ChooseQAVendor

Due-diligence checklist

What to verify before signing and how to verify it, from legal entity to certifications.

What this does

A proposal states; due diligence verifies. The checklist holds 29 checks across legal entity and jurisdiction, insurance, references, security posture and certifications, subcontracting, staff continuity, IP and code ownership, data handling and financial stability.

Each check says how to verify it, often with a free public register, and which evidence to keep on file. Download it as a working checklist with result and date columns.

See a sample output

Due-diligence checklist: [Vendor]

ChooseQAVendor framework v1.0. 29 checks. Nothing you enter in the toolkit is sent anywhere.

Complete before contract signature. Keep the evidence listed for each check on file with the contract.

Legal entity and jurisdiction

1. The company that will sign the contract exists, is active, and is the same entity described in the proposal.

How to verify: Ask for the full legal name, registration number and registered address of the contracting entity. Look it up in the national register (Companies House for the UK, SAM.gov entity records for US federal registrants) or in OpenCorporates for other countries. Confirm the status is active and the name and number match the proposal and draft contract exactly.

Evidence to keep: Dated register extract or screenshot showing name, number, status and registered address.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Companies House: find and update company information (https://find-and-update.company-information.service.gov.uk/); OpenCorporates: open database of companies (https://opencorporates.com/)

2. Where the delivery team sits and which entity employs them, if it differs from the contracting entity.

How to verify: Ask the vendor to list every entity involved in delivery, with country and the role each plays. Look each one up in OpenCorporates or the relevant national register and note the parent and group relationships. Confirm the contract makes the contracting entity responsible for all of them.

Evidence to keep: Vendor's written entity map, with register lookups for each entity.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: OpenCorporates: open database of companies (https://opencorporates.com/); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

3. The EU VAT number given on the proposal or invoice is valid and belongs to the contracting entity.

How to verify: Enter the member state and VAT number in the European Commission VIES validation service. Check that the returned name and address match the contracting entity.

Evidence to keep: VIES validation result with the consultation reference and date.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: VIES VAT number validation (https://ec.europa.eu/taxation_customs/vies/)

4. Neither the vendor, its parent, nor its named directors appear on sanctions lists.

How to verify: Search the entity names and director names in the OFAC Sanctions List Search, and in any sanctions list your own jurisdiction requires. Record exact and close matches and resolve any close match before proceeding.

Evidence to keep: Search results with date, names searched and outcome.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: OFAC Sanctions List Search (https://sanctionssearch.ofac.treas.gov/); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

5. The vendor is not debarred or excluded from public contracts.

How to verify: Search the World Bank listing of ineligible firms and individuals, and the exclusion records on SAM.gov. Where the buyer is a public body, also check the exclusion grounds that apply under its own procurement rules.

Evidence to keep: Search results with date and outcome for each list.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: World Bank listing of ineligible firms and individuals (https://www.worldbank.org/en/projects-operations/procurement/debarred-firms); SAM.gov entity and exclusion records (https://sam.gov/)

Insurance

6. The vendor holds professional indemnity, cyber and other insurance at the levels the contract will require.

How to verify: Ask for a certificate of insurance for each policy, issued by the insurer or broker. Check the insured entity is the contracting entity, the cover limits meet the contract, and the policy dates cover the start of the work.

Evidence to keep: Certificates of insurance, with a note of limits and expiry dates.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)

7. The cyber and professional indemnity policies cover the kind of work the vendor will do, including access to your systems and data.

How to verify: Ask the vendor or its broker to confirm in writing whether the policies cover services provided to clients, data breaches caused by the vendor's staff, and work done by subcontractors. Note any exclusions that apply to your use.

Evidence to keep: Broker or insurer confirmation letter describing scope and exclusions.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

References

8. References come from clients with work similar in size, domain and engagement model to yours.

How to verify: Ask for at least [3] references with contact names, the service delivered and dates. Choose which ones to call, ask for one former client if possible, and speak to the person who managed the vendor day to day rather than only a sponsor.

Evidence to keep: Reference call notes, dated, with the name and role of each person spoken to.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)

9. Any adverse public information about the vendor, such as litigation, regulatory action or public statements from former clients.

How to verify: Search public court and regulator records in the vendor's home jurisdiction and news sources for the entity name and main directors. Ask the vendor to disclose any material litigation or regulatory action in the last [5] years and compare with what you found.

Evidence to keep: Search log with dates and results, and the vendor's written disclosure.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

Security posture and certifications

10. Any ISO/IEC 27001 certificate the vendor cites is valid, current and issued by an accredited certification body.

How to verify: Ask for a copy of the certificate. Search the certificate or company in IAF CertSearch and confirm the certification body is accredited, the certificate is current and the entity named matches the contracting entity.

Evidence to keep: Certificate copy and the IAF CertSearch result, dated.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: IAF CertSearch: verify accredited management system certificates (https://www.iafcertsearch.org/); ISO/IEC 27001 Information security management systems (https://www.iso.org/standard/27001)

11. The ISO/IEC 27001 scope covers the sites, teams and services that will deliver your work.

How to verify: Read the scope statement on the certificate and ask for the statement of applicability. Check that the delivery locations and the testing service are inside the scope, not only a head office or a different business unit.

Evidence to keep: Certificate scope statement and statement of applicability, with a note on any gaps.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: ISO/IEC 27001 Information security management systems (https://www.iso.org/standard/27001); IAF CertSearch: verify accredited management system certificates (https://www.iafcertsearch.org/)

12. Any SOC 2 report is a Type II report that covers a recent period and the services you are buying.

How to verify: Request the SOC 2 Type II report under NDA. Read the period covered, the system description and scope, the trust services criteria included, the auditor's opinion and the listed exceptions. If the period ended more than a few months ago, ask for a bridge letter covering the gap.

Evidence to keep: SOC 2 report (held under NDA), bridge letter if any, and your review notes.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: SOC 2: SOC for Service Organizations, Trust Services Criteria (https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2)

13. Exceptions and complementary user entity controls in the SOC 2 report are understood and addressed.

How to verify: List each exception the auditor reported and ask the vendor how it was fixed. List the complementary user entity controls the report expects you to operate and confirm who on your side will do each one.

Evidence to keep: Exception and control list with vendor responses and owners.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: SOC 2: SOC for Service Organizations, Trust Services Criteria (https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2); ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html)

14. Where no certificate or report exists, the vendor's security controls are assessed directly and in proportion to the access they will have.

How to verify: Send a security questionnaire covering access control, device security, staff onboarding and offboarding, incident response and secure handling of credentials. Ask for supporting documents for the answers that matter most to your risk.

Evidence to keep: Completed questionnaire, supporting documents and your risk assessment.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

15. The vendor has a working incident response process and can notify you in the time the contract will require.

How to verify: Ask for the incident response policy and the named contact for security incidents. Ask for an anonymised example of how a past incident was handled and how quickly clients were told.

Evidence to keep: Incident response policy, contact details and example summary.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

Subcontracting

16. Whether any part of the work will be done by subcontractors or freelancers, and who they are.

How to verify: Ask the vendor to state in writing whether any team member will be a subcontractor, freelancer or employee of another company. For each subcontractor, get the legal name, country and work to be done, and run the entity and sanctions checks above.

Evidence to keep: Vendor's written subcontractor disclosure and the checks run on each.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

17. The vendor passes its security, confidentiality and IP obligations down to subcontractors.

How to verify: Ask for the template agreement the vendor uses with subcontractors, or the relevant clauses. Check it covers confidentiality, IP assignment, security requirements and audit rights at least equal to your contract.

Evidence to keep: Subcontractor template or clause extracts with your review notes.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

Staff continuity

18. The people proposed are employed by the vendor and available for the planned start date.

How to verify: Ask for CVs of the proposed team, their employing entity and confirmation of availability. Interview the lead and at least one team member. Confirm the proposal does not list people who are not yet hired.

Evidence to keep: CVs, interview notes and written availability confirmation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)

19. Staff turnover and how the vendor handles departures from client teams.

How to verify: Ask for the vendor's staff turnover figure for delivery staff over the last [12] months and how it is calculated. Ask how handovers are run when someone leaves a client team, and confirm the answer with references.

Evidence to keep: Vendor's written answer and reference call notes on continuity.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

20. Staff background checks match the level of access they will have.

How to verify: Ask what pre-employment checks the vendor runs (identity, right to work, employment history, criminal record where lawful) and whether these apply to subcontractors. Compare with what your own policy requires for people with the same access.

Evidence to keep: Vendor screening policy and written confirmation for the proposed team.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

IP and code ownership

21. The vendor owns the work of its staff and subcontractors, so it can assign test code and assets to you.

How to verify: Ask the vendor to confirm in writing that employment and subcontractor agreements assign IP created during the work to the vendor. For US work, note that commissioned software is not usually a work made for hire, so a written assignment is needed at each step.

Evidence to keep: Vendor's written confirmation and the IP clause from its standard employment or subcontractor agreement.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Circular 30: Works Made for Hire (https://www.copyright.gov/circs/circ30.pdf)

22. Which pre-existing tools, frameworks or libraries the vendor plans to use, and on what terms.

How to verify: Ask for a list of any proprietary tools or accelerators the vendor will bring, and any open-source components with their licences. Confirm you can keep using the test suite after exit without a licence from the vendor.

Evidence to keep: Pre-existing materials list and licence terms, attached to the contract.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Circular 30: Works Made for Hire (https://www.copyright.gov/circs/circ30.pdf); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)

Data handling

23. Whether the vendor will act as a processor of personal data and, if so, can meet GDPR Article 28 requirements.

How to verify: Map what personal data testers could see, including in test environments, logs and screenshots. If any, send your data processing terms and ask the vendor to confirm it can meet them, including instructions, confidentiality, security, subprocessors, assistance, deletion and audit.

Evidence to keep: Data map and the vendor's signed or marked-up data processing terms.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Contracts and liabilities between controllers and processors (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/)

24. Where data will be accessed from, and the transfer mechanism for any access from outside your jurisdiction.

How to verify: Ask for the countries from which staff and subcontractors will access your systems and data. For access from outside the EEA or UK, confirm the transfer mechanism, such as the Standard Contractual Clauses, and ask for the vendor's transfer risk assessment.

Evidence to keep: List of access locations and signed transfer mechanism.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Standard Contractual Clauses for international transfers (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)

25. How test data is created and how the vendor avoids using production data.

How to verify: Ask the vendor to describe how it creates or obtains test data, how it masks any real data, and how it deletes data at the end of an engagement. Ask for an example of a deletion confirmation given to another client, with details removed.

Evidence to keep: Vendor's test data procedure and example deletion confirmation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); ISO/IEC 27001 Information security management systems (https://www.iso.org/standard/27001)

Financial stability signals

26. The vendor files its accounts on time and the filed figures show no obvious distress.

How to verify: Download the latest filed accounts from Companies House or the relevant national register. Check filing dates, any overdue filings, net assets and whether auditors raised a going concern issue. For private companies with no public filings, ask for the latest accounts under NDA.

Evidence to keep: Filed accounts or accounts provided under NDA, with your summary notes.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Companies House: find and update company information (https://find-and-update.company-information.service.gov.uk/); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)

27. Your contract value is not a large share of the vendor's revenue, and the vendor does not depend on one or two clients.

How to verify: Ask the vendor for its annual revenue band and the share of revenue from its largest clients. Compare your expected annual spend with its revenue. A high share on either side means the relationship matters more if either party leaves.

Evidence to keep: Vendor's written answer and your calculation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

28. Charges, insolvency notices and recent changes in ownership or directors.

How to verify: Check the company filing history in Companies House or OpenCorporates for charges registered against the company, insolvency notices, and recent changes of directors or owners. Ask the vendor to explain any recent change.

Evidence to keep: Filing history extract and the vendor's explanation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Companies House: find and update company information (https://find-and-update.company-information.service.gov.uk/); OpenCorporates: open database of companies (https://opencorporates.com/)

29. What happens to your service and your test assets if the vendor fails or is sold.

How to verify: Ask the vendor how it would keep services running and hand over your assets in an insolvency or change of control. Check this against the exit plan, the repository clause and your ability to terminate on change of control.

Evidence to keep: Vendor's continuity statement and your contract cross-reference.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)

Sample files:Sample Markdown 22 KBSample CSV 20 KB

Build your checklist

Areas to check

29 checks selected.

Due-diligence checklist: [Vendor]

ChooseQAVendor framework v1.0. 29 checks. Nothing you enter in the toolkit is sent anywhere.

Complete before contract signature. Keep the evidence listed for each check on file with the contract.

Legal entity and jurisdiction

1. The company that will sign the contract exists, is active, and is the same entity described in the proposal.

How to verify: Ask for the full legal name, registration number and registered address of the contracting entity. Look it up in the national register (Companies House for the UK, SAM.gov entity records for US federal registrants) or in OpenCorporates for other countries. Confirm the status is active and the name and number match the proposal and draft contract exactly.

Evidence to keep: Dated register extract or screenshot showing name, number, status and registered address.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Companies House: find and update company information (https://find-and-update.company-information.service.gov.uk/); OpenCorporates: open database of companies (https://opencorporates.com/)

2. Where the delivery team sits and which entity employs them, if it differs from the contracting entity.

How to verify: Ask the vendor to list every entity involved in delivery, with country and the role each plays. Look each one up in OpenCorporates or the relevant national register and note the parent and group relationships. Confirm the contract makes the contracting entity responsible for all of them.

Evidence to keep: Vendor's written entity map, with register lookups for each entity.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: OpenCorporates: open database of companies (https://opencorporates.com/); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

3. The EU VAT number given on the proposal or invoice is valid and belongs to the contracting entity.

How to verify: Enter the member state and VAT number in the European Commission VIES validation service. Check that the returned name and address match the contracting entity.

Evidence to keep: VIES validation result with the consultation reference and date.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: VIES VAT number validation (https://ec.europa.eu/taxation_customs/vies/)

4. Neither the vendor, its parent, nor its named directors appear on sanctions lists.

How to verify: Search the entity names and director names in the OFAC Sanctions List Search, and in any sanctions list your own jurisdiction requires. Record exact and close matches and resolve any close match before proceeding.

Evidence to keep: Search results with date, names searched and outcome.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: OFAC Sanctions List Search (https://sanctionssearch.ofac.treas.gov/); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

5. The vendor is not debarred or excluded from public contracts.

How to verify: Search the World Bank listing of ineligible firms and individuals, and the exclusion records on SAM.gov. Where the buyer is a public body, also check the exclusion grounds that apply under its own procurement rules.

Evidence to keep: Search results with date and outcome for each list.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: World Bank listing of ineligible firms and individuals (https://www.worldbank.org/en/projects-operations/procurement/debarred-firms); SAM.gov entity and exclusion records (https://sam.gov/)

Insurance

6. The vendor holds professional indemnity, cyber and other insurance at the levels the contract will require.

How to verify: Ask for a certificate of insurance for each policy, issued by the insurer or broker. Check the insured entity is the contracting entity, the cover limits meet the contract, and the policy dates cover the start of the work.

Evidence to keep: Certificates of insurance, with a note of limits and expiry dates.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)

7. The cyber and professional indemnity policies cover the kind of work the vendor will do, including access to your systems and data.

How to verify: Ask the vendor or its broker to confirm in writing whether the policies cover services provided to clients, data breaches caused by the vendor's staff, and work done by subcontractors. Note any exclusions that apply to your use.

Evidence to keep: Broker or insurer confirmation letter describing scope and exclusions.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

References

8. References come from clients with work similar in size, domain and engagement model to yours.

How to verify: Ask for at least [3] references with contact names, the service delivered and dates. Choose which ones to call, ask for one former client if possible, and speak to the person who managed the vendor day to day rather than only a sponsor.

Evidence to keep: Reference call notes, dated, with the name and role of each person spoken to.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)

9. Any adverse public information about the vendor, such as litigation, regulatory action or public statements from former clients.

How to verify: Search public court and regulator records in the vendor's home jurisdiction and news sources for the entity name and main directors. Ask the vendor to disclose any material litigation or regulatory action in the last [5] years and compare with what you found.

Evidence to keep: Search log with dates and results, and the vendor's written disclosure.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

Security posture and certifications

10. Any ISO/IEC 27001 certificate the vendor cites is valid, current and issued by an accredited certification body.

How to verify: Ask for a copy of the certificate. Search the certificate or company in IAF CertSearch and confirm the certification body is accredited, the certificate is current and the entity named matches the contracting entity.

Evidence to keep: Certificate copy and the IAF CertSearch result, dated.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: IAF CertSearch: verify accredited management system certificates (https://www.iafcertsearch.org/); ISO/IEC 27001 Information security management systems (https://www.iso.org/standard/27001)

11. The ISO/IEC 27001 scope covers the sites, teams and services that will deliver your work.

How to verify: Read the scope statement on the certificate and ask for the statement of applicability. Check that the delivery locations and the testing service are inside the scope, not only a head office or a different business unit.

Evidence to keep: Certificate scope statement and statement of applicability, with a note on any gaps.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: ISO/IEC 27001 Information security management systems (https://www.iso.org/standard/27001); IAF CertSearch: verify accredited management system certificates (https://www.iafcertsearch.org/)

12. Any SOC 2 report is a Type II report that covers a recent period and the services you are buying.

How to verify: Request the SOC 2 Type II report under NDA. Read the period covered, the system description and scope, the trust services criteria included, the auditor's opinion and the listed exceptions. If the period ended more than a few months ago, ask for a bridge letter covering the gap.

Evidence to keep: SOC 2 report (held under NDA), bridge letter if any, and your review notes.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: SOC 2: SOC for Service Organizations, Trust Services Criteria (https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2)

13. Exceptions and complementary user entity controls in the SOC 2 report are understood and addressed.

How to verify: List each exception the auditor reported and ask the vendor how it was fixed. List the complementary user entity controls the report expects you to operate and confirm who on your side will do each one.

Evidence to keep: Exception and control list with vendor responses and owners.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: SOC 2: SOC for Service Organizations, Trust Services Criteria (https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2); ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html)

14. Where no certificate or report exists, the vendor's security controls are assessed directly and in proportion to the access they will have.

How to verify: Send a security questionnaire covering access control, device security, staff onboarding and offboarding, incident response and secure handling of credentials. Ask for supporting documents for the answers that matter most to your risk.

Evidence to keep: Completed questionnaire, supporting documents and your risk assessment.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

15. The vendor has a working incident response process and can notify you in the time the contract will require.

How to verify: Ask for the incident response policy and the named contact for security incidents. Ask for an anonymised example of how a past incident was handled and how quickly clients were told.

Evidence to keep: Incident response policy, contact details and example summary.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: ISO/IEC 27036-1:2021 Cybersecurity, Supplier relationships, Part 1: Overview and concepts (https://www.iso.org/standard/82905.html); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

Subcontracting

16. Whether any part of the work will be done by subcontractors or freelancers, and who they are.

How to verify: Ask the vendor to state in writing whether any team member will be a subcontractor, freelancer or employee of another company. For each subcontractor, get the legal name, country and work to be done, and run the entity and sanctions checks above.

Evidence to keep: Vendor's written subcontractor disclosure and the checks run on each.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

17. The vendor passes its security, confidentiality and IP obligations down to subcontractors.

How to verify: Ask for the template agreement the vendor uses with subcontractors, or the relevant clauses. Check it covers confidentiality, IP assignment, security requirements and audit rights at least equal to your contract.

Evidence to keep: Subcontractor template or clause extracts with your review notes.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

Staff continuity

18. The people proposed are employed by the vendor and available for the planned start date.

How to verify: Ask for CVs of the proposed team, their employing entity and confirmation of availability. Interview the lead and at least one team member. Confirm the proposal does not list people who are not yet hired.

Evidence to keep: CVs, interview notes and written availability confirmation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)

19. Staff turnover and how the vendor handles departures from client teams.

How to verify: Ask for the vendor's staff turnover figure for delivery staff over the last [12] months and how it is calculated. Ask how handovers are run when someone leaves a client team, and confirm the answer with references.

Evidence to keep: Vendor's written answer and reference call notes on continuity.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

20. Staff background checks match the level of access they will have.

How to verify: Ask what pre-employment checks the vendor runs (identity, right to work, employment history, criminal record where lawful) and whether these apply to subcontractors. Compare with what your own policy requires for people with the same access.

Evidence to keep: Vendor screening policy and written confirmation for the proposed team.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management); NIST SP 800-161r1 Cybersecurity Supply Chain Risk Management Practices (https://csrc.nist.gov/pubs/sp/800/161/r1/final)

IP and code ownership

21. The vendor owns the work of its staff and subcontractors, so it can assign test code and assets to you.

How to verify: Ask the vendor to confirm in writing that employment and subcontractor agreements assign IP created during the work to the vendor. For US work, note that commissioned software is not usually a work made for hire, so a written assignment is needed at each step.

Evidence to keep: Vendor's written confirmation and the IP clause from its standard employment or subcontractor agreement.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Circular 30: Works Made for Hire (https://www.copyright.gov/circs/circ30.pdf)

22. Which pre-existing tools, frameworks or libraries the vendor plans to use, and on what terms.

How to verify: Ask for a list of any proprietary tools or accelerators the vendor will bring, and any open-source components with their licences. Confirm you can keep using the test suite after exit without a licence from the vendor.

Evidence to keep: Pre-existing materials list and licence terms, attached to the contract.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Circular 30: Works Made for Hire (https://www.copyright.gov/circs/circ30.pdf); Model Services Contract (https://www.gov.uk/government/publications/model-services-contract)

Data handling

23. Whether the vendor will act as a processor of personal data and, if so, can meet GDPR Article 28 requirements.

How to verify: Map what personal data testers could see, including in test environments, logs and screenshots. If any, send your data processing terms and ask the vendor to confirm it can meet them, including instructions, confidentiality, security, subprocessors, assistance, deletion and audit.

Evidence to keep: Data map and the vendor's signed or marked-up data processing terms.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Contracts and liabilities between controllers and processors (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/)

24. Where data will be accessed from, and the transfer mechanism for any access from outside your jurisdiction.

How to verify: Ask for the countries from which staff and subcontractors will access your systems and data. For access from outside the EEA or UK, confirm the transfer mechanism, such as the Standard Contractual Clauses, and ask for the vendor's transfer risk assessment.

Evidence to keep: List of access locations and signed transfer mechanism.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Standard Contractual Clauses for international transfers (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)

25. How test data is created and how the vendor avoids using production data.

How to verify: Ask the vendor to describe how it creates or obtains test data, how it masks any real data, and how it deletes data at the end of an engagement. Ask for an example of a deletion confirmation given to another client, with details removed.

Evidence to keep: Vendor's test data procedure and example deletion confirmation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Regulation (EU) 2016/679 (GDPR), including Article 28 on processors (https://eur-lex.europa.eu/eli/reg/2016/679/oj); ISO/IEC 27001 Information security management systems (https://www.iso.org/standard/27001)

Financial stability signals

26. The vendor files its accounts on time and the filed figures show no obvious distress.

How to verify: Download the latest filed accounts from Companies House or the relevant national register. Check filing dates, any overdue filings, net assets and whether auditors raised a going concern issue. For private companies with no public filings, ask for the latest accounts under NDA.

Evidence to keep: Filed accounts or accounts provided under NDA, with your summary notes.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Companies House: find and update company information (https://find-and-update.company-information.service.gov.uk/); The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks)

27. Your contract value is not a large share of the vendor's revenue, and the vendor does not depend on one or two clients.

How to verify: Ask the vendor for its annual revenue band and the share of revenue from its largest clients. Compare your expected annual spend with its revenue. A high share on either side means the relationship matters more if either party leaves.

Evidence to keep: Vendor's written answer and your calculation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks); Interagency Guidance on Third-Party Relationships: Risk Management (2023) (https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)

28. Charges, insolvency notices and recent changes in ownership or directors.

How to verify: Check the company filing history in Companies House or OpenCorporates for charges registered against the company, insolvency notices, and recent changes of directors or owners. Ask the vendor to explain any recent change.

Evidence to keep: Filing history extract and the vendor's explanation.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: Companies House: find and update company information (https://find-and-update.company-information.service.gov.uk/); OpenCorporates: open database of companies (https://opencorporates.com/)

29. What happens to your service and your test assets if the vendor fails or is sold.

How to verify: Ask the vendor how it would keep services running and hand over your assets in an insolvency or change of control. Check this against the exit plan, the repository clause and your ability to terminate on change of control.

Evidence to keep: Vendor's continuity statement and your contract cross-reference.

Result: [ ] Verified [ ] Concern [ ] Not applicable

Source: The Sourcing and Consultancy Playbooks (https://www.gov.uk/government/publications/the-sourcing-and-consultancy-playbooks); Guidelines on outsourcing arrangements (EBA/GL/2019/02), being replaced by the EBA guidelines on third-party risk management (https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf)

Download your document:

Everything on this page runs in your browser. Nothing you type is sent to us or to anyone else, and nothing is stored after you close the tab.

Framework v1.0 · released 2026-09-24 · changelog

Questions buyers ask

When should due diligence happen?
After scoring, on the one or two vendors you might sign with, and before contract signature. Some checks, such as the legal entity and sanctions screening, are quick enough to run at shortlist stage.
How do we verify an ISO 27001 certificate?
Ask for the certificate, note the certification body and certificate number, and check it on the certification body's register or IAF CertSearch. Then read the scope: it must cover the people and sites that will work on your product.
What should we look for in a SOC 2 report?
The report type (Type II covers a period of operation), the period, the systems in scope, any exceptions noted by the auditor, and the complementary controls you are expected to run. Ask for a bridge letter if the period ended months ago.
What evidence should we keep?
Each check lists the evidence to keep. File it with the contract so the next review, or an auditor, can see what was checked and when.