified bank account take minutes and protect you from the most common problems: fake suppliers, listed parties and payment fraud.

Reporting to management

Keep a simple summary: number of vendors by tier, how many have current documents, open follow-ups, and any vendors with findings. It shows the programme is working and where attention is needed.

A one-page vendor file template

Every vendor file can follow the same shape, which makes reviews faster:

Vendor: legal name, registration number, address, website, owner of the relationship, risk tier.

Checks: registry status, list results with dates, adverse media summary, ownership summary.

Documents: security report (type, period, opinion, exceptions), data-processing agreement status, insurance certificate expiry, contract renewal and notice dates.

Payments: bank details verified on, verified by, call-back number used.

Findings: a ranked list of what needs follow-up, with owner and due date.

Decision: approved, approved with conditions or declined, with reason, approver and date.

Next review: date and trigger events, such as an ownership change or a renewal.

Keep the template the same for every vendor, even small ones; just fill fewer sections for low-risk tiers. Consistency is what lets someone else pick up a file and understand it in minutes.

Key terms

Vendor due diligence: Checks on a supplier before contracting and during the relationship.

Third-party risk: Risk that comes from vendors, suppliers, partners and other outside parties.

Due diligence questionnaire: A set of questions sent to a vendor or customer to gather information for a risk assessment. Often called a DDQ.

Beneficial owner: The real person who ultimately owns or controls a company, however many companies sit in between. Often abbreviated to UBO.

Payment fraud: Tricking someone into making or redirecting a payment, for example with a fake request to change bank details.

SOC 2: An independent auditor's report on a service organisation's security and related controls.

Summary

Vendor due diligence works best when its depth matches the risk. Tier your vendors by what they touch, then check that each one exists and is in good standing, screen it and its key people, map its owners, and review the documents that matter for its tier: security report, data-processing agreement, insurance and contract. Treat every request to change bank details as suspicious until you have called back on a number you already hold. Keep everything in one file per vendor with a ranked list of follow-ups, an owner, a decision and a review date. Monitor important vendors until renewal and refresh documents on schedule. A consistent file for every vendor, however small, is what lets you answer an auditor, a customer or your own board in minutes rather than weeks.

REPORTS THAT HELP