Supplier Due Diligence: A Practical Guide to Assessing Risks Before Contracting

This question seems simple, but it can reveal a number of risks.

A supplier may have access to confidential information, personal data, systems, customers, financial processes, or activities critical to operations.

The candidate may also have a history of financial problems, conflicts of interest, sanctions, relevant legal proceedings, or other circumstances that should be disclosed prior to hiring.

It is in this context that the Supplier Due Diligence.

Due diligence is a process of investigation and evaluation that allows an organization to better understand its potential business partners and identify risks before entering into a business relationship.

More than just a background check, a well-structured due diligence process helps answer a key question:

“Does this supplier pose an acceptable risk to my company?”

In this guide, you’ll learn what supplier due diligence is, what should be analyzed, what the main red flags are, and how to structure an efficient process.

What is Supplier Due Diligence?

Supplier Due Diligence It is the assessment process conducted before or during a business relationship to identify information and situations that may pose risks to the organization.

The process may involve analyzing:

• Registration information;
• Corporate structure;
• Members and directors;
• Final beneficiaries;
• Business history;
• Sanctions;
• Relevant legal proceedings;
• Relationships with public officials;
• Conflicts of interest;
• Integrity policies;
• Information security;
• Data protection;
• Financial capacity;
• Reputation.

The Office of the Comptroller General recommends implementing appropriate safeguards for the hiring and oversight of suppliers, service providers, intermediaries, and associates, especially in situations involving a higher risk to integrity. :contentReference[oaicite:1]{index=1}

The goal is not to completely eliminate the risk.

The goal is to understand, assess, and make an informed decision about the risk.

Why Conduct Supplier Due Diligence?

A contract can have consequences that extend far beyond the contract's financial value.

Depending on the supplier, the company may take on risks:

• Financial;
• Operational;
• Regulatory;
• Reputational;
• Corruption;
• Fraud;
• Information security;
• Data protection;
• Business continuity.

Proper due diligence helps identify these risks before a business relationship is established or renewed.

The CGU itself points out that due diligence practices are part of the integrity measures recommended for relationships with partners and service providers. :contentReference[oaicite:2]{index=2}

Due diligence does not mean investigating all suppliers in the same way

This is one of the most important principles of effective third-party management.

An organization may have hundreds or thousands of suppliers.

It would be inefficient to conduct an extremely thorough investigation into all of them.

Therefore, the recommendation is to adopt a risk-based approach.

The CGU also recommends that third parties be classified by risk level and that the scope of the due diligence be proportional to that classification. :contentReference[oaicite:3]{index=3}

When Should You Conduct Due Diligence?

Due diligence can be conducted at various stages of the supplier relationship cycle.

Before Hiring

This is the most important time to identify risks before committing to the relationship.

During the hiring process

Additional information may be requested before the final signing.

Upon contract renewal

The supplier's risk may have changed since the original contract was signed.

Following significant events

A change in corporate structure, a security incident, a penalty, or a significant change in service may warrant a reassessment.

Periodically

Suppliers classified as high risk may need to be reassessed more frequently.

Due diligence should not be treated as a snapshot taken on the day the contract is signed.

It must be part of the third's life cycle.

What Should Be Analyzed During a Supplier Due Diligence?

1. Company Information

The first step is to verify who the supplier is.

Some basic information includes:

• Company name;
• Trade name;
• CNPJ;
• Address;
• Economic activity;
• Duration;
• Legal representatives.

This step may seem simple, but it is essential to ensure that all other searches are conducted on the correct entity.

2. Corporate Structure

Knowing who controls the company helps identify potential conflicts and risks.

Depending on the case, the assessment may take into account:

• Members;
• Administrators;
• Final beneficiaries;
• Related companies;
• Significant corporate changes.

The greater the risk involved in the relationship, the more important this analysis becomes.

3. Integrity History

A due diligence review can assess whether there is any relevant public information regarding the integrity of the supplier or its key officials.

Depending on the context, the following may be analyzed:

• Sanctions;
• Public investigations;
• Cases of corruption;
• Fraud;
• Irregularities;
• Relevant cases.

The CGU recommends verifying, prior to hiring, whether the individual or legal entity has a history of involvement in acts harmful to the government. :contentReference[oaicite:4]{index=4}

4. Relationships with Public Officials

This point may be particularly important for suppliers involved in activities related to the public sector.

It is possible to assess whether the supplier or related parties have ties that could increase the risk of conflicts of interest or corruption.

The relevance of this analysis depends on the industry, the contract, and the type of relationship.

5. Financial Capacity

A financially vulnerable supplier can pose a significant operational risk.

Depending on the criticality of the contract, the company may evaluate:

• Financial health;
• Recovery history;
• Indebtedness;
• Reliance on a small number of customers;
• Ability to continue.

The goal is to determine whether the supplier is capable of continuing to provide the service throughout the contract period.

6. Information Security

If the supplier has access to the company's systems or information, the assessment must take into account its ability to protect those assets.

Some important questions:

• How is access controlled?
• Are there any security policies?
• How are incidents handled?
• Is there a vulnerability management system in place?
• Are there any backups?
• Is there a business continuity plan?
• Are there controls in place for subcontractors?

The greater the supplier's access, the more in-depth this analysis should be.

7. Protection of Personal Data

When a third party processes personal data, the organization must also assess the privacy-related risks.

Some of the points to consider include:

• Types of data processed;
• Purpose of the processing;
• Data volume;
• Data location;
• Safety controls;
• Incident management;
• Outsourcing;
• Deletion or return of data.

The evaluation must be consistent with the role played by each party and the requirements applicable to the relationship.

8. Integrity Program

A relevant question for higher-risk suppliers is:

“Does this supplier have its own mechanisms for preventing and detecting irregularities?”

The assessment may take into account the existence of:

• Code of Conduct;
• Anti-Corruption Policy;
• Whistleblower Channel;
• Training;
• Internal controls;
• Risk management;
• Monitoring.

The CGU recommends verifying, where applicable, whether the contracted company has an Integrity Program capable of reducing the risk of irregularities. :contentReference[oaicite:5]{index=5}

What Are Red Flags in Due Diligence?

Red Flags These are red flags that may indicate the need for further investigation before hiring or retaining a supplier.

Some examples include:

• A corporate structure that lacks transparency;
• Contradictory information;
• Significant history of sanctions;
• Unclear relationships with public officials;
• Refusal to provide information;
• Inconsistent documentation;
• Unusual business conditions;
• Use of intermediaries without a clear justification;
• History of corruption or fraud;
• Recurring security issues.

A Red Flag does not necessarily mean that the supplier should be rejected.

It means that the company needs to investigate the matter further before making a decision.

The CGU recommends that the formal due diligence process identify situations that require further investigation and establish how such situations will be handled. :contentReference[oaicite:6]{index=6}

Supplier Due Diligence Checklist

The checklist below can serve as a starting point for structuring an evaluation.

How should the due diligence results be classified?

After the analysis, the company needs to turn the information it has gathered into a decision.

A simple classification system can use three levels:

The decision must be documented.

This makes it possible to demonstrate later what information was analyzed, what risks were identified, and why the organization decided whether or not to hire the supplier.

What should you do when a red flag is identified?

Finding a red flag does not automatically mean ending the negotiation.

The first step is to understand the context.

The company may:

1. Identify the information;
2. Validate the source;
3. Assess the relevance;
4. Request clarification;
5. Conduct a more in-depth investigation;
6. Evaluate compensating controls;
7. Submit the case for appropriate approval;
8. Document the decision.

Depending on the risk, the organization may decide to:

• Approve;
• Approve with conditions;
• Request additional controls;
• Postpone the hiring;
• Reject the supplier.

The important thing is that the decision be based on criteria and properly documented.

How to Document a Due Diligence Process?

Due diligence without documentation loses much of its value.

The organization must be able to demonstrate:

• When was the assessment conducted?;
• Who organized it;
• What information was analyzed;
• What documents were used;
• What red flags were identified;
• What was the level of risk;
• Who approved it;
• What was the decision?

The CGU recommends formalizing the process and documenting the due diligence reviews conducted, their results, and the decisions made. :contentReference[oaicite:7]{index=7}

Does the contract need to include a due diligence clause?

The pre-hire assessment must be supplemented by appropriate contractual mechanisms.

Depending on the risk, the contract may establish obligations related to:

• Compliance;
• Anti-corruption;
• Confidentiality;
• Data protection;
• Information security;
• Auditing;
• Incident reporting;
• Outsourcing;
• Termination.

The CGU recommends, among other measures, that contracts with third parties include integrity commitments, provisions for audits, and contractual consequences for certain violations. :contentReference[oaicite:8]{index=8}

Due Diligence and Ongoing Monitoring

One of the biggest mistakes is to consider due diligence complete after the contract is signed.

Imagine that a supplier was classified as low risk two years ago.

Today, he can:

• To have changed control;
• Having begun to process personal data;
• To have experienced an incident;
• Having received a penalty;
• To have changed its business model;
• Has started using new subcontractors.

The risk has changed.

Therefore, the organization must establish criteria for re-evaluate suppliers throughout the relationship cycle.

How to Create a Due Diligence Policy?

A policy can establish the main rules of the process.

She can set:

• Objective;
• Scope;
• Types of third parties covered;
• Classification criteria;
• Levels of diligence;
• Responsibilities;
• Red Flags;
• Approval criteria;
• Documentation;
• Frequency of reassessment;
• Monitoring;
• Exceptions.

This reduces subjective decisions and increases the consistency of the process.

How can you automate supplier due diligence?

When a company has only a few suppliers, manual controls may seem sufficient.

As the user base grows, however, it becomes more difficult to manage:

• Deadlines;
• Documents;
• Reviews;
• Questionnaires;
• Risks;
• Revaluations;
• Action plans;
• Approvals.

A GRC platform can centralize this information and enable the company to track the supplier's lifecycle.

Instead of having information scattered across spreadsheets and emails, the organization can work with a structured workflow:

Registration → Classification → Due Diligence → Approval → Contracting → Monitoring → Reevaluation

How Does Triskle Help with Due Diligence?

A Triskle GRC It allows you to centralize risk management, compliance, controls, documentation, and action plans on a single platform.

When it comes to managing third parties, this structure can help the organization:

• Organize supplier information;
• Classify third parties by risk;
• Record evaluations;
• Centralize evidence;
• Document decisions;
• Track pending items;
• Create action plans;
• Monitor reassessments;
• Monitor indicators;
• Raise awareness of management.

The goal is to transform due diligence from a one-time activity into a ongoing third-party risk management process.

Frequently Asked Questions About Supplier Due Diligence

What is Supplier Due Diligence?

It is the process of investigation and assessment used to identify risks before or during a relationship with suppliers and other third parties.

When Should You Conduct Due Diligence?

Primarily before contracting, but also during contract renewals and after significant events. Higher-risk suppliers may be reassessed periodically.

What Should Be Analyzed During Due Diligence?

Depending on the risk, the following may be analyzed: registration data, corporate structure, ultimate beneficiaries, history, sanctions, conflicts of interest, financial capacity, integrity, information security, and data protection.

Do all suppliers have to undergo due diligence?

The scope of the assessment should be proportional to the risk. Low-risk suppliers may undergo simplified checks, while critical third parties may require in-depth due diligence.

What Are Red Flags?

These are warning signs that indicate a particular situation warrants further investigation before a decision is made.

Is due diligence mandatory?

The necessity and scope of these measures depend on the context, sector, applicable legislation, and risk profile. Within the scope of integrity programs, the CGU recommends appropriate measures when contracting and supervising third parties, especially in high-risk situations. :contentReference[oaicite:9]{index=9}

How long does due diligence take?

There is no single timeframe. The duration depends on the depth of the assessment, the supplier’s profile, the availability of documents, and the level of risk identified.

How do you document a due diligence process?

The process must maintain records of the information analyzed, evidence, red flags, risk classification, responsible parties, and the decision made.

Hiring a supplier means entering into a relationship and, consequently, assuming a certain level of risk.

Due diligence allows this decision to be made with more information and less uncertainty.

The goal is not to find “perfect” suppliers.

It involves identifying significant risks before they become problems for the organization.

A mature structure connects:

Supplier → Due Diligence → Risk → Control → Evidence → Decision → Monitoring

This approach transforms supplier evaluation into a strategic tool for governance and risk management.

When the process still relies on spreadsheets, emails, and scattered documents, the company may lose visibility precisely when it needs it most.

Knowing your suppliers means understanding some of the risks involved in your own business.

REQUEST A DEMO →