Supplier due diligence: a practical framework for procurement teams

The problem with one-size-fits-all checks

Procurement teams that try to apply the same diligence to every supplier end up doing too much for low-value relationships and too little for the ones that actually carry risk. The right answer is tiered: a small amount of verification on every supplier, more on those with material exposure, full investigation on the ones whose failure would meaningfully damage the business.

The framework below sets out three tiers, what each one should contain, and where the standard public-record checks need to be supplemented by a freshly investigated report. It is deliberately practical, the kind of thing that fits on one page of a procurement policy.

How to tier a supplier base

Tiering should be based on exposure, not on order size in isolation. A small recurring spend with a sole-source supplier of a critical input carries more risk than a one-off large order with a replaceable commodity vendor. The questions that matter:

• Replaceability — could the same input be sourced elsewhere within an acceptable timeframe?
• Credit exposure — annual spend, payment terms, and committed forward commitments
• Operational criticality — does this supplier's failure stop your production line or service delivery?
• Regulatory exposure — sanctions, export controls, modern slavery, ESG, data protection
• Reputational exposure — adverse media risk, brand association, customer-facing involvement

Tier 1 · Light-touch verification

For replaceable, low-value, short-term supplier relationships.

The goal at this tier is to confirm the counterparty is a real legal entity and is currently trading. It is not to build a full picture; it is to weed out the obvious. Checks:

• Registry confirmation that the entity exists and is in active status
• Match between the legal entity name and the bank account on the invoice
• Sanctions list screening (where applicable to the jurisdiction)
• A documented record of who checked, when, and what the result was

For most established markets (UK, EU, US, Australia) Tier 1 can be done from public sources in an hour. For markets with less accessible registers, even Tier 1 may need a paid report.

Tier 2 · Standard due diligence

For ongoing supplier relationships with material credit exposure, where failure would cause real disruption but not existential damage.

The goal here is to assess financial standing, trading legitimacy and counterparty risk well enough to support credit terms and a multi-year relationship. Checks build on Tier 1 and add:

• Financial position — most recent filed accounts, trend, credit rating, calculated credit limit
• Directors and shareholders, including disqualifications and obvious red flags
• Court and enforcement record check at higher court level
• Adverse media check in both English and the local language
• Insurance and certification verification where relevant (ISO, sector-specific accreditations)
• A signed supplier questionnaire covering UBO, sanctions, modern slavery, anti-bribery

For most international markets, this is the point at which a freshly investigated company report is the efficient way to gather Tier 2 evidence. The work is already being done: sourcing it from a single in-country agent is both cheaper and more reliable than fragmenting it across multiple free portals in a language no one on the procurement team reads.

Tier 3 · Enhanced due diligence

For strategic, sole-source, high-value, or politically and regulatorily exposed supplier relationships.

At this tier, the standard report is the starting point, not the end. Tier 3 work extends to:

• Ultimate beneficial ownership traced through layered structures and offshore vehicles
• Politically exposed person (PEP) screening on owners, directors and key personnel
• On-site premises verification — confirmation the operating site is real and operating at the claimed scale
• Trade references from named, contactable bankers and customers
• Litigation searches extended to lower courts, tribunals and regulatory enforcement
• Country-specific risk overlays — sanctions, export controls, sectoral restrictions
• Periodic refresh, with a documented review cycle of typically twelve to twenty-four months

Enhanced diligence is not a one-off. The relationship's risk profile changes with time, ownership and regulation; the file needs to keep up.

What to keep on file

A common procurement failure isn't doing too little diligence: it's doing the work and then not being able to evidence it later. For every supplier above Tier 1, the file should contain:

• A dated record of the checks performed and the sources used
• The underlying documents — registry extracts, the company report PDF, signed declarations
• Identification of who within the team approved the supplier and on what basis
• A documented exception, with sign-off, where any standard check was waived
• A scheduled review date proportionate to the tier

Where a company credit report fits in this framework

A freshly investigated company report is the single most efficient instrument for Tier 2 due diligence, and the foundation document for Tier 3. It combines financial standing, ownership and director investigation, legal and adverse-media checks, and a structured risk assessment in one document, researched in-country, delivered in English, suitable for direct inclusion in the supplier file.

Reports are available on companies in over 200 countries, with online instant reports for selected markets and freshly investigated reports for everywhere else. Turnaround starts at two working days for express investigations.