The eight-step supplier due diligence checklist
Start with the decision, not a folder of documents. A useful checklist identifies the exact supplier entity, asks for evidence proportionate to the relationship and ends with a recorded outcome, named owner and next review trigger.
- Confirm the contracting entity. Capture the legal name, registration number, jurisdiction and internal supplier ID.
- Tier the relationship. Record service criticality, data or system access, substitutability and spend exposure.
- Define the evidence scope. Separate company-record checks from cyber, sanctions, ESG, operational and contractual controls.
- Check legal status. Retain the source, retrieval date and any effective or filing date.
- Review ownership and group links. Distinguish direct shareholders, parent relationships and beneficial ownership.
- Inspect directors and available filings. Confirm the record belongs to the right entity and compare like with like.
- Assign every evidence gap. Name the reviewer, request and due date; do not turn missing data into a negative fact.
- Record the decision and review trigger. Approve, approve with conditions, escalate or decline according to your policy.
CompanyDelta supports the company-record layer: entity matching, corporate status, directors, ownership relationships, available financial filings and detected company changes. It does not replace cyber assessment, sanctions screening, credit scoring, bank-account verification, ESG review, contractual diligence or operational testing.
Set scope and evidence depth before requesting documents
Use the service and relationship to decide how much evidence is reasonable. A low-impact office supplier should not face the same review as a provider that can interrupt a regulated process or access sensitive systems. Conversely, a short questionnaire is not sufficient merely because it has been completed.
Minimum intake before company checks
- The proposed legal entity and the entity named on the contract, invoice and purchase order.
- The service, countries of delivery, internal owner and intended start date.
- Whether the supplier processes data, accesses systems, handles funds or supports a critical activity.
- The policy tier, required reviewers and evidence that can block or condition approval.
Review company evidence without overclaiming what it proves
| Evidence area | Reviewer question | What it does not prove |
|---|---|---|
| Legal identity | Is this the exact entity that will contract, deliver and be paid? | A registry match does not confirm the bank account or service capability. |
| Company status | What status is recorded, by which source and on what date? | An active status is not an endorsement or a licence for every activity. |
| Ownership and group | Which direct owners and parent relationships are available, and where are the gaps? | A corporate link does not quantify operational concentration or establish a UBO by itself. |
| Directors and officers | Who holds recorded roles, and what appointment or resignation dates are available? | A name match alone does not establish that two records describe the same person. |
| Financial filings | Are the entity, period, currency, units and consolidation scope comparable? | A missing field is not zero, and a parent filing is not the subsidiary's filing. |
| Change history | Which later events would materially alter the original decision? | No alert does not prove nothing changed if coverage or retrieval failed. |
Keep the evidence state explicit: verified means the defined check has sufficient retained evidence; gap means a reviewer or supplier must provide more; not in scope means the policy deliberately excludes it for this relationship. These states are more useful than one unexplained risk score.
Build an evidence worksheet and assign every gap
Use the worksheet below to prepare a review. It runs in your browser, makes no network request and does not save your selections. Copy the summary into your approved procurement system or print it to PDF.
Route evidence gaps to a decision, not a dead end
| Evidence state | Required record | Next action |
|---|---|---|
| Verified | Source, date, reviewer and conclusion | Retain evidence and continue to the decision. |
| Gap | Missing item, why it matters, owner and due date | Request evidence, apply a condition or escalate. |
| Conflicting | Both values, definitions and source dates | Resolve the entity or field definition before choosing a value. |
| Unavailable | Source attempted, failure state and last successful check | Use policy-approved alternatives; never convert unavailable to zero. |
| Not in scope | Policy reason and approving role | Retain the exclusion so it is not mistaken for an omission. |
A complete review should let a colleague reproduce the entity match, understand which evidence was considered and see why the outcome followed. If the decision depends on an assumption, write the assumption and the event that would invalidate it.
Buyer questions to resolve before rollout
Can one checklist cover every supplier?
No. Keep a common company-evidence spine, then vary specialist controls and approval thresholds by criticality, access and jurisdiction.
Will company data replace supplier questionnaires?
No. Independent company records can corroborate identity and corporate facts, while the supplier must provide service, control and contractual evidence.
Can missing ownership data be treated as low risk?
No. It is an evidence gap. Your policy decides whether to request documents, apply conditions, escalate or stop.
Can CompanyDelta approve suppliers automatically?
No. It can support entity and company-record review. Your organisation owns the policy, specialist checks and final decision.
Does the checklist verify bank details?
No. Reconcile the legal and payee entities, but use an authorised bank-account verification control before changing payment instructions.
How should buyers prove value?
Measure confirmed entity matches, actionable gaps, review time, conditional approvals and completed qualified enquiries—not raw page traffic alone.
Define the events that reopen supplier review
Due diligence is not finished when onboarding ends. Set a time-based cadence for the relationship tier and event triggers for facts that can change the original decision. Examples include a changed company status, new corporate shareholder, parent relationship change, director appointment or resignation, a newly filed financial statement, a contract-party change or a failed evidence retrieval.
For each trigger, record the evidence required, the reviewer and the possible outcomes. Monitor service health as well as company facts: unmatched entities, failed checks and long periods without a successful retrieval need their own queue. A quiet dashboard is not proof that the supplier record is unchanged.
Explore supplier company monitoring →Test a representative pilot before scaling
Use a mixed sample rather than the easiest records. Include a supplier with several local entities, one trading under a different name, one with incomplete ownership disclosure, one with a recent officer change and one without comparable financial periods. Ask two reviewers to complete the worksheet independently; differences expose unclear definitions and thresholds.
- Measure confirmed and unresolved entity matches separately.
- Count gaps that received an owner and were resolved by the target date.
- Record decisions changed or conditioned by company evidence.
- Track qualified assessment and demo enquiries with source-page attribution where consent and system access allow.
- Review false matches, unavailable sources and workflow failures before expanding.
CompanyDelta can first assess which entities in your list can be matched and which company-record fields are available by country. That is a better starting point than promising complete coverage before the sample is tested.
Questions about supplier due diligence
What should a supplier due diligence checklist include?
Include the exact legal entity, relationship criticality, company status, ownership and group evidence, directors, available financial filings, relevant specialist controls, assigned evidence gaps, the approval outcome and time- or event-based review triggers.
Is vendor due diligence different from supplier due diligence?
Procurement teams often use vendor and supplier interchangeably. In mergers and acquisitions, vendor due diligence can also mean information prepared by a seller. This guide addresses procurement review of a third party that supplies goods or services.
How often should supplier due diligence be repeated?
Set the cadence according to relationship criticality and policy, then reopen review when a material event occurs. Critical suppliers may need more frequent review than low-impact vendors; event-driven checks complement rather than automatically replace periodic review.
Who should own supplier due diligence?
Procurement can coordinate the record, but ownership is shared. Finance, legal, security, privacy, compliance and operations should own the evidence and decisions within their disciplines, with one accountable relationship owner.
Should we reject a supplier with incomplete ownership data?
Incomplete data identifies uncertainty, not a negative fact. Apply your policy: request more evidence, condition approval, escalate for review or decline when the unresolved gap exceeds the accepted threshold.
Does a corporate link prove supplier concentration?
No. It identifies a relationship worth investigating. Concentration analysis also requires spend, substitutability, service dependency and operating-location evidence.
Is a shareholder the same as an ultimate beneficial owner?
No. A direct shareholder, an accounting parent and a person who ultimately owns or controls the entity are different concepts. Record the relationship type and the evidence supporting each conclusion.
What if supplier financial statements are unavailable?
Record what was attempted and why the evidence is unavailable. Request policy-approved alternatives from the supplier or reviewer. Never translate a missing figure into zero or substitute a parent filing without disclosing the scope difference.
Does company due diligence verify supplier bank accounts?
No. Company records can help confirm the legal and payee entities, but payment instructions require a separate authorised bank-account verification and change-control process.
What part of supplier due diligence can CompanyDelta support?
CompanyDelta supports legal-entity matching and review of available company status, directors, ownership relationships, financial filings and later company changes. Coverage varies by country and source, and specialist risk checks remain with the relevant control owners.