Supplier Due Diligence Checklist Before You Sign

The due diligence most small businesses do before signing a supplier contract is a credit check and a good feeling about the account manager.

The due diligence most procurement departments do is a 40-question form sent to every supplier regardless of what is being bought, answered by someone who has answered it 200 times, filed, and never looked at again.

Neither is much use. The first misses things that matter; the second collects things that don't. What works sits in between, and the deciding question is not "what should we check?" but "what would we lose if this supplier stopped existing on Tuesday?"

Scale the checks to the damage

Three suppliers, three different levels of effort.

Office stationery, £2,000 a year, replaceable in an afternoon. Confirm the legal entity and that the company is active. That is genuinely it.

Marketing agency, £30,000 a year, holds some confidential material, three-month notice period. Add a credit check, confirm professional indemnity cover, and ask who actually does the work.

Core software, £50,000 paid annually in advance, processes customer data, two-year term, six months to migrate away. Everything below, and the contract terms should reflect what you find.

The mistake is not doing too little on the first one. It is doing the same thing on all three, which guarantees the third gets the attention the first deserved.

Who you are actually contracting with

The supplier's trading name is often not the entity in the contract. Record the full legal name, company number and registered address, and check at Companies House that the company is active with filings reasonably up to date.

This sounds like box-ticking until something goes wrong, at which point knowing precisely which legal entity owes you something stops being administrative.

Worth checking ownership at the same time — privately held, part of a group, private-equity backed, recently acquired. Ownership is not itself a risk, but it changes during multi-year agreements, and the relevant protections are in the assignment and change-of-control provisions. What happens when your supplier gets bought depends entirely on what those clauses say, and almost nobody reads them before signing.

Can they afford to deliver it?

A credit report gives you a rating, payment history, any County Court Judgments, and the direction of travel in the accounts. None of it guarantees anything — healthy companies fail and struggling ones recover — but it tells you which questions to ask next.

Financial stability matters most in a specific situation: when you pay significantly in advance. A supplier billing monthly can fail and cost you a month. The same supplier holding a year's fees in advance costs you the year, and you join the queue of unsecured creditors.

That is the point where due diligence should start changing the contract rather than just informing it.

Where the work actually happens

The company you sign with may not do the work. Cloud software, IT services, logistics, facilities management and consultancy all routinely subcontract, and the question is not whether they do but whether it matters.

Ask which parts are subcontracted, where those providers are, and whether any of them touch your data. The supplier should stay responsible for the whole service regardless — but you want that written down rather than assumed, particularly where a subcontractor is in a different jurisdiction from the one you signed in.

For smaller suppliers there is a related question, and it is often the more important one: what happens if a particular person leaves? If you have been impressed by the founder or the lead consultant during the sales process, find out whether anyone else could deliver the same thing. A business-critical service resting on one individual is a continuity risk that no amount of financial checking will reveal.

Data, if they touch any

Where a supplier processes personal data, the questions are specific and answerable: what data, why, stored where, who can access it, does it leave the UK, which subcontractors are involved, how long is it kept, and what happens to it when the contract ends.

Ask for the Data Processing Agreement rather than assuming the standard terms deal with it. For technology suppliers, evidence of ISO 27001 or Cyber Essentials is worth asking for — though a certificate tells you a process existed on the audit date, not that it is being followed now.

One question gets overlooked: how quickly must they tell you about a breach? Your own notification obligations have deadlines, and they start when you find out.

Support promises versus support commitments

"Excellent support" is marketing. A service level is a number with a consequence attached.

If the service matters, establish the support hours, how issues get reported, the severity definitions, the response times — and separately the resolution targets, which are a different thing entirely. A supplier can promise to respond to a critical fault within 30 minutes while promising nothing whatsoever about fixing it.

Then check what happens when they miss. Most contracts include service credits that nobody ever claims, and a credit regime with no teeth is worth knowing about before signing rather than after.

References, asked properly

"Are you happy with them?" produces a useless answer. Specific questions produce real ones:

• Did implementation land on time?
• What did it cost beyond the quoted price?
• How do they behave when something breaks?
• How much has the price risen since you started?
• Would you choose them again?

The last one does most of the work. People will tell you about a bad experience when the question gives them permission to.

What the findings should change

This is the part most checklists leave out. Due diligence that ends in a filed document was a waste of everyone's time; due diligence that changes the contract was worth doing.

A financially weaker supplier asking for annual payment upfront is an argument for monthly billing. Heavy reliance on subcontractors is an argument for tighter subcontracting provisions. A supplier you would struggle to replace is an argument for stronger exit assistance — because whether you can actually leave is determined entirely at signature, not when you want to go.

Ask the question plainly before committing: if this supplier disappeared tomorrow, could we get our data out, how long would replacement take, and what have we already paid for that we would never see again?

It expires

Insurance lapses. Companies get acquired. Certifications need renewing. The people you met leave. A supplier that was low risk when you signed in 2024 can look materially different by the time the contract rolls in 2027 — and nothing prompts anyone to look, because the checks were done once and filed.

The practical problem is that the evidence scatters. The credit report sits with whoever ran it, the insurance certificate is in an inbox, the DPA is with whoever handled the contract, and the signed agreement is somewhere else entirely. Six months on, nobody has the whole picture, and reassembling it costs more than the original exercise.

Keeping the documents with the supplier and the contract — rather than with the person who happened to collect them — is what makes the second review cheaper than the first.

Timemy keeps supplier records, contracts and their key dates together, so the information you gathered before signing is still there when the renewal comes round. See how contract tracking works.

---

The short version: decide how much the supplier could cost you if they failed, and check in proportion to that. Confirm the legal entity, the finances if you are paying in advance, who really does the work, and what happens to your data. Then let what you find change the contract — and diarise a look at it again before you renew.