The documents to request before onboarding a supplier, SaaS provider or outsourcing partner – company, financial health, information security, data protection, compliance and contract terms.
Third-party (vendor) due diligence is done by a customer before it relies on a supplier: a bank onboarding a payments processor, a company choosing a cloud provider, a manufacturer signing a key component supplier. The goal is to confirm the supplier is who it says it is, financially able to perform, compliant with law and the customer's own regulatory obligations, and secure enough to be trusted with data or critical processes.
Depth should match risk. A low-risk supplier with no data access may only need identity, sanctions screening and insurance. A critical vendor processing personal data or running a core process needs the full list below, a security assessment and a right to audit. Many regulated sectors – financial services in particular – also require ongoing monitoring, so expect to refresh certificates and reports at least once a year. (Note: in M&A, "vendor due diligence" means a report the seller commissions on its own company; for that, see the M&A checklist.)
For the vendor, the fastest way to pass these reviews is a ready-made trust package: current certificates and audit reports, a standard completed questionnaire, policies and a template data processing agreement, shared through a single access-controlled link with an NDA rather than attached to e-mails on request.
Numbered like a data room index: use the sections as folders and keep the numbers in file names.
The CSV opens in Excel, Numbers or Google Sheets. A practical starting point – adapt it to your deal and jurisdiction with your advisers.
Procurement, information security, legal and privacy teams on the customer side; in regulated firms also compliance and third-party risk management. For critical outsourcing, regulators may expect the file to be available on request.
From a few days for low-risk suppliers to several weeks for critical vendors; repeat at renewal and at least annually for high-risk third parties.
The checks a company performs on a supplier or service provider before signing and during the relationship: identity and ownership, financial health, security, data protection, compliance and contract terms.
Registry extract and ownership, financial statements, insurance certificates, security certifications or SOC 2 report, a completed security questionnaire, a data processing agreement and sub-processor list, policies and the SLA.
At renewal and on a risk-based schedule – typically annually for critical or high-risk vendors and less often for low-risk suppliers – plus whenever the service or ownership changes.
In M&A, vendor due diligence is a report the seller commissions on its own business to give to buyers. In procurement and third-party risk management, it means a customer checking its suppliers.
Through a data room or tracked link with NDA acceptance, watermarking and access expiry, so SOC 2 reports and penetration test summaries are not forwarded freely.