Vendor Due Diligence: Practical Checklist

Vendor due diligence is a structured review of a supplier’s financial, legal, operational, and security health before you sign a contract, and this article gives you a practical, field-tested checklist to run one efficiently. You’ll learn what to ask for, how to verify the answers, and where most buyers get tripped up—so you can avoid costly surprises after the deal is done.

Why Vendor Due Diligence Matters

Every time you hand a vendor money, data, or access to your systems, you take on their risk. A supplier that seems cheap can become expensive if they go bankrupt, lose your data, or fail to deliver. Due diligence is not about distrust—it’s about understanding the true cost and risk of the relationship before you commit. For critical vendors (those whose failure would halt your operations), the review should be proportional: a small office-supply vendor needs far less scrutiny than a cloud infrastructure provider.

What to Review: The Core Areas

A practical checklist covers five domains. You don’t need to go deep on every one for every supplier—prioritize based on the vendor’s role and the sensitivity of what they handle.

• Financial health: Review audited financial statements (last 2–3 years), credit reports, and signs of distress like late tax payments or a declining cash position.
• Legal & compliance: Check for litigation, regulatory sanctions, licenses, and certifications relevant to their industry (e.g., ISO standards, GDPR compliance).
• Information security: Ask for SOC 2 reports, penetration test results, data handling policies, and incident response plans.
• Operational capability: Verify they can actually deliver the volume and quality you need—check their capacity, staffing, and sub-contractor arrangements.
• Business continuity: Ask for disaster recovery plans, backup frequency, and tested recovery time objectives (RTOs).

The Practical Checklist: Step-by-Step

Work through this list systematically. Document everything—you’ll need it for your own audit trail and for comparing vendors.

1. Define the scope: List what the vendor will handle (data, money, physical assets, critical processes). This determines which areas deserve deep review.
2. Send a structured questionnaire: Use a standardized vendor assessment form. This makes responses comparable across vendors.
3. Request documents: Ask for financials, insurance certificates, security attestations, and compliance certifications. Set a deadline.
4. Review the documents: Look for red flags like qualified audit opinions, gaps in insurance coverage, or expired certifications.
5. Conduct a security review: For IT vendors, review their security policies, encryption practices, and access controls. If you lack expertise, involve your IT or security team.
6. Check references: Contact 2–3 current or past clients, ideally ones with a similar use case to yours. Ask about responsiveness, issue resolution, and hidden costs.
7. Visit the site (if critical): For high-risk vendors, a site visit can reveal more than documents—observe their operations and ask about their culture.
8. Document findings and risks: Create a risk register listing identified issues, their likelihood, and impact. Decide what’s acceptable and what’s a deal-breaker.
9. Define mitigation: For acceptable risks, plan mitigation steps—e.g., requiring the vendor to carry specific insurance, or adding contract clauses for data breach notification.

Common Problems and Mistakes

Even experienced buyers make these errors:

• Treating it as a one-time event: Vendor risk changes. A financially stable vendor can deteriorate. Re-assess critical vendors annually or when you renew a contract.
• Over-relying on certifications: A SOC 2 report is a snapshot, not a guarantee. Check the date and scope—some reports exclude key systems.
• Ignoring sub-contractors: Your vendor may outsource work to third parties you never vetted. Ask who their sub-contractors are and what their own due diligence looks like.
• Skipping the exit plan: If the vendor fails, how will you get your data back? Ensure the contract includes data return and transition assistance clauses.
• Not aligning with the contract: The due diligence findings should feed directly into the contract terms—e.g., requiring the vendor to maintain insurance levels you verified.

How to Choose What to Review (Risk-Based Approach)

Not all vendors are equal. Use a simple scoring system: rate each vendor on (1) how critical they are to your operations, (2) how much sensitive data they handle, and (3) how much money is at stake. High scores warrant full due diligence; low scores can be handled with a lighter questionnaire. For example, a marketing agency that only sends newsletters may need a basic financial check, while a payment processor requires deep security and financial review.

Costs and Time Involved

The cost of due diligence varies widely. Internal effort can range from a few hours for a low-risk vendor to several weeks for a critical, complex one. External help—like a consultant or a specialized due diligence firm—can cost thousands, but may be justified for major contracts. The real cost of skipping it is usually higher: contract termination, data breach remediation, or business disruption. Budget time for the vendor to respond (often 1–2 weeks) and for your team to review (another week or more).

Alternatives and When to Skip

For very low-risk vendors (e.g., buying office furniture), a simple background check and a credit report may suffice. For high-risk vendors, consider a phased approach: start with a questionnaire, then escalate to document review and site visit only if needed. There is also the option of using third-party risk management platforms that automate parts of the process—they can help but don’t replace human judgment. If a vendor refuses to provide basic information or is evasive, treat that as a red flag—consider it a deal-breaker unless you have a strong reason to proceed.

Frequently Asked Questions

What is the difference between vendor due diligence and vendor risk assessment?
They are often used interchangeably, but due diligence is the initial investigation before signing a contract, while risk assessment is an ongoing process that monitors the vendor’s performance and risk posture throughout the relationship.

How often should I re-run due diligence on existing vendors?
For critical vendors, annually is a good baseline. For others, at least every two years or whenever there is a major change—like a merger, a data breach, or a significant change in their financials.

What if a vendor refuses to share financial statements?
For private companies, this is common. You can ask for a credit report, bank references, or a letter from their accountant. If they still refuse, weigh the risk—it may be acceptable for a low-risk vendor, but for a critical one, it’s a warning sign.

Can I rely on a vendor’s SOC 2 report?
Yes, but check the report’s date, scope, and whether it’s a Type I (point-in-time) or Type II (over a period) report. Also, ensure the report covers the specific services you’re using. If the report is old, ask for the latest one.

How do I handle a vendor that has had a data breach?
Don’t automatically disqualify them. Ask for details: what happened, what was affected, how they responded, and what they’ve changed since. If they are transparent and have improved controls, they might still be acceptable—but you’ll want to include strong breach notification and liability clauses in the contract.

Should I do due diligence on open-source or free tools?
Yes, but differently. For open-source software, review the license, the project’s activity, and the community’s security practices. For free tools, check the vendor’s privacy policy and data handling—free often means your data is the product.

Related

• Slack Tips and Tricks for Beginners
• Hardware Support Services: What They Cover
• Unlock All Three Moonlight Peaks Forms