Due diligence checklist
Definition
Due diligence checklist
A due diligence checklist is the written list of what you verify about a counterparty before you sign. It spans finances, legal standing, security, staffing and references, so that no material fact is ever checked from memory or quietly taken on trust.
The checklist is a verification instrument, not a governance one. It covers the window that closes the moment ink hits paper. Everything after that belongs to vendor management outsourcing, which tracks a live supplier instead.
Most buyers run three passes — a desk check on public records, a formal document request, then a site or system walkthrough. Each pass is cheap to start and expensive to skip, and each one narrows what the next has to examine.
Key takeaways
- A due diligence checklist verifies a counterparty before signature, never after it.
- Finance, legal, operations, security and commercial are the five standing sections.
- Public records answer the cheapest questions, so run them before you request documents.
- Anything you cannot verify before signing becomes a contract clause or a reason to walk.
How it works
The checklist turns every assumption in a deal into a question with a documented answer. You give each question an owner, a source and a pass or fail mark, then review the failures together before anyone signs anything.
Public buyers formalise the same logic. Before award, a United States contracting officer must find a supplier responsible, which requires adequate financial resources and a satisfactory record of integrity under Federal Acquisition Regulation (FAR) Part 9.
| Section | What you verify | Typical evidence |
|---|---|---|
| Finance | Solvency, runway, concentration | Audited accounts, bank reference |
| Legal | Ownership, litigation, sanctions | Registry extract, counsel opinion |
| Operations | Capacity, attrition, subcontracting | Headcount report, site visit notes |
| Security | Data handling and access control | Certification, penetration test summary |
| Commercial | Price build, renewal and exit terms | Rate card, draft contract |
| People | Background screening, training records | Policy pack, sample personnel file |
Two items get skipped most often. The first is your right to look again later, which a right to audit clause secures. The second is regulated work, where compliance outsourcing rules decide what a supplier may touch at all.
Sequence matters as much as content. Public filings and registry searches cost almost nothing — so they go first and often kill a candidate before anyone writes a document request.
Scale the list to the risk, not to the deal size. A small supplier touching customer data deserves a deeper security section than a large one supplying office furniture, and most checklist failures come from getting that backwards.
Evidence has a shelf life. An audited account from two years ago and a certificate that expired last quarter prove nothing today, so every item needs a date beside it and a rule for how stale is too stale.
Deal size changes the depth, not the shape. Large mergers in the United States trigger a federal filing, and the parties may not close until the waiting period has passed — a pause the Federal Trade Commission (FTC) uses to review the transaction.
Examples
Three checklist shapes dominate in practice: supplier onboarding, acquisition diligence and regulated vendor review. They share sections but differ sharply in who signs off, how deep the evidence goes and how long that evidence stays valid.
A buyer onboarding an offshore contact centre asks for registration papers, labour compliance records, attrition by account and a folder of security certificates before the first pilot seat is staffed.
In manufacturing, the checklist lives inside the sourcing cycle. That is why procurement outsourcing teams keep one standing template and tune it per category rather than writing a fresh list for every deal.
On an acquisition the commercial section swells — the buyer is pricing a contract book. The list asks for total contract value per client, renewal dates, termination rights and any change of control consent.
Technology buyers add a code and access section. They want to see who can reach production, how joiners and leavers are handled, and whether subcontractors sit anywhere inside the delivery chain.
Banks invert the order. A regulated buyer reviewing an offshore supplier opens with security and legal, because a failure in either section ends the conversation long before price is ever discussed.
References are the section most people treat as a formality. Done properly, you call two clients the supplier did not nominate, and you ask what went wrong rather than what went well.
Repeat buyers keep a scoring sheet instead of a simple pass mark. Each section carries a weight, the weights reflect what has actually gone wrong before, and the total decides whether a deal reaches committee.
Small buyers run the same list shorter. Four sections, one reviewer and a two week clock still beat a handshake, and the discipline scales up later without a redesign.
Related terms
- Vendor management outsourcing: the governance that begins once the checklist is finished and the contract is live.
- Right to audit clause: the contract right to re-verify later what diligence verified once.
- Compliance outsourcing: regulated work where verification is a legal duty rather than good practice.
- Software audit tools: the tooling that evidences licence, access and usage claims a checklist asks about.
- Fixed price contract outsourcing: a pricing model whose risk sits in scope, so diligence weights delivery capacity.
FAQ
What should a due diligence checklist always include?
Finance, legal, operations, security and commercial terms. Anything you cannot evidence inside those five sections should turn into a contract clause before signature rather than a hope afterwards.
How long does due diligence usually take?
Supplier onboarding commonly runs two to six weeks. Acquisition diligence runs longer, because the document request and the legal review sit in sequence rather than side by side. Regulated reviews add weeks again, since approvals queue behind other work.
Who owns the checklist?
Procurement normally owns the template. Every section still needs a named reviewer with the authority to fail an item and stop the deal. Shared ownership with nobody named is how items quietly pass unchecked.
Is due diligence the same as an audit?
No. Diligence happens before signature and relies on what the counterparty chooses to hand over; an audit happens afterwards and relies on a contract right to look for yourself.
What if an item cannot be verified?
You either price that risk into the contract or walk away from the deal. Leaving the gap silent is the one choice that is never safe.
Shortlist verified providers in the Outsource Accelerator directory before you open talks.
Independent
