Third-party due diligence: assessing suppliers and partners according to risk

Risk that comes from outside

Every business relies on suppliers, consultants, distributors and technology partners. Many of them have access to critical data, systems or processes, and their problems quickly become yours: a cyber incident, a supply disruption, misconduct that makes the news with your company’s name next to it.

Recent regulation says so explicitly. NIS2 requires organizations to manage supply chain security, the GDPR requires them to choose processors that offer sufficient guarantees, and anti-bribery and sustainability rules extend scrutiny to business partners. Third-party due diligence is no longer an optional check run by procurement, but a process involving compliance, IT, legal and senior management.

Tier before you assess

The most common mistake is treating every supplier the same way, sending the same long questionnaire to the stationery vendor and to the company running your servers. The result is a huge effort, answers filled in hastily and no extra scrutiny where it is actually needed.

Start instead with a classification based on a few criteria: access to personal data or company systems, how important the service is to business continuity, the countries the supplier operates in, the value and length of the relationship, and how quickly it could be replaced. A handful of questions asked at registration is enough to place each third party in a risk tier.

Each tier then calls for a different depth of review. For low-risk suppliers a basic document check may be enough; critical ones need a full questionnaire, verified evidence and, in some cases, an on-site audit.

What to ask and how to verify it

A good due diligence questionnaire is short and matched to the risk tier. Typical areas are the identity of the company and its beneficial owners, information security and data protection, certifications, business continuity, ethics and anti-bribery, sustainability and the use of subcontractors. Every question should serve a clear purpose: if the answer wouldn’t change the decision, drop the question.

The answers then need checking. A claimed certification should come with the certificate and its expiry date, a security policy with the approved document, a statement on beneficial ownership with an up-to-date company register extract. External sources such as sanctions lists and public registers round out the picture without asking the supplier for anything more.

It also pays to decide in advance who reviews what. Answers on cybersecurity need IT’s eye, data protection answers need the privacy lead’s view, and ethics and anti-bribery answers belong with compliance. A workflow that routes each section to the right expert stops the questionnaire from sitting on one person’s desk.

The essential questionnaire

• Identity and beneficial owners
• Security and data protection
• Certifications and expiry dates
• Business continuity
• Ethics and anti-bribery
• Subcontractors

From score to decision

Answers and checks feed into a risk score calculated with transparent criteria that apply to everyone. The score doesn’t decide on its own: it makes different suppliers comparable and brings out the weak spots worth discussing.

There are more than two possible decisions. Besides approving or rejecting, you can approve with conditions: specific contract clauses, an improvement plan with deadlines, restrictions on data access, an early reassessment. Every decision should be justified and recorded, along with who made it.

The conditions that come out of due diligence must make it into the contract. A security requirement missing from the agreement is hard to enforce exactly when you need it.

1. 01 Tiering
2. 02 Questionnaire
3. 03 Evidence check
4. 04 Risk score
5. 05 Reasoned decision
6. 06 Contract clauses

Ongoing monitoring

Due diligence doesn’t end at onboarding. Certifications expire, ownership changes, a supplier may suffer an incident or end up on a sanctions list. Periodic reassessments at a frequency proportionate to risk, alerts on document expiry dates and the ability to reopen an assessment when something significant happens keep the picture current.

Regulate’s Third Party Due Diligence module covers the whole cycle: initial tiering, questionnaires tailored to each tier, evidence collection, risk scoring and ongoing monitoring with alerts. Linked to the supplier records in CRM, it brings data, documents, assessments and contracts together in a single view, so you can show at any time how the company governs the risks that come from outside.