Vendor Due Diligence

The depth of the review depends on how important the supplier will be and what it will touch. Typical checks cover ownership and legal status, financial health, references and past performance, information security and privacy controls, business continuity, regulatory licences, sanctions and adverse media screening, and use of subcontractors. Suppliers often complete a questionnaire and provide documents, and higher-risk ones may be visited or independently audited. Many buyers add an assessment of environmental, social and governance practices, such as labour conditions, bribery controls and emissions, sometimes called a supplier ESG assessment. Findings are scored and either accepted, accepted with conditions to be fixed, or rejected. The review is repeated at intervals after onboarding. Rejecting a weak supplier before signing costs far less than escaping a contract afterwards.

A university picks a new vendor for its student payments portal. Due diligence finds that the vendor has had no independent security test in two years and uses a subcontractor in a country the university treats as high risk. It signs only after the vendor completes a penetration test and agrees to remove the subcontractor.