What due diligence is for
Vendor or third-party due diligence is the investigation you do before (and when renewing) a relationship, to confirm the other party can do the work safely, legally and reliably. It sits between planning and contracting in the third-party life cycle. Its findings decide whether to proceed, on what terms and with what monitoring.
Due diligence is broader than a security questionnaire. It covers who the third party is, whether it is financially sound, whether it complies with law, whether it can protect your data and keep running, and whom it depends on.
The 14 factors in US interagency guidance
The 2023 Interagency Guidance on Third-Party Relationships, issued by the Federal Reserve, FDIC and OCC, lists factors to consider “depending on the degree of risk and complexity.” They make a useful checklist for any industry:
| # | Factor | Typical evidence |
|---|---|---|
| 1 | Business strategy and goals | Company overview, plans affecting the service |
| 2 | Compliance with laws and regulations | Licenses, compliance program, regulatory actions, litigation |
| 3 | Financial condition | Audited financial statements, credit reports |
| 4 | Track record and experience | References, years in business, client base |
| 5 | Key personnel qualifications and backgrounds | Management bios, background check policy |
| 6 | Internal risk management | Risk and audit functions, policies |
| 7 | Information security | SOC 2, ISO/IEC 27001, security policies |
| 8 | Management of information systems | Architecture, change management |
| 9 | Operational resilience | Business continuity and disaster recovery plans and tests |
| 10 | Incident reporting and management | Incident response plan, notification commitments |
| 11 | Physical security | Site controls, where relevant |
| 12 | Reliance on subcontractors | Subcontractor list and oversight |
| 13 | Insurance coverage | Certificates of insurance |
| 14 | Contractual arrangements with other parties | Conflicts, exclusivity, dependencies |
The guidance also says that when information is unavailable, “it is important for the banking organization to identify and document any limitations of its due diligence.”
Integrity, sanctions and compliance screening
Security and operations are not the only risks. Screen for:
- Sanctions. OFAC’s Framework for OFAC Compliance Commitments names “improper or incomplete due diligence” among root causes of violations and says due diligence on customers, supply chain, intermediaries and counterparties is fundamental to an effective risk assessment.
- Ownership. Who ultimately owns or controls the third party.
- Adverse media and litigation. Fraud, corruption, data breaches, regulatory actions.
- Regulatory status. Licenses, enforcement actions and, in regulated industries, inspection history (for example FDA warning letters for a life sciences supplier).
- Anti-corruption risk. Especially for agents, distributors and intermediaries dealing with government officials.
The DOJ’s September 2024 update to its Evaluation of Corporate Compliance Programs asks whether third-party risk management “allows for the review of vendors in a timely manner” and whether the company uses available data to evaluate vendor risk during the relationship, according to Gibson Dunn.
Scaling due diligence to risk
| Tier | Due diligence scope |
|---|---|
| Critical / high | All relevant factors; document review; independent reports; possibly onsite or remote audit; senior approval |
| Moderate | Core factors; questionnaire with key evidence; standard approval |
| Low | Identity, sanctions screening, basic questionnaire |
Verifying what you collect
Collecting documents is not the same as checking them. For each key document, confirm:
- The legal entity matches the one you are contracting with
- Dates are current (certificates, insurance, SOC report periods)
- Scope covers the services and locations you use
- Statements are consistent across documents (for example data locations in the questionnaire, SOC report and contract)
- Exceptions, qualifications and exclusions are understood
Most due diligence failures are not missing documents. They are documents that were filed but never compared with each other.
Common weaknesses
- Due diligence done after the business has already committed
- The same checklist for every third party
- Sanctions screening at onboarding only
- Entity names that do not match across documents
- Limitations not documented
- Findings not carried into contract terms
Vendor due diligence checklist
- Risk tier set before due diligence starts
- Relevant interagency factors covered for the tier
- Sanctions, ownership and adverse media screening completed
- Regulatory status checked where relevant
- Documents verified for entity, dates, scope and consistency
- Limitations of due diligence documented
- Findings translated into contract terms
- Re-screening and refresh schedule set
Review due diligence files with AskDona
Due diligence files are long and repetitive: financials, certificates, policies, SOC reports, insurance, questionnaires. AskDona reads them together against your due diligence criteria, flags expired documents, entity mismatches, scope gaps and statements that conflict across files, and links each finding to the page it came from. Run a sample due diligence file review on one new vendor. AskDona shows the evidence; your team decides.
FAQ
What is vendor due diligence? The investigation of a vendor before and during a relationship to confirm it can perform safely, legally and reliably.
What is the difference between due diligence and a risk assessment? Due diligence gathers and verifies facts about the third party; the risk assessment uses those facts to rate the risk and decide.
What documents are needed for vendor due diligence? Typically company and ownership information, financial statements, licenses, security reports such as SOC 2, policies, business continuity plans, insurance certificates and a subcontractor list, scaled to risk.
How often should due diligence be refreshed? At renewal, on a schedule by tier, and when something significant changes, such as ownership, a breach or a regulatory action.
Does due diligence apply to existing vendors? Yes. Ongoing monitoring and periodic refresh are part of the life cycle.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| Federal Register, Interagency Guidance on Third-Party Relationships | US guidance | 14 due diligence factors; limitations |
| Federal Reserve, interagency guidance press release (June 6, 2023) | US regulator | Agencies and date |
| OFAC, A Framework for OFAC Compliance Commitments | US Treasury guidance | Sanctions due diligence |
| Gibson Dunn, DOJ updates ECCP (Sept 2024) | Law firm client alert | Timely vendor review |