Vendor Due Diligence

In the current regulatory landscape, vendor due diligence is more important than ever before. Companies rely on third-party vendors to provide key services, handle sensitive financial data or handle mission-critical operations. Businesses often have governance, contractual, regulatory, or fiduciary responsibilities that make vendor risk assessment an important part of vendor selection.

Vendors can create additional layers of risk for businesses in a number of areas, including:

• Financial stability
• Contractual performance
• Operational continuity
• Cybersecurity
• Data privacy
• Reputation
• Regulatory compliance

Although it may seem like this aspect of due diligence is a one-time thing related to onboarding a new vendor, it’s not. Rather, companies must complete regular assessments to determine if the vendor continues to meet expectations for risk management and performance.

The vendor due diligence process should happen in the discovery period, well in advance of signing a contract. With this guide, businesses will discover the importance of conducting enhanced due diligence for vendors and have a checklist and several best practices for an efficient diligence process.

What is Vendor Due Diligence?

When companies think about adding a vendor to provide services to the organization, they may perform a basic evaluation and onboarding. These steps usually involve gathering general information and receiving a proposal for service from the potential vendor. Although these processes are important for selecting a vendor and ensuring they have the correct information and appropriate access to business systems, they are not the same thing as due diligence.

True vendor or supplier due diligence is a far more detailed process, involving an evaluation of several areas:

• Legal entity information
• Ownership structure
• Financial statements
• Insurance coverage
• Compliance certifications
• Cybersecurity controls
• Data-handling practices
• Litigation history
• Sanctions or watchlist results
• Contract terms
• Service-level capabilities

The goal is to dig deeply into a risk assessment, confirming that the vendor does not present excessive risk to the company. The ultimate result should show whether the business can trust, monitor and manage the vendor effectively.

The scope of due diligence depends on the vendor risk level. A vendor that does not have access to customer data or any sensitive information related to company operations may not require the same level of investigation as one handling financial services, data or critical outsourcing functions.

Why Vendor Due Diligence Matters

If this seems like a lot of work for a company to perform for a number of possible vendors, it’s for good reason. Third-party organizations can expose businesses to risk, even if it is the vendor performing the activity. Depending on the role that the vendor fills for the organization, it can affect these critical areas:

• Accuracy of financial reporting
• Protection of confidential data
• Regulatory compliance
• Customer trust
• Investor confidence
• Continuity of the business

Going through a diligence checklist with each vendor helps the company identify problems before signing a binding contract or allowing a vendor to become embedded in operations. These issues can create questions about corporate governance if they affect mission-critical functions like material operations, financial controls or disclosure processes.

A thorough due diligence process for vendors can reduce:

• Fraud risk
• Cybersecurity risk
• Operational disruption
• Contract disputes
• Compliance violations
• Reputational harm

Investing into the effort supports stronger internal controls and reinforces company decision-making.

When to Conduct Vendor Due Diligence

Conducting vendor due diligence is an ongoing process, with the bulk of the work happening before signing contracts or granting access to systems, data or sensitive workflows. Companies may need to perform follow-up diligence at these points:

• Contract renewal
• Changes to the scope of work
• Presence of performance issues
• Increase in vendor risk level
• Post-cybersecurity incidents
• Changes to regulations that apply to the company or vendor
• M&A due diligence
• Vendor acquisition or change in ownership, including evaluating the potential buyer or potential acquirers

Companies with a range of vendors should consider classifying them by risk level and creating a set of standards to follow for each level. For example, the organization may choose to implement these controls:

• Low-Risk: Basic onboarding and periodic evaluation on contract renewal
• Moderate-Risk: Standard due diligence and evaluation as part of contract controls
• High-Risk: Enhanced due diligence, including senior approval and continuous monitoring

Routine monitoring of vendors becomes increasingly important due to the expansion and growing complexity of vendor ecosystems.

Key Areas to Review During Vendor Due Diligence

Although the areas to review as part of vendor due diligence depend on the types of services the vendor will be providing and its access to critical company systems, these general topics should get some coverage.

Financial stability

Financial due diligence for vendors looks like an assessment as to whether the vendor can provide consistent services through the contract. Companies should review:

• Financial statements
• Liquidity
• Credit rating
• Indicators of potential financial distress, such as recurring losses, liquidity concerns, or sustained negative cash flow

These details can help to determine if the vendor is likely to survive and remain resilient over time.

Legal and corporate structure

Checking the legal and corporate structure involves these tasks:

• Confirming legal name
• Identifying ownership, including beneficial ownership and potential conflicts of interest
• Researching subsidiaries or parent entities
• Sourcing the vendor’s jurisdiction

This analysis paints a picture of the vendor’s overall governance.

Regulatory and compliance history

A diligence report should include an inspection of the vendor’s regulatory and compliance history, specifically:

• Reviewing licenses
• Verifying certifications
• Researching regulatory enforcement history
• Identifying regulatory obligations
• Confirming vendor compliance with industry-specific standards and regulations

These details establish the vendor’s pattern of compliance with routine reporting and other requirements.

Cybersecurity and data privacy

Assessing vendor risk management involves an evaluation of its cybersecurity and data privacy, including analyzing:

• Information security policies
• History of any security breaches
• Level and consistency of encryption
• Access controls
• Incident response plans

When possible, companies should consider SOC reports or other independent assurance reports.

Operational capability

Since business continuity is critical for the company and its vendors, businesses should conduct a vendor risk assessment for these areas:

• Staffing
• Technology infrastructure
• Service delivery model
• Scalability
• Continuity planning

This assessment shows whether the vendor can function reasonably and provide agreed-upon services.

Reputation and ethics

Since a vendor relationship can affect a company’s reputation, it is important to consider these reputational and ethical aspects of the vendor’s operations:

• Current and past litigation
• Regulatory sanctions
• Adverse media
• Risk of corruption
• History of ethical practices

This evaluation establishes whether the vendor’s reputation can damage the company by association.

Contract and service terms

Businesses should evaluate whether existing contractual obligations could create conflicts, limit service delivery, or affect performance:

• Existing indemnities
• Service-level agreements (SLAs)
• Audit rights
• Termination rights
• Confidentiality obligations
• Data processing terms

With this information, the company can determine if the vendor has conflicting or superseding commitments.

Vendor Due Diligence Checklist

To ensure that all necessary information is researched and collected, companies should consider following a vendor due diligence checklist:

• Confirm details about legal entity name and registration.
• Identify ownership structure and all beneficial owners.
• Confirm conflicts of interest.
• Collect W-9, tax information or equivalent documentation.
• Review financial statements or credit information when appropriate.
• Obtain insurance certificates.
• Review cybersecurity policies and SOC reports where present.
• Assess data privacy policies.
• Evaluate data processing practices, including data visibility and security.
• Confirm regulatory licenses or certifications.
• Review sanctions, watchlists and adverse media results.
• Evaluate litigation or enforcement history.
• Review contract terms, SLAs and termination rights.
• Assess business continuity and disaster recovery plans.
• Assign a vendor risk rating.
• Create records of approval and sign-off.
• Establish a cadence for renewal and monitoring.

The goal here is to standardize a review process, minimize unnecessary repetition and make sure critical aspects receive sufficient coverage.

Vendor Due Diligence Documentation to Maintain

Once each iteration of the diligence process is done, the company must complete and retain documentation related to the evaluation. Detailed documentation can help to demonstrate reasonable due diligence in the event that issues arise with the vendor arise later. These documents may support audits, regulatory examinations where applicable, transaction diligence, and internal investigations.

A comprehensive diligence questionnaire should provide reports covering these aspects:

• Initial vendor questionnaires
• Risk ratings
• Reviews of financial data and history
• Assessments of security
• SOC reports and certifications
• Insurance certificates
• Sanctions
• Adverse media reports
• Reviews of conflicts of interest
• Approvals of any exceptions
• Renewal reviews
• Performance reports

Retention periods for each type of document should align with company policy, as well as contractual obligations and regulatory standards. Data centralization can help to ensure that this information remains available to all relevant stakeholders.

Select Vendors Strategically and with Confidence

Vendor management involves regular evaluation of performance, along with maintenance of the vendor relationship. It also requires a detailed due diligence process, so that the company can ensure its chosen vendors will meet the terms of their contracts and protect the organizational bottom line.

Vendor due diligence helps businesses to identify and handle risks presented to them by third parties before a contractual relationship results in damage to operations, compliance, financial reporting or reputation. The strongest programs emphasize risk evaluation, cross functions, maintain detailed documentation and provide ongoing monitoring. The goal should not just be to onboard new vendors in an efficient way, but rather to maintain visibility into vendor performance, compliance and risk throughout the contract term.

Although vendor due diligence is a complex, detailed process, software solutions can simplify the workflows and improve efficiency. DFIN’s secure virtual data rooms protect privacy during collaboration and review of vendor contracts, as well as protecting diligence materials during transactions. Our ActiveDisclosure platform supports controlled reporting workflows, a key advantage when vendor risk affects board materials, investor disclosures or other types of financial reporting.