Vendor Due Diligence

In 2018, Atrium Health had data on 2.65 million patients exposed through a breach at its billing vendor. In 2020, the SolarWinds attack compromised thousands of organisations through a single supplier’s software update. These are the visible consequences of inadequate vendor due diligence. The invisible ones, the regulatory penalties, commercial losses, and reputational damage that accumulate from working with financially unstable, ethically compromised, or operationally unreliable suppliers, are far more common and equally avoidable.

Vendor due diligence is the structured process of investigating and assessing a potential or existing supplier before committing to, renewing, or expanding a commercial relationship. It is not a procurement formality. It is a risk management discipline that determines which suppliers are safe to work with, on what terms, and with what ongoing monitoring. This guide covers the full process, the key risk categories, what to do when problems are found, and how to build vendor due diligence into the procurement lifecycle rather than treating it as a one-off pre-contract exercise.

---

Key Takeaways

60% Of organisations experienced a third-party data breach or cybersecurity incident in 2023 according to Ponemon Institute research, making vendor risk one of the most material categories of operational risk that most organisations face

5 categories Financial health, operational capability, compliance and regulatory standing, information security, and ESG (environmental, social, governance). A thorough vendor due diligence assessment covers all five for high-risk or high-value relationships

Proportionate Due diligence must be proportionate to the risk and value of the relationship. A critical sole-source supplier handling personal data warrants a full five-category assessment. A low-value commodity supplier does not. Applying the same process to all vendors is inefficient and misses the point.

Ongoing Due diligence conducted once at contract award and never repeated is not risk management. It is historical documentation. Vendor risk must be monitored continuously for changes in financial health, ownership, compliance standing, and operational performance

• Vendor due diligence is the investigation of a third party before entering or renewing a commercial relationship, to identify risks that could affect the organisation’s financial position, operations, reputation, or regulatory compliance.
• The scope and depth of due diligence should be proportionate to the criticality of the supplier (what happens if they fail?) and the risk category of the relationship (does it involve personal data, regulatory obligations, safety-critical operations?).
• Red flags discovered during due diligence do not automatically mean a supplier cannot be used. They require a risk-based decision: can the risk be mitigated through contract terms, enhanced monitoring, or supplier remediation? Or does the risk level make the relationship untenable?
• Modern vendor due diligence extends beyond the immediate supplier to include material sub-contractors and critical Tier 2 suppliers, where many of the most significant risks in complex supply chains actually originate.

---

Step 1: Vendor Risk Segmentation

Before conducting any due diligence, segment your vendor base by risk level. This determines the depth of assessment each supplier requires and prevents both under-investigation of high-risk suppliers and over-investment in assessing low-risk ones.

Risk Tier	Characteristics	Due Diligence Approach
Tier 1: Critical	Access to personal data, safety-critical services, sole-source dependency, high spend, or regulatory obligation tied to the relationship	Full five-category assessment, site visits where feasible, third-party certification review, annual re-assessment
Tier 2: Significant	Meaningful spend, some data access, or operational dependency without the critical characteristics of Tier 1	Financial health, compliance, and information security assessment; self-assessment questionnaire; bi-annual review
Tier 3: Standard	Low spend, easily replaceable, no data access, no regulatory or safety implications	Basic trade reference checks, company registration verification; light-touch monitoring

This segmentation connects directly to the Kraljic matrix covered in our article on what is strategic procurement and how does it differ from purchasing. Strategic and bottleneck suppliers from the Kraljic analysis almost always map to Tier 1 or Tier 2 risk tiers, which drives both the depth of due diligence and the intensity of ongoing monitoring required.

---

---

The Five Due Diligence Assessment Categories

Category 1: Financial Health

Supplier insolvency is one of the most common and most disruptive third-party risk events. A financially distressed supplier will cut corners on quality, reduce service levels to preserve cash, be unable to invest in capacity or capability, and ultimately fail at a moment of maximum inconvenience. Early warning signals include: deteriorating credit ratings, late filing of statutory accounts, payment delays to their own suppliers, unusual management changes, or pricing that is significantly below market (often a signal of financial desperation or quality compromise).

For Tier 1 suppliers, financial assessment should include: review of audited financial statements for the past three years, current credit agency ratings, Companies House or equivalent registry checks for directorships and filing compliance, and periodic monitoring of news and trade publications for financial distress signals. For publicly listed suppliers, analyst reports and stock performance provide additional early warning indicators.

Category 2: Operational Capability

Can the supplier actually deliver what they are proposing to deliver, at the scale and quality required, consistently over the contract term? Operational due diligence assesses: production or service capacity versus committed volume, quality management systems and certifications (ISO 9001, sector-specific standards), track record with comparable clients, key personnel and their stability, and business continuity and disaster recovery arrangements.

Reference checks with existing clients are one of the most valuable and most underused due diligence tools. Speaking directly with the supplier’s existing clients about actual delivery experience provides insights that no documentation or supplier-provided case study can replicate.

Category 3: Compliance and Regulatory Standing

Regulatory compliance due diligence checks whether the supplier has the licences, registrations, and certifications required to operate legally in the relevant jurisdiction and sector, whether they have a clean regulatory enforcement record, and whether they are subject to sanctions, debarment, or legal proceedings that could affect their ability to perform or the organisation’s ability to be associated with them.

Key checks include: sanctions screening against relevant lists (OFAC, EU, UK HM Treasury), politically exposed persons (PEP) checks for ownership and management, anti-bribery and corruption history, sector-specific regulatory standing (financial services authorisation, healthcare registration, food safety certification), and Modern Slavery Act compliance documentation for UK-regulated organisations.

The compliance dimension of vendor due diligence sits squarely within the GRC framework covered in our article on GRC explained: governance, risk, and compliance for modern organisations. Organisations with mature GRC programmes typically have structured vendor compliance assessment processes that are far more efficient and reliable than ad hoc checks.

Category 4: Information Security

For any supplier that has access to the organisation’s systems, data, or networks, information security assessment is non-negotiable. The frequency and severity of third-party cyber breaches makes this the fastest-growing area of vendor due diligence investment. Assessment should cover: information security certifications (ISO 27001, SOC 2), data processing agreements and GDPR compliance documentation, penetration testing history and vulnerability management approach, incident response procedures, and access control and privilege management practices.

For critical data-handling suppliers, questionnaire-based assessment is insufficient. Independent security testing, audit rights in contracts, and ongoing monitoring through specialist vendor risk management platforms are increasingly considered minimum standards for Tier 1 technology and data suppliers.

Category 5: ESG (Environmental, Social, and Governance)

ESG due diligence has shifted from an ethical preference to a legal and commercial requirement in many jurisdictions. The EU Corporate Sustainability Due Diligence Directive (CSDDD), the UK Modern Slavery Act, and the growing requirements of sustainability reporting frameworks all require organisations to assess and manage ESG risks in their supply chains. Assessment covers: environmental certifications and emissions data, labour practices and living wage compliance, supply chain transparency beyond Tier 1, health and safety performance, and governance structures including anti-corruption policies and board diversity.

---

Conducting the Due Diligence: Practical Methods

Vendor due diligence uses a combination of desk research, supplier-provided documentation, independent verification, and direct engagement. The balance between these methods depends on the tier of the supplier and the specific risk categories most relevant to the relationship.

Supplier questionnaires are the standard starting point for structured assessment. A well-designed questionnaire (covering all five categories at a depth appropriate to the supplier’s tier) provides a consistent baseline across all supplier assessments and creates a documented audit trail. Questionnaire responses must be verified rather than accepted at face value: requesting supporting documentation (certificates, financial statements, policy documents) and cross-referencing against independent sources is standard practice for Tier 1 suppliers.

Desktop research using public databases, company registries, credit agencies, sanctions lists, and news monitoring provides independent verification of supplier-provided information and often reveals issues that suppliers would not self-report. Tools ranging from free public databases (Companies House, national business registries) to specialist platforms (LexisNexis Diligence, Refinitiv World-Check) support this process at different levels of depth and automation.

Site visits and audits provide direct visibility of operational capability, safety practices, and working conditions that cannot be assessed from documentation alone. For critical Tier 1 suppliers in manufacturing, logistics, or service delivery, periodic site visits are considered best practice and increasingly required by regulatory and certification bodies.

For organisations managing large volumes of supplier assessments, our article on supply chain risk management: how to build resilience before the next disruption covers how technology platforms and supply chain mapping tools are changing the scale at which due diligence and risk monitoring can be conducted.

---

---

What to Do When Red Flags Are Found

Finding a red flag during due diligence does not automatically mean a supplier cannot be used. It means a risk-based decision is required. The decision framework is straightforward: is the risk material (could it cause financial loss, regulatory penalty, operational disruption, or reputational damage if it crystallises?), and can it be mitigated to an acceptable residual level through specific actions?

Mitigation options include: enhanced contract protections (performance bonds, step-in rights, indemnities), increased monitoring frequency, escrow arrangements for critical software or IP, insurance requirements, supplier remediation plans with specific milestones, or dual-sourcing to reduce dependency. For risks that cannot be mitigated to an acceptable level, the only appropriate decision is not to proceed or not to renew.

The escalation path for red flag findings must be clear before due diligence begins. Who has decision authority for accepting a supplier with identified risk? What approval level is required for exceptions to standard due diligence requirements? Documenting these decisions, and the reasoning behind them, creates the audit trail that demonstrates the organisation acted responsibly regardless of how the supplier relationship subsequently performs.

Ongoing Vendor Monitoring: Due Diligence as a Continuous Process

Due diligence conducted at contract award and never repeated is not risk management. It is historical documentation. A supplier’s financial health, ownership structure, regulatory standing, and operational quality can deteriorate significantly between contract award and renewal. Continuous monitoring converts due diligence from a pre-contract formality into a genuine risk management capability.

Ongoing monitoring for Tier 1 suppliers should include: automated credit monitoring alerts for significant financial changes, annual questionnaire refresh and certification renewal checks, periodic news monitoring for regulatory actions, sanctions changes, and significant corporate events, and integration of operational KPI data from contract management into the risk assessment picture.

Conclusion: Due Diligence as a Strategic Procurement Discipline

Vendor due diligence is most effective when it is built into the procurement process as a standard discipline rather than conducted as a reactive exercise when problems emerge. Organisations that wait until a supplier failure causes disruption before conducting due diligence are not managing third-party risk. They are managing third-party consequences, which is a far more expensive and reactive posture.

Building the capability to assess, monitor, and manage third-party risk systematically is one of the most valuable investments a procurement and risk function can make. The returns are in avoided costs (supplier failures, regulatory penalties, operational disruptions), not in visible revenue, which makes them easy to underinvest in. But the organisations that have learned this lesson through experience consistently characterise it as one of the most material risk management capabilities they have developed.

Related reading: Vendor due diligence and contract management work together: due diligence identifies risks that must be addressed in contract terms, and contract management verifies that the commitments made during due diligence are being maintained throughout the relationship. Our article on contract management best practices covers the post-award disciplines that complete the vendor risk management lifecycle.

---