What is vendor due diligence?

It is the set of checks you run on a supplier before you sign with them, and keep running while they work for you: who they are, whether they are excluded or sanctioned, whether they are insured, licensed and safe, whether they are financially stable, and whether they can protect your data. The goal is to know what you are taking on before the contract is signed.

What should a vendor due diligence checklist include?

At minimum: identity and registration, exclusion and sanctions screening, insurance certificates, safety record, financial checks, licenses and permits, references, data security questions, recertification and expiry tracking, and an audit history that keeps every version of what the vendor declared.

How often should vendors be rechecked?

Recheck anything with an expiry date before it expires, such as insurance certificates and licenses, and rerun exclusion and sanctions screening on a schedule. Many organizations rescreen monthly for exclusion lists and do a full recertification every year or two, depending on the risk of the vendor.

What is the difference between vendor due diligence and vendor vetting?

The terms overlap. Vendor vetting usually means the initial prequalification of a supplier before they are approved. Vendor due diligence often covers the same checks plus the ongoing monitoring and recertification that keep an approval current.

Why keep every version of what a vendor declared?

Because an auditor or a dispute rarely asks what the vendor's profile says today. The question is what the vendor declared at the time you approved them or signed the contract. A system that overwrites old values cannot answer that.

Vendor Due Diligence Checklist

The contract is ready, the business owner wants the vendor started on Monday, and your vendor file has a W-9 and an insurance certificate that expired in June. That is how most vendor due diligence actually fails: not because nobody knew what to check, but because the checks were done once, by email, and nobody tracked what changed afterward.

This checklist covers what to check before you sign a vendor, what to verify at the source rather than take on trust, and what to keep so you can show your work later. One of the checks, exclusion and sanctions screening, you can run right now with our free exclusion check, which searches the OIG LEIE, SAM.gov exclusions and the OFAC SDN list for up to 25 names at once.

Key Takeaways

Vendor due diligence is not a one-time form. Most of the risk comes from things that change after approval: expired insurance, lapsed licenses, new exclusions.
Verify at the source where you can: the secretary of state for registration, the official lists for exclusions and sanctions, the licensing body for licenses, the insurer or broker for coverage.
Screen vendors against exclusion and sanctions lists before you sign and on a schedule after that. A name match is a possible match to confirm, not a finding.
Track every expiry date and send reminders before it passes, not after.
Keep every version of what the vendor declared, with dates, so an audit can see what was true when you approved them.

1. Identity and registration

Start by confirming the vendor is who they say they are.

Legal name, any trade names, and the address of record
Business registration and good standing with the secretary of state in the state of formation, checked on the state's own site
Taxpayer identification number on a signed W-9; payers who file certain information returns can check the name and TIN combination through the IRS TIN Matching program
Ownership: who owns and controls the business, including parent companies
Unique Entity ID from SAM.gov if the vendor does federal work

Ownership matters for the next step, because you will want to screen the owners and key people as well as the company.

2. Exclusion and sanctions screening

Check the company, its owners and its key people against:

The OIG LEIE, if the vendor touches anything billed to Medicare, Medicaid or another federal health care program
SAM.gov exclusions, for parties suspended or debarred from federal contracts and assistance
The OFAC SDN list, for sanctions; US persons are generally prohibited from dealing with listed parties
State lists that apply to your industry and states, such as state Medicaid exclusion lists for health care

Run the check before you sign and rescreen on a schedule after that; monthly is common for exclusion lists. Our free exclusion check covers the first three in one search. Every result is a possible match: confirm it on the official site with the identifiers the record holds before you act on it. We explain the difference between the lists in OIG LEIE vs SAM.gov exclusions.

3. Insurance certificates

Ask for a certificate of insurance and read it, rather than filing it.

Coverage types your contract requires, such as general liability, workers' compensation, auto and professional liability
Limits at or above what the contract requires
Your organization named as certificate holder, and as additional insured where the contract requires it, with the endorsement to back it up
Policy effective and expiry dates, entered into your tracking system on the day you receive the certificate

A certificate is a snapshot. If coverage matters, confirm it with the broker or insurer, and ask for a new certificate before each expiry date.

4. Safety

For vendors who work on your sites or with your people, ask about their safety record and program.

Written safety program and training records
Injury and incident history, and the logs your industry uses to report it
Workers' compensation experience modification rate, where it applies
Any regulatory citations and how they were resolved

Score these against criteria you set in advance, so two reviewers reach the same answer on the same vendor.

5. Financial checks

You want to know the vendor will still be there when the work is half done.

Financial statements, audited where the size of the contract justifies it
Bank and trade references
Credit reports from a commercial credit bureau
Liens, judgments and bankruptcies in public records
How much of the vendor's revenue your contract would be; a vendor that depends on you is a different risk from one that does not

6. Licenses and permits

Every professional or trade license the work requires, checked with the issuing board or agency, not from a copy the vendor sends
License number, status, scope and expiry date
Any disciplinary actions on the license

7. References

Call them. Ask about the same type of work, done recently, at a similar size. Ask what went wrong and how the vendor handled it. A reference that only says good things has not told you much.

8. Data security

If the vendor will handle your data or connect to your systems:

What data they will hold, where it will be stored, and who at the vendor can see it
Security certifications or reports, such as ISO 27001 or a SOC 2 report, and the period they cover
Encryption in transit and at rest, access control and multi-factor authentication
Breach notification terms and timelines in the contract
Their own subcontractors who will touch your data
What happens to your data at the end of the contract

9. Recertification and expiry tracking

Approval is the start, not the end. Most vendor risk shows up after the contract is signed, when a certificate lapses or a vendor is added to an exclusion list.

Record every expiry date: insurance, licenses, certifications, security reports
Send reminders to the vendor well before each date, and escalate if nothing arrives
Rescreen exclusion and sanctions lists on a schedule
Run a full recertification at a set interval, often yearly for higher-risk vendors

10. Audit history

Keep every version of what the vendor declared, with the date and who submitted it. When an auditor asks whether a vendor was insured and approved on the day they started work, the answer has to come from the record as it stood that day, not from the profile as it stands now.

That means the system you use cannot simply overwrite old values. Store each change as a new version, attach the documents that supported it, and keep the reviewer's decision alongside.

What this looks like as a system

We built and have run i4 Strategies' vendor prequalification platform for four years. Suppliers complete a scored online questionnaire, upload their documents and pay for their submission by card. Each vendor has a profile of around 200 fields, and every change is kept as a version for audit. Recertification reminders go out by email and text before certifications expire, and buyers and suppliers each have their own portal.

If you want a working list to start from, our Vendor Prequalification and Recertification Checklist covers profiles and documents, the scored questionnaire, insurance, safety and financial checks, recertification and audit history. You can request it on our vendor vetting page.

Start with screening

Of everything above, exclusion and sanctions screening is the quickest to start and the easiest to forget after approval. Run your current vendors and their owners through our free exclusion check for the OIG LEIE, SAM.gov exclusions and the OFAC SDN list, and have the full report sent by email.

Talk to us

If your vendor due diligence lives in email threads and spreadsheets, we can build it into one workflow: questionnaire, documents, screening, expiry tracking and a full version history. Contact us and tell us how you vet vendors today.

Vendor Due Diligence Checklist: What to Check Before You Sign