Supplier onboarding checklist
What to check before a new supplier goes live, and how much checking each supplier needs.
Onboarding is the point where you have the most leverage over a supplier. Once they are live and invoicing, it is much harder to ask for missing paperwork. A short, consistent checklist stops the gaps that auditors, insurers and fraudsters all look for.
Not every supplier needs every check. A one-off stationery order and a cloud provider holding your customer data are very different risks. Decide the tier first, then run the checks for that tier.
1. Before you start
- Is there a business need? Record who is asking for the supplier and why.
- Could an existing supplier do it? Adding suppliers you don't need adds cost and risk.
- Who owns the relationship? Name an internal owner before anything else happens.
- What tier is it? Value, how hard it would be to replace, and what data or systems it touches decide how deep the checks go.
2. Who are they?
- Legal name and company number. Check the company on the Companies House search service. It is free. Look at the status (active, or in liquidation), the registered office, the directors and whether accounts are overdue.
- VAT number, if they charge VAT. Make sure it belongs to the same business.
- Sanctions screening. Check the company and its owners against the UK sanctions list. Record the date and the result.
- Conflicts of interest. Ask whether anyone involved in choosing the supplier has a personal or financial link to it. Record a "none" answer too.
3. Can they deliver, and will they last?
- Financial health. For bigger or harder-to-replace suppliers, look at their latest filed accounts or a credit report.
- Insurance. Ask for certificates (public liability, professional indemnity, cyber where relevant) and note the expiry dates.
- Certifications. ISO 27001, Cyber Essentials or sector accreditations, with expiry dates.
4. Data protection and security
- Will they handle personal data? If yes, you need a written contract that meets UK GDPR Article 28. Our DPA checklist lists what it must cover.
- Where will the data be held? Note any transfers outside the UK.
- Security questionnaire. Keep it proportionate. A short questionnaire answered properly beats a long one ignored.
- Sub-processors. Ask who else will touch your data.
5. Terms and conduct
- Contract or terms agreed, including notice period and renewal terms. Put the key dates in your diary on day one.
- Supplier code of conduct signed: modern slavery, anti-bribery, environment and ethics.
6. Finance set-up and bank details
- Bank details on letterhead, then checked independently. See our penny test guide for the call-back, Confirmation of Payee and penny test steps.
- Payment terms, purchase order rules and cost centre agreed with finance.
- Set up in your finance system by someone other than the person who requested the supplier.
7. Sign-off
Every supplier should have a named person who approves it going live, including small, low-risk ones. Record who signed off, when, and what was checked. The approver should be more senior for higher tiers, and should not be the person who raised the request.
Keep it proportionate
| Tier | Typical checks |
|---|---|
| T4 Transactional supplier | Conflict of interest, sanctions, supplier set-up, bank detail checks, code of conduct |
| T3 Approved supplier | T4 checks plus financial viability, privacy assessment, security questionnaire, terms |
| T2 Key supplier | T3 checks plus enhanced due diligence, named owners on both sides, negotiated terms and SLAs |
| T1 Strategic partner | T2 checks plus executive sponsor, exit and continuity plan, concentration-risk review |
Doing this in SupplierVault
SupplierVault sets the checks for each supplier's tier, sends forms for suppliers to complete, tracks what is outstanding and records who signed off. Read more about supplier onboarding, or try it with example suppliers in the live demo.