Only 15% of UK businesses formally review the cyber security risks posed by their immediate suppliers, and just 6% look at their wider supply chain, according to the government's Cyber Security Breaches Survey 2025/2026. The same survey found that 43% of businesses identified a cyber breach or attack in the previous 12 months.
Most organisations depend on third party vendors and partners for software, logistics, payroll or professional services. Each new supplier or partner brings potential legal, commercial and cyber risks into the business and its supply chain, and vendor due diligence is the process that identifies them before a contract is signed.
In brief
- Definition: Vendor due diligence (VDD) is the structured assessment an organisation carries out on a potential vendor, partner or third party before entering a business relationship.
- VDD vs vendor assistance: In a sale, VDD is an independent review relied on by investors, while vendor assistance is support prepared by the seller's own advisers.
- Five-step process: Classify the risk, collect information, verify it independently, assess and decide, then contract and monitor.
- Checklist areas: Corporate and financial health, cyber security and data protection, and operational/compliance checks such as anti-bribery, modern slavery and sanctions.
- Contract impact: Findings should shape the contract terms, and electronic signature speeds up onboarding once a supplier is approved.
What Is Vendor Due Diligence and Why Is It Important?
Vendor due diligence (VDD) is the structured assessment an organisation carries out on a potential vendor, partner or other third party before entering a business relationship. It checks that the supplier is who it claims to be, is financially stable, operates lawfully and has the processes to protect the systems and records it will have access to.
Third party risk management matters because responsibility cannot be outsourced. If a third party loses your customers' personal data, fails to deliver a key service or is linked to bribery or forced labour, the regulatory and reputational damage lands on you. A proportionate, risk-based approach to assessment before onboarding is far cheaper than dealing with those issues later.
Good to know
The term has a second meaning. In mergers and acquisitions, VDD is a review commissioned by the seller of a business, the "vendor", for potential buyers in the transaction.
Vendor Due Diligence vs Vendor Assistance: What Is the Difference?
In a sale transaction, the seller can prepare for scrutiny by investors in two ways.
Point of comparison | Vendor due diligence (VDD) | Vendor assistance |
|---|---|---|
What it is | An independent review of the target company | Support for management in preparing information |
Who prepares it | External advisers with financial, tax or legal expertise | Advisers working alongside the seller's team |
Who relies on it | Investors, potential buyers and their lenders | The seller, to prepare for the sale |
Typical output | A formal VDD report shared in the sale process | A document pack, databook or answers to buyer questions |
Best suited to | Larger sales with several bidders | A smaller transaction or a single buyer |
A VDD report gives bidders a consistent view of the business, speeds up the transaction and helps protect value by showing investors any issues early — supporting informed decisions on both sides. The second option is lighter and cheaper, but buyers will still conduct their own review.
The rest of this article focuses on the procurement meaning: assessing the vendors and partners you plan to work with.
What Are the Main Steps in Vendor Due Diligence?
A consistent method makes the assessment fair to vendors and easy to repeat. Most organisations follow five steps in their vendor diligence process.
The 5 Steps of Vendor Due Diligence
Classify the third party risk
Decide how important the services are and what the supplier will be able to reach. A cleaning contractor and a cloud payroll provider do not need the same depth of review.
Collect information
Send a questionnaire and request supporting documents, such as accounts, insurance certificates, policies and certifications.
Verify independently
Check what you are told against public records, references and adverse media searches.
Assess and decide
Score the findings, record any gaps and agree whether to approve, approve with conditions or reject.
Contract and monitor
Reflect the findings in the contract, then review higher risk vendors at set intervals. Ongoing monitoring is part of sound vendor management.
Two best practices help: give one team ownership, usually procurement, and bring in legal, finance and IT security — the relevant subject matter experts — for the areas that need their expertise.
The National Cyber Security Centre recommends the same cycle. Its supply chain security guidance sets out 12 principles in four stages: understand the risks, establish control, check your arrangements and continuous improvement.
Vendor Due Diligence Checklist: What Should You Assess?
The checklist below covers the areas that matter for most UK companies. Scale each one to the level of vendor risk and the value of the contract.
Corporate and Financial Checks
Legal identity
Confirm the registered name, company number, directors and people with significant control on the Companies House register.
Financial health
Review filed accounts, credit reports, payment practices and any insolvency notices or county court judgments.
Insurance
Ask for evidence of professional indemnity, public liability and other relevant cover at suitable limits.
Reputation
Search media coverage, litigation records and customer references for recurring problems.
Cyber Security and Data Protection
- Technical controls. Ask about the vendor's security practices and any Cyber Essentials or ISO 27001 certification, and how access to your systems will be managed. Bear in mind that the government survey cited above puts Cyber Essentials take-up at just 5% of UK businesses, rising to 35% of large businesses, so treat certification as a strong positive signal rather than a hard requirement for smaller suppliers.
- Incident history. Find out whether the supplier has suffered a breach and how its processes changed afterwards.
- Data protection. Under Article 28 of the UK GDPR, a controller may only use processors that offer sufficient guarantees, and a written contract is required. The ICO's guidance on contracts with processors lists the mandatory terms. Our article on GDPR and outsourcing covers the practical side.
- Sub-contractors. Identify any other third party the supplier relies on in its own supply chain.
Operational and Compliance Checks
Operational resilience
Check that the supplier has the people, processes and business continuity plans to deliver the services.
Anti-bribery
Under section 7 of the Bribery Act 2010, an organisation can be liable for bribery committed by those acting on its behalf, unless it can prove it had adequate procedures in place to prevent it — so ask for the vendor's policy and training records.
Modern slavery
Under section 54 of the Modern Slavery Act 2015, a body corporate or partnership that carries on business in the UK, supplies goods or services and has a total annual turnover of £36 million or more must publish an annual modern slavery statement, and needs information on suppliers' labour practices to do so.
Sanctions and licences
Screen the supplier and its owners against the UK Sanctions List, and confirm any sector licences.
Important
Keep a record of what you checked, when and what you decided. If something goes wrong, a documented review is the best evidence that your organisation acted responsibly.
How Does VDD Shape the Contract and Onboarding?
The findings should feed straight into the supplier contract. Weak financials may justify shorter payment terms or a parent guarantee. Gaps can be addressed through audit rights, breach notification duties and a remediation plan with deadlines. Processor clauses are mandatory wherever personal data is involved. If approval comes with conditions, write those conditions into the agreement so that they are enforceable.
Onboarding a new vendor is then a matter of getting the right documents signed: the master agreement, the processor terms, an NDA and any schedules. Handling these on paper adds days that procurement teams are trying to save. Electronic signatures remove that delay and give each document a time-stamped audit trail, which fits well with a digitised procurement process.
Try Youtrust free
Sign supplier contracts electronically once your VDD is complete.
Turn Supplier Checks Into a Reliable Process
VDD does not need to be heavy to be effective. A clear risk classification, a standard checklist and a written record of each decision will help you catch most third party risks before they reach you.
When the checks are complete, the contract should follow quickly so that the relationship can start. Youtrust helps procurement and legal teams send supplier agreements for signature, track who has signed and store every document securely.
Sign supplier contracts online
Sign supplier contracts and NDAs online with a secure audit trail.
FAQ — Vendor Due Diligence
How long does it take to conduct VDD?
A low-risk, low-value supplier can be cleared in a day or two. A critical technology or outsourcing partner may take several weeks, depending on how quickly it responds.
Is VDD a legal requirement?
There is no single law that requires it, but privacy, anti-bribery, modern slavery and sector rules all expect organisations to assess the suppliers they use.
How often should vendors be reassessed?
Monitoring should be continuous for critical vendors and partners: review them at least once a year, and reassess any partner after a security incident, a change of ownership or a significant change in the services provided.
What is the difference between vendor due diligence and vendor assistance?
Vendor due diligence is an independent review relied on by investors and buyers in a sale process. Vendor assistance is support prepared by the seller's own advisers to get ready for that sale.
What are the main steps in vendor due diligence?
The five steps are: classify the third party risk, collect information, verify it independently, assess and decide, then contract and monitor the vendor.
What should a vendor due diligence checklist cover?
It should cover corporate and financial checks, cyber security and data protection, and operational and compliance checks such as anti-bribery, modern slavery and sanctions screening.
