A vendor due diligence checklist lists the checks you run on a supplier's legal standing, finances, security, operations and reputation before you sign a contract or onboard them, with who checked each item and what evidence they saw.
Updated 13 Oct 2026 · Reviewed by the Spendflo procurement team
Pick the vendor's risk tier, then work through the checks it needs. Open any check to see the evidence to request and the red flag that should stop approval.
Get the vendor due diligence checklist as an Excel tracker with owners, status drop-downs and a progress score.
Vendor due diligence is how a company assesses a third party's legal, financial, operational and security risk before signing a contract or onboarding the supplier, so it knows the vendor is real, stable, secure and able to keep delivering.
Procurement usually owns the review and hands each risk area to a specialist: security takes the data checks, finance the accounts and bank details, legal the contract. It happens before signature, while the deal is unsigned and you can still ask for changes, and repeats at renewal for vendors that hold sensitive data.
The depth should match the risk. A one-off stationery order needs a handful of checks; a payroll provider holding employee data needs every one, which is why this due diligence vendor checklist comes with risk tiers.
A complete checklist covers eight risk areas, and each one answers a different question about the vendor.
| Risk area | The question it answers | Usual owner |
|---|---|---|
| Company and legal | Is this a real, properly owned and licensed business? | Procurement |
| Financial health | Will the vendor still be here next year, is it insured, and are we paying the right bank account? | Finance |
| Security and data privacy | Will our data be protected, and will we hear quickly if it is not? | Security |
| Compliance | Are there sanctions, bribery or regulatory problems? | Compliance |
| Operational resilience | Can the vendor recover from an outage and support us? | Business owner |
| Reputation and ESG | What do customers, the press and public records say? | Compliance |
| Fourth parties and insurance | Who else touches our data, and is the vendor insured? | Security, Finance |
| Commercial and contract | Is the price fair, and can we audit, renew or exit on our terms? | Procurement, Legal |
Send these questions on day one and ask for a document behind every answer. They map to the checklist above, so answers drop straight into the evidence column.
When answers come back, use the questionnaire as a vendor review checklist: every security claim has a dated document behind it, names and owners match public records, and any gap is written into the contract as a condition with a deadline.
Software vendors add risks a goods supplier never has. Add these ten checks to turn the core list into a SaaS vendor due diligence checklist.
When a tool sends your data to a model, ask about training, retention, model changes and who is liable for wrong outputs. Put the answers in the contract.
Download the vendor due diligence checklist so every owner can work their own rows in Excel or Google Sheets, with status and dates.
For suppliers that make, ship or handle physical goods, add quality, supply chain and ethical sourcing checks to the core list.
Use this vendor screening checklist on the long list. It takes under an hour per vendor, and a hard fail ends the review.
The same screen works as a supplier vetting checklist for goods and services suppliers.
Set the tier at intake from three facts: data access, annual spend and how hard the vendor would be to replace. The tier decides the depth of the review and how often it repeats.
Holds sensitive data, runs a core process or takes a large share of spend.
Evidence on file for every check
Limited data access or moderate spend.
Skip the Tier 1-only checks
No data access, low spend and easy to replace.
Plus the 15-point vetting screen
Each step has one owner and one output, so no vendor reaches signature with checks still open.
Log the request and set the tier at intake.
Send the questionnaire and ask for every document at once.
Owners mark each check Done or Flagged.
Approve, approve with fixes in the contract, or reject.
Repeat on the tier's cycle or after a trigger.
Here is what a completed checklist looks like for a Tier 1 payroll vendor, with the two flagged checks and the decision they led to. The companies and figures are illustrative.
| Check | Owner | Evidence received | Status |
|---|---|---|---|
| Legal entity confirmed | Procurement | Registry extract, 2 Sep | Done |
| Bank details verified by call-back | Finance | Called number on registry, 4 Sep | Done |
| Security certification in date | Security | SOC 2 Type I only, dated Mar | Flagged |
| Incident response plan and notice time | Security | DPA silent on breach notice | Flagged |
| Sanctions and watchlist screening | Compliance | No match, 2 Sep | Done |
| Liability cap reviewed | Legal | Cap at 2x annual fees | Done |
+ 38 more checks done, evidence filed
The same 44 checks, the questionnaire and every part on this page, ready to fill in. Free, no credit card.
FreeNo credit cardWork email only
| # | Check | Owner | Status |
|---|---|---|---|
| 1 | Legal entity, registration number and registered address confirmed | Procurement | Done |
| 2 | Ultimate beneficial owners identified | Procurement | In progress |
| 3 | Tax ID and tax forms on file | Finance | Flagged |
| 4 | Required business licences current | Procurement | Done |
Vendor due diligence covers the vendor's legal identity, financial health, security and data privacy, compliance, operational resilience, reputation, fourth parties and contract terms. The free download groups these into 44 checks with an owner and evidence for each.
Each line should name the check, who owns it, the evidence to collect and the red flag that stops approval. You can download this one in Excel, Google Sheets or PDF and cut it down by risk tier.
A vendor checklist is a list of the checks and documents a company needs before it approves or keeps working with a supplier. This page's download covers due diligence, with 44 checks across legal, financial, security, operational and reputational risk.
It is the set of questions you send a vendor so they can supply answers and documents before you assess them. The 20 questions above are included as a separate sheet in the download.
You can download the vendor due diligence checklist as a PDF, an Excel file or a Google Sheet from this page. Every version includes the questionnaire and the AI, SaaS and supplier checks.
Run due diligence where the request starts
Spendflo collects vendor documents at intake, routes approvals, onboards suppliers and tracks third-party risk after signature. Spendflo has handled 15,000+ agreements.
Enter your work email and your download starts straight away.
Need another format? Pick one below.
Google Sheets: upload the Excel file to Drive and open it with Google Sheets.
