What is vendor due diligence?

Risk-based review before onboarding and periodically after: financials, security posture, compliance, concentration, and exit plan. Critical vendors get deeper review and contract controls.

What documents should we request?

Financials or viability proof, SOC 1/2 reports, pen-test summary, insurance, subprocessors, BCP/DR, and sanctions/regulatory standing.

How often to re-review?

Annually for critical, biennially for important, event-driven on breach, acquisition, or service change.

Who approves vendors?

Requester plus finance plus security/privacy for data-touching vendors, with independent payment setup — never requester-only.

Vendor Due Diligence Checklist 2026: Financial, Security, and Compliance Review

Tiering

Tier	Example	Review
Critical	Bank, payroll, ERP	Full + SOC + BCP test
Important	Expense, tax engine	Standard + SOC
Low	Office supplies	Basic + terms

Pair with SOC 1 vs SOC 2, NIST, PCI, and Procurement Fraud.

Checklist

Financial viability + concentration check.
SOC reports reviewed, gaps tracked — see SOX 404.
Data map + DPA + subprocessor review — see GDPR.
Sanctions + license verification.
Contract: SLA, audit rights, exit + data return.
Payment setup via callback, segregated from request — see AP Fraud and QuickBooks vs Xero.

File packet in Month-End Close vendor file; report themes to Audit Committee.

Monitoring

Annual re-cert + incident notice test.
Scorecard: uptime, support, findings closure.
Exit drill for critical vendors yearly.

SOC Report Review (What to Actually Read)

Most teams file the SOC report without reading it. Read these five sections:

Opinion and period. Qualified opinion or gap in coverage period = follow-up, not filing. A 9-month-old report with no bridge letter leaves a quarter uncovered.
Complementary user-entity controls (CUECs). The auditor explicitly assigns controls to you (e.g., “user reviews payroll preview”). Map each CUEC to an owner and test it — untested CUECs void reliance — see SOX 404.
Exceptions and deviations. Note each, assess impact on your data, and track remediation with the vendor. Repeat exceptions year-over-year escalate tier.
Subservice organizations. If the vendor carves out its cloud/hosting provider, you inherit that gap — request the subservice SOC or document acceptance.
System description changes. New data centers, AI features, or subprocessors since last review trigger re-scoping of your DPA and transfer assessment — see GDPR.

File the review memo (report date, period, CUECs mapped, exceptions disposition, reviewer sign) in the vendor packet — it is the workpaper that satisfies PBC and Audit Procedures.

Concentration and Exit Risk

Score two questions annually: (1) if this vendor failed tomorrow, how many days until we operate? (2) how do we get our data out? Payroll, GL, and banking vendors with no tested exit plan are single points of failure regardless of SOC cleanliness. Require data-export formats and frequencies in the contract (monthly full exports for critical systems), test a restore or migration drill yearly, and keep the runbook where Month-End Close can find it during an outage — see NIST recover function.

Concentration also means commercial leverage risk: a vendor holding 40% of opex with auto-renewal and 90-day termination notice owns your budget cycle. Calendar renewals 120 days out with a market check, and tie approval to the AP Fraud segregation (requester proposes renewal, finance approves).