Supplier due diligence questionnaire

Templates are guides only. Adapt the questions to your own policies and risks, and check them with your legal team before use. This is not legal advice.

A supplier due diligence questionnaire asks a supplier to tell you, in writing, about the things that could hurt you if they went wrong: who owns them, whether they'll stay in business, how they protect your data, and how they treat people. The questions below are grouped by topic. Send only the sections that fit the supplier's tier and what they will do for you.

Which sections to send

Not sure of the tier? Try the supplier risk tier calculator.

A. Company and ownership

1. Full legal name, company number and registered address.
2. Who are your ultimate owners or people with significant control? Are you part of a group? If so, name the parent company.
3. How long have you been trading, and how many staff do you have?
4. Will any part of the work be subcontracted? If so, to whom, and for what?
5. Do any of your owners, directors or staff have a personal or business link to our organisation or our staff?

B. Financial standing

1. Please provide your last two years' accounts, or a link to them on Companies House.
2. Are you, or any group company, subject to insolvency proceedings, a winding-up petition or a county court judgment?
3. What proportion of your turnover would our contract represent?
4. Do you hold the insurance we require? Please send certificates showing cover amounts and expiry dates.

Check what you can yourself: filed accounts, overdue filings and insolvency notices are free to look up on Companies House and The Gazette.

C. Legal, sanctions and conduct

1. Are you, your owners or your directors named on the UK Sanctions List, or owned or controlled by anyone who is?
2. In the last five years, have you or your directors been convicted of, or investigated for, fraud, bribery, corruption, money laundering, tax evasion or modern slavery offences?
3. Do you have procedures to prevent bribery by people acting for you? (Organisations can commit an offence under section 7 of the Bribery Act 2010 if they fail to prevent bribery and don't have adequate procedures.)
4. Do you have procedures to prevent the facilitation of tax evasion, and, if you're a large organisation, to prevent fraud by people acting for you? (The failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023 applies to large organisations.)
5. Is there any current or threatened legal action that could affect your ability to deliver?
6. Will you accept our supplier code of conduct?

D. Information security

1. Do you hold Cyber Essentials, Cyber Essentials Plus, ISO 27001 or a SOC 2 report? Please send the certificate or report and its scope and expiry date.
2. Do all staff and administrators use multi-factor authentication for email and remote access?
3. How quickly do you apply security updates to systems that hold our data?
4. How is our data encrypted in transit and at rest?
5. Where will our data be stored and accessed from, including by your subcontractors?
6. How and when will you tell us about a security incident that affects our data or service?
7. Have you had a security incident in the last three years that affected customer data? What did you change afterwards?
8. How do you check the security of your own suppliers?

E. Data protection

1. What personal data will you process for us, and for what purpose?
2. Have you paid the data protection fee to the Information Commissioner's Office? (Most organisations that process personal data must pay it unless exempt.) Please give your registration number.
3. Will you sign a data processing agreement that meets UK GDPR Article 28? See our DPA checklist.
4. Which sub-processors will you use, and where are they?
5. Will any personal data be transferred outside the UK? If so, under which transfer mechanism?
6. How will you return or delete our data at the end of the contract?

F. Business continuity

1. Do you have a business continuity and disaster recovery plan covering the services you'll provide us? When was it last tested?
2. What are your recovery time and recovery point targets for these services?
3. Do you depend on any single supplier, site or person for the service you'll provide us?
4. Would you support an orderly exit and handover if our contract ended?

G. People, ethics and environment

1. If your turnover is £36 million or more, please link to your latest modern slavery statement. Our modern slavery statement checker explains who needs one.
2. How do you check that workers in your supply chain are paid fairly and free to leave their jobs?
3. Do you pay at least the National Minimum Wage or National Living Wage to everyone working on our contract? Are you an accredited Real Living Wage employer?
4. Do you have an equality, diversity and inclusion policy?
5. Do you have a net zero commitment or a carbon reduction plan? (Central government buyers ask for a carbon reduction plan on some larger contracts.)

H. Health and safety

1. Please send your health and safety policy (required in writing if you employ five or more people).
2. For work on our premises, will you provide risk assessments and method statements before work starts?
3. Do your staff hold the qualifications or registrations the work needs (for example Gas Safe, CSCS or SIA)?
4. Have you had any reportable incidents or enforcement action in the last three years?
5. Do staff working with children or vulnerable adults have the right level of DBS check?

I. Use of AI

1. Will you use AI tools to deliver the work or to process our data? Which tools, and for what?
2. Will our data be used to train any AI model, by you or by your AI provider?
3. Will a person check AI-produced work before it reaches us?

After the answers come back

• Check the evidence, not just the answer. A "yes" to Cyber Essentials should come with a certificate in date.
• Record follow-up questions and the supplier's replies.
• Decide whether any gaps are acceptable, need a contract clause, or rule the supplier out, and record who decided.
• Set a date to ask again: certificates expire and suppliers change.

Templates are guides only. Adapt the questions to your own policies and risks, and check them with your legal team before use. This is not legal advice.