Third-party due diligence: vetting partners and suppliers

A business takes on some of the risk of every partner, supplier and distributor it works with. When a third party fails, cuts corners or misrepresents itself, the consequences land on the business that chose them.

Be proportionate

Not every supplier needs the same scrutiny. Tier third parties by what they touch: critical operations, sensitive data, regulatory exposure, or significant spend. Concentrate effort on the top tier.

Core questions for any material relationship

• Is the entity what it claims to be, and who ultimately owns and controls it?
• Is it financially stable enough to deliver over the life of the contract?
• Does it hold the licences, registrations and insurance its work requires?
• What does its track record look like, from sources other than its own references?
• Are there public records of disputes, regulatory action or reputational issues?

Use public sources first

Corporate registries, court records, regulatory databases and credible news coverage answer many of these questions at low cost. Gaps or inconsistencies between what a party says and what the public record shows are worth pursuing.

Build it into the contract

Diligence findings should shape terms: audit rights, notification obligations, termination triggers and appropriate warranties. Contract terms are a legal matter and should be reviewed by counsel.

Revisit periodically

Due diligence is a snapshot. Ownership, finances and conduct change. Re-check critical relationships on a set schedule and whenever a warning sign appears.