What is the difference between vendor due diligence and vendor risk management?

Vendor due diligence is the upfront check you run when onboarding a new vendor — often once, before contract signature. Vendor risk management is the ongoing programme: tracking renewals, re-assessing high-risk vendors annually, and monitoring certificates and questionnaires over the life of the relationship. Due diligence is the front door; risk management is how you keep the house in order after they move in.

How long does vendor due diligence take for an SMB?

For a standard vendor without heavy data access, most SMB teams can complete meaningful due diligence in one to two weeks: send a short questionnaire, collect insurance and compliance documents, verify the company exists, and make a documented decision. High-risk vendors — those processing personal data or providing critical infrastructure — may need three to four weeks including reference calls. With VendorAuditly, the questionnaire sending and document tracking typically compresses the admin work into a few days.

What should be on a vendor due diligence checklist?

At minimum: business verification (legal registration, trading history), financial stability, data security (named security owner, relevant certifications, breach history), insurance (cyber liability, professional indemnity, certificates with expiry dates), and operational resilience (SLA, business continuity plan, subcontractor disclosure). GDPR requires a signed Data Processing Agreement for any vendor handling personal data. SOC2 and ISO27001 audits increasingly ask for evidence that you ran this checklist — not just that you trust the vendor.

Do SMBs need vendor due diligence for GDPR, DORA, and NIS2?

Yes, if your vendors handle personal data or provide critical services. GDPR makes you accountable for your processors' data handling — you cannot outsource liability. DORA (for financial services supply chains) and NIS2 (for essential and important entities) explicitly require documented third-party risk assessment. You do not need enterprise GRC software to comply; you need a repeatable process, dated evidence, and a named owner. That is exactly what a lightweight due diligence workflow provides.

How does VendorAuditly automate vendor due diligence?

VendorAuditly lets you send due diligence questionnaires by email, track when vendors open and complete them, store insurance certificates and compliance documents with automatic expiry alerts, and export an audit-ready package when a customer or auditor asks for proof. You tier vendors by risk, run deeper checks on high-risk suppliers, and get reminders before certificates lapse — so due diligence is not a one-time PDF in a folder but a living record.

Vendor Due Diligence: The Complete Guide for SMBs

Q: What is vendor due diligence?

Vendor due diligence is the work you do before signing with a supplier or service provider: checking who they are, whether they are financially stable, how they handle your data, what insurance they carry, and whether they can actually deliver. The goal is not a 200-page legal review — it is knowing what risks you are taking on before you commit, and having evidence on file if a customer or regulator asks later.

Enterprise customers and regulators are asking SMBs to prove they checked their vendors — not just signed a contract and hoped for the best. Vendor due diligence is how you answer that question before something goes wrong. This guide covers the process, the checklist, and how to run it without a legal team or a six-figure GRC platform.

Start your free vendor due diligence audit See the 7-step process

What Is Vendor Due Diligence — and Why It Matters Now

Vendor due diligence is the structured check you run on a supplier or service provider before you sign. It answers a simple question: is this vendor safe to work with? That means verifying they are a real business, financially stable enough for the contract term, capable of protecting data you share with them, and insured if something goes wrong.

For years, vendor due diligence was treated as an enterprise problem — something legal and procurement teams handled with 150-question questionnaires and months of review. That is changing. Under GDPR, you remain accountable for how your processors handle personal data. DORA requires financial services firms to document third-party ICT risk across their supply chain. NIS2 extends similar expectations to essential and important entities across the EU. Even if you are not directly regulated, your enterprise customers are — and they pass those requirements down to you through security questionnaires and vendor audits.

The good news: you do not need a compliance department to run meaningful due diligence. You need a repeatable process, a short checklist, and a place to store the evidence. That is what this guide — and tools like vendor risk management software — are built for.

The process

The Vendor Due Diligence Process: 7 Steps

This is the vendor due diligence process most SMB operations teams can run in one to two weeks per vendor — without outside consultants. Adapt depth to the tier: light touch for low-risk suppliers, full run for anyone with data access or operational criticality.

01
Define scope and tier the vendor
Before you send a single question, decide how much scrutiny this vendor deserves. High tier: handles personal data, critical to operations, or single-source. Medium: moderate spend, some data access. Low: commodity supplier with alternatives. Tiering stops you running a 50-question questionnaire on the office stationery supplier.
02
Verify the business exists
Check company registration (Companies House in the UK, state filings in the US), confirm the legal entity matches the contract, and note how long they have traded. A vendor that cannot provide a registration number or has been trading less than 12 months warrants extra financial checks.
03
Send a due diligence questionnaire
A focused questionnaire — 15 to 20 questions covering security, insurance, compliance, and operations — catches most real risk. Ask for named contacts, certification evidence, breach history, and subcontractor disclosure. VendorAuditly sends these by link so vendors complete them without creating an account, and you see responses in one dashboard.
04
Collect and verify documents
Request insurance certificates (not just confirmation they hold cover), compliance attestations (SOC2, ISO27001, Cyber Essentials as relevant), and a signed Data Processing Agreement if they process personal data under GDPR. Log expiry dates the day you receive them — not the day someone notices they lapsed.
05
Assess financial and operational risk
For high-tier vendors, check for county court judgements, customer concentration risk, and whether they have a business continuity plan. Ask what happens if their key person leaves. For SaaS vendors, confirm where data is stored and who has admin access to your account.
06
Document the decision
Record whether you onboarded, rejected, or requested more information — and why. This audit trail is what regulators and enterprise customers ask for. A one-line note in email is not enough; tie the decision to the questionnaire responses and documents on file.
07
Set a review schedule
Due diligence is not a one-time event. High-risk vendors: review quarterly, full re-assessment annually. Medium: annual review. Low: check on contract renewal. Automated expiry alerts mean you are not relying on calendar memory when an insurance certificate runs out mid-contract.

What to Include in a Vendor Due Diligence Checklist

A vendor due diligence checklist does not need 200 lines. It needs five domains, each with specific, verifiable items. Use this as your template — or send it directly through VendorAuditly as a questionnaire vendors complete online.

Business verification

Registered company name and registration number verified
Trading history confirmed (12+ months preferred for critical vendors)
Ownership structure understood
Two customer references checked (call, not email)

Financial stability

No recent county court judgements or bankruptcies
Not overly dependent on a single customer
Business continuity plan documented

Data security

Named person responsible for data security
Relevant certification (SOC2, ISO27001, or Cyber Essentials)
No material breach in the last three years
GDPR-compliant Data Processing Agreement signed

Insurance

Cyber liability insurance — minimum £1m / $1m
Professional indemnity insurance (for service providers)
Certificates received with expiry dates logged

Operations

SLA defined for critical services
Subcontractors disclosed and assessed
Incident response process documented

For security-specific questions, see our vendor security questionnaire templates. For ongoing monitoring after onboarding, pair this with supplier risk management.

VendorAuditly

How VendorAuditly Automates Vendor Due Diligence

Built for operations managers and COOs — not compliance teams with six-month implementation cycles.

Send questionnaires in one click

Email vendors a due diligence questionnaire they complete without creating an account. Track opens, completions, and missing answers from one dashboard — no chasing through forwarded threads.

Store documents with expiry tracking

Upload insurance certificates, DPAs, and compliance attestations. VendorAuditly extracts expiry dates and alerts you at 90, 60, 30, and 7 days — so renewals never depend on someone's memory.

Export audit-ready evidence

When an enterprise customer or auditor asks for proof, export a ZIP plus a readable summary showing what you collected, when, and what you decided. Third party due diligence evidence — without rebuilding the folder from email.

Most teams are running vendor due diligence in spreadsheets and email today. VendorAuditly replaces that with a single queue: who needs a questionnaire, whose insurance expires this month, and what is still missing before you can sign. Setup takes about ten minutes. Free to start on three vendors.