Third-party due diligence is the process of checking whether a supplier is suitable for the relationship before approval and at key points afterwards. A strong review combines supplier-provided evidence with independent verification, scales depth to inherent risk, and continues with monitoring once the relationship is live.
In practice, due diligence sits inside the wider third-party risk management. It helps an organisation decide whether to proceed with a supplier, what conditions should be written into the contract, how deeply the supplier should be reviewed, and what needs to be monitored once the service is live.
The depth of the review should follow the relationship’s inherent risk, rather than applying the same evidence request to every supplier.
A practical supplier due diligence checklist
A useful due diligence process should answer the following questions before the relationship is approved or renewed:
Due diligence vs ongoing monitoring: what is the difference?
Due diligence is a decision gate used before approval, renewal or material change. Ongoing monitoring is the continuing process of checking whether the assumptions behind that decision remain true after the supplier is in use.
A supplier can pass a thorough pre-contract review and still change afterwards. It may add a new subprocessor, move infrastructure, experience an incident, expose a new service or change the way your organisation uses its platform. The original due diligence remains valuable evidence, but it cannot describe changes that happened after it was completed.
This is why due diligence and continuous monitoring belong together inside a mature third-party risk management programme.
When to do supplier due diligence
Supplier due diligence should happen whenever an organisation needs to make or revisit a risk decision about the relationship. Four moments are especially important:
A calendar-based review can still be useful, but risk events should also trigger reassessment. The cadence should reflect criticality, access, regulatory obligations and the organisation’s risk appetite.
What does a supplier due diligence pack usually contain?
A due diligence pack brings together different types of evidence because each artefact answers a different question. None should be read as proof of the whole supplier relationship.
Each artefact answers a different part of the due diligence question. None provides a complete view on its own, and each has its own scope and freshness limits. For a deeper breakdown of what these documents prove, what they miss and what can be verified independently, see 7 Vendor Risk Assessment Documents to Request During Due Diligence.
How should due diligence depth scale with inherent risk?
The amount of due diligence should reflect the exposure created by the relationship. A supplier handling sensitive data, supporting a critical service, receiving privileged access, or sitting deeply inside the organisation’s digital environment deserves more scrutiny than a low-impact supplier with no technical connection.
That scaling prevents two common problems: spending the same effort on every supplier, and letting procurement value stand in for actual exposure. The inherent risk assessment should decide how much evidence is required, which specialists need to review it, what approval level is needed, and how often the relationship should be revisited.
What should cyber due diligence verify externally before signing?
Cyber due diligence can use external evidence to test whether the supplier’s observable footprint is consistent with the story presented in the diligence pack. It cannot prove internal controls, but it can reveal conditions that deserve validation before a contract is signed.
Depending on scope and authorisation, useful external checks can include:
External findings should be treated as evidence to investigate, not as automatic proof of control failure. Ownership, business relevance, and materiality still need to be validated.
Where does due diligence fall short?
Due diligence becomes weak when the organisation collects evidence without testing what that evidence can actually support. The most common failure is treating completion of the pack as the risk decision itself.
Common oversights include:
What do regulators and auditors expect supplier due diligence to show?
Regulatory frameworks use different language and apply to different organisations, but the common expectation is that supplier risk decisions are proportionate, evidenced, and connected to the real relationship.
Due diligence should therefore show what was assessed, why the depth was appropriate, what evidence supported the decision, which issues were accepted or remediated, and how the relationship will be monitored afterwards.
NIS2 Article 21
The Directive requires essential and important entities to include supply chain security in their cybersecurity risk-management measures. Article 21 specifically calls for attention to the relationships between each entity and its direct suppliers or service providers, including the vulnerabilities specific to each direct supplier and the overall quality of their cybersecurity practices. NIS2 does not prescribe one universal due diligence pack, and national implementation also matters.
DORA
For financial entities using ICT services, Article 28 requires a pre-contract assessment before entering relevant arrangements. This includes assessing the criticality of the service, supervisory conditions, relevant risks including concentration risk, performing due diligence on the prospective ICT provider, and considering conflicts of interest. DORA also keeps responsibility for compliance with the financial entity.
GDPR Article 28
Where a processor handles personal data on behalf of a controller, the controller must use processors that provide sufficient guarantees for appropriate technical and organisational measures. A processor also needs prior specific or general written authorisation before engaging another processor, with the controller given an opportunity to object where general authorisation is used.
These requirements can inform due diligence, but a technology platform does not make an organisation compliant. Legal interpretation, governance, contractual decisions and documented accountability remain with the organisation.
What does evidence-based due diligence add on top of the paperwork?
Evidence-based due diligence connects supplier-provided documents with information that can be independently checked. It gives reviewers another way to test whether the relationship they are approving looks consistent with the evidence presented.
The value is strongest when external evidence is used for the questions it can answer: whether an asset is exposed, whether infrastructure changed, whether a technical connection exists, or whether observable posture contradicts a supplier statement. Internal controls, contractual rights and business criticality still require internal knowledge or supplier evidence.
This creates a more defensible decision record because the organisation can show both what the supplier declared and what it independently observed at the time of approval. The same external evidence can then continue after onboarding, helping the team identify changes that justify reassessment.
The nine-month-old due diligence test
Take a supplier due diligence pack that was approved nine months ago and ask one question: what in it is still true today?
The certificate may still be valid. The policy may still be current. The questionnaire may still describe the supplier accurately. But the service may have changed, a subprocessor may have been added, new infrastructure may be exposed, or your own integration with the supplier may now be deeper than it was at onboarding.
That does not make due diligence pointless. Due diligence gives you a defensible decision at a point in time. Assurance requires a process for checking whether the conditions behind that decision still hold.
For high-impact relationships, that means combining formal reassessment with continuous or event-driven monitoring, and reopening the risk decision when something material changes.
See how ThingsRecon adds continuous external evidence to supplier oversight with Supply Chain Intelligence.
