What is vendor due diligence?

Vendor due diligence is the structured process of investigating and verifying a vendor's financial health, legal standing, cybersecurity posture, operational capabilities, and compliance record before entering into a significant commercial relationship or at scheduled reassessment intervals.

What should be on a vendor due diligence checklist?

A comprehensive vendor due diligence checklist covers: company and legal verification (incorporation, sanctions screening), financial health (D&B, financial statements for Tier 1), cybersecurity (SOC 2, security questionnaire, cyber insurance), compliance (licences, regulatory history, FCPA), operational resilience (BCP, key person risk), and ESG (modern slavery, environmental policy).

What is the difference between vendor due diligence and vendor onboarding?

Vendor onboarding collects the administrative information needed to set up a vendor in your systems (W-9, banking, insurance). Vendor due diligence is the risk investigation — verifying the vendor's financial health, legal standing, cybersecurity posture, and compliance record. They overlap but serve different purposes. Due diligence informs the decision to onboard; onboarding executes it.

How long does vendor due diligence take?

Tier 1 (critical vendor) due diligence: 5–10 business days with automation, 2–4 weeks manually. Tier 2: 3–5 days automated. Tier 3: 1–2 days. The biggest time drivers are: vendor responsiveness, financial statement collection, and approval routing speed.

Is vendor due diligence required by law?

Specific due diligence requirements vary by industry and regulation. Banking (OCC), healthcare (HIPAA), financial services (FINRA), and organisations subject to FCPA/OFAC compliance have specific third-party due diligence obligations. For most commercial organisations, due diligence is best practice risk management rather than a statutory requirement — though negligence in vendor selection can create legal liability in the event of a vendor-caused incident.

Vendor Due Diligence Checklist: 50-Point Framework for 2026

☰ Contents

How to Use This Checklist
Domain 1: Company & Legal Verification (10 items)
Domain 2: Financial Health (8 items)
Domain 3: Cybersecurity & Data Privacy (12 items)
Domain 4: Regulatory & Compliance (10 items)
Domain 5: Operational Resilience & ESG (10 items)
Tiered Checklist Summary

📥 Free Download

This 50-point vendor due diligence checklist is available as a free downloadable Excel template at ProcurementVMS.com — with tiered versions for Tier 1, 2, and 3 vendors, built-in scoring, and completion tracking.

How to Use This Checklist

Assign each checklist item a status: Not Applicable / Not Started / In Progress / Complete / Flagged for Review. Items flagged for review require a documented risk treatment decision before the vendor can proceed to contract execution. Use the tiered summary (below) to determine which items apply to each vendor tier — do not apply all 50 items to every vendor.

Domain	Items	Applies To	Primary Owner
Company & Legal Verification	10	All tiers	Procurement
Financial Health	8	Tier 1 & 2	Finance / Procurement
Cybersecurity & Data Privacy	12	Tier 1 (full); Tier 2 (partial)	IT Security / Procurement
Regulatory & Compliance	10	All tiers (depth varies)	Compliance / Legal
Operational Resilience & ESG	10	Tier 1 & 2	Procurement / Risk

Domain 1: Company & Legal Verification (10 Items)

› ✓ Legal entity name verified — exact match to IRS records and state registration
› ✓ Secretary of State good standing — active registration confirmed in state of incorporation
› ✓ EIN / TIN verified — IRS TIN matching confirmation
› ✓ OFAC sanctions screening — vendor legal name and principal owners screened against OFAC SDN list
› ✓ UN and EU sanctions screening — for internationally-operating vendors
› ✓ OIG / SAM exclusion screening — government contractors and healthcare vendors
› ✓ Beneficial ownership verified — ultimate beneficial owners identified for Tier 1 vendors
› ✓ Conflict of interest disclosed — no relationships between vendor principals and your employees
› ✓ Corporate structure documented — parent, subsidiary, and affiliate relationships identified
› ✓ Adverse media screening — recent news and legal records checked for material issues

Domain 2: Financial Health (8 Items — Tier 1 & 2)

› ✓ D&B credit score obtained — current Dun & Bradstreet financial health score
› ✓ Years in business verified — minimum 2–3 years for standard vendors; 5+ for critical
› ✓ Revenue size appropriate — vendor revenue supports the scope of your contract
› ✓ Financial statements reviewed — last 2 years audited financials (Tier 1 only)
› ✓ Revenue concentration assessed — no single customer >30% of vendor revenue for critical vendors
› ✓ Liens and judgements checked — no undisclosed material liens or court judgements
› ✓ Bankruptcy history disclosed — no pending or recent bankruptcy proceedings
› ✓ Cyber liability insurance current — minimum coverage limits verified for Tier 1 data-access vendors

Domain 3: Cybersecurity & Data Privacy (12 Items)

› ✓ SOC 2 Type II report current — within 18 months; Tier 1 technology vendors
› ✓ ISO 27001 certificate current — alternative or supplement to SOC 2; international vendors
› ✓ Security questionnaire completed and scored — CAIQ or custom questionnaire by tier
› ✓ Cyber risk score obtained — BitSight or SecurityScorecard for Tier 1 technology vendors
› ✓ Data Processing Agreement (DPA) executed — for any vendor accessing personal data
› ✓ HIPAA BAA executed — healthcare organisations only; all vendors accessing PHI
› ✓ Penetration testing policy confirmed — annual pen testing for vendors with system access
› ✓ Breach notification obligation confirmed — contractual 48-hour notification requirement
› ✓ Fourth-party data controls documented — subcontractors handling your data identified and controls confirmed
› ✓ Access control policy reviewed — least-privilege access; multi-factor authentication
› ✓ Incident response plan confirmed — vendor has documented, tested IR plan
› ✓ Data retention and deletion policy confirmed — vendor will delete your data on contract termination

🚀 Free Executive Demo

Track Due Diligence Completion in Procurement VMS

Join US procurement leaders who replaced manual processes with intelligent automation. Live in 4–8 weeks.

Request Your Executive Demo → Calculate Your ROI

🔒 SOC 2 Type II ⚡ Live in 4–8 Weeks 🇺🇸 US-Based Support

Domain 4: Regulatory & Compliance (10 Items)

› ✓ Applicable licences current — professional, state, or industry-specific licences verified
› ✓ FCPA / anti-bribery acknowledgment signed
› ✓ Code of conduct signed — vendor acknowledges your supplier standards
› ✓ Export control compliance confirmed — EAR/ITAR for relevant technology vendors
› ✓ CCPA / CPRA data handling confirmed — for vendors processing California consumer data
› ✓ PCI DSS compliance confirmed — for vendors in payment data scope
› ✓ Regulatory enforcement history disclosed — no undisclosed material enforcement actions in past 5 years
› ✓ Anti-money laundering (AML) policy confirmed — financial services vendors
› ✓ Environmental compliance confirmed — EPA and state environmental regulation adherence
› ✓ Employment law compliance confirmed — no material wage, discrimination, or safety violations

Domain 5: Operational Resilience & ESG (10 Items)

› ✓ Business continuity plan documented — BCP available and tested within 12 months
› ✓ Disaster recovery capability confirmed — RTO and RPO defined for critical service delivery
› ✓ Key person dependency assessed — no single-person risk for critical capabilities
› ✓ Alternative supplier documented — Tier 1 vendors: back-up sourcing option identified
› ✓ Geographic concentration assessed — primary operations and data centres identified
› ✓ Modern slavery statement current — annual disclosure for vendors with international supply chains
› ✓ Environmental policy documented — relevant environmental certifications or commitments
› ✓ Diversity and inclusion policy confirmed — where relevant to procurement programme
› ✓ Worker safety record reviewed — OSHA recordable incident rate for on-site vendors
› ✓ Subcontractor use disclosed — all material subcontractors identified; flow-down obligations confirmed

Tiered Checklist Summary

Vendor Tier	Total Items	Key Domains Included	Target Completion
Tier 1 — Critical	50 items	All 5 domains — full depth including financial statements, SOC 2, cyber risk score	5–10 business days
Tier 2 — High	30 items	Company/Legal, Financial (D&B only), Cybersecurity (partial), Compliance, BCP	3–5 business days
Tier 3 — Standard	15 items	Company/Legal, Core Compliance (licences, code of conduct, COI)	1–2 business days

Related Resources

→ Vendor Risk Management Complete Guide → Vendor Risk Assessment Template → Vendor Compliance Management → Vendor Onboarding 50-Point Checklist → Vendor Scorecard Template