Third-Party Due Diligence: What Enterprises Must Check Before Signing

You're two weeks from signing a multi-million-dollar contract with a new supplier in Vietnam. The price is 18% below your current vendor, and the sales director has been responsive. But a quick check of the company registry reveals the entity was incorporated only six months ago, and the registered address is a residential apartment. Do you sign? Third-party due diligence is the process that answers this question before you commit—and skipping it has cost enterprises millions in fines, reputational damage, and supply chain disruptions. In this article, you'll learn exactly what to check, how to check it, and the common mistakes that even experienced procurement teams make.

Why Third-Party Due Diligence Is Non-Negotiable

Third-party due diligence (TPDD) is your first line of defense against fraud, sanctions violations, corruption, and operational failure. Regulatory bodies like the U.S. Department of Justice and the UK's Serious Fraud Office hold enterprises liable for the actions of their business partners—even if you had no knowledge of wrongdoing. Fines for violations can reach 20% of annual turnover under GDPR, and the average cost of a third-party data breach is $4.45 million. Beyond compliance, TPDD protects your margins: a supplier that's financially unstable may take your deposit and disappear, or fail to deliver on time, costing you far more than the $500–$2,000 a basic vetting report costs.

Core Checks: Ownership, Sanctions, and Legal Standing

Start with the basics: who owns the company, who controls it, and whether anyone is on a sanctions or watchlist. This is not just a box-ticking exercise—it's the difference between a clean contract and a criminal investigation. For example, a Fortune 500 electronics company once signed with a distributor that was 30% owned by a relative of a sanctioned oligarch. The company faced a $1.2 billion fine and a multi-year compliance monitorship. You can avoid this by running these checks on every entity and its beneficial owners (individuals with 25% or more ownership).

What to Verify

A basic screening report from a provider like LexisNexis or Refinitiv costs $100–$300 per entity and returns results within 1–3 business days. For high-risk jurisdictions (e.g., China, Russia, or countries with high corruption indices), consider enhanced due diligence, which adds on-the-ground verification and costs $1,500–$5,000 per entity.

Financial Health: Don't Get Stuck with a Bankrupt Supplier

A supplier's financial stability is a direct predictor of their ability to fulfill your order. Many enterprises skip this check, assuming that a low price means a good deal—but a supplier that's cash-strapped may cut corners, delay shipments, or take your deposit and vanish. According to a 2023 study by the Institute for Supply Management, 45% of businesses experienced a supply disruption due to a financially distressed supplier in the past three years.

Key Financial Metrics to Review

For a deeper dive, you can order a financial report from a provider like QIMA or SGS for $200–$500 per supplier. These reports include on-the-ground verification of assets, inventory, and even interviews with management. Remember: 20% deposit is standard for first orders, but if the financial check shows weakness, negotiate a lower deposit or use a letter of credit instead.

Compliance and Regulatory History: The Hidden Red Flags

Even a financially sound supplier can be a compliance nightmare. Environmental violations, labor abuses, or a history of customs fraud can land your company in legal trouble and ruin your brand. For example, in 2021, a major fashion retailer faced a $10 million fine after a supplier was found using forced labor—even though the retailer had no direct knowledge. The key is to check not just the supplier's own compliance, but also their sub-tier suppliers, as many violations happen deep in the chain.

What to Check

A practical way to check compliance is to hire a third-party audit firm like SGS, Bureau Veritas, or QIMA. A social compliance audit costs $1,000–$3,000 per factory and takes 3–5 days on-site. A full environmental audit is $2,000–$5,000. These audits are not just a checkbox—they give you direct evidence of working conditions, safety, and environmental practices.

Operational Capability: Can They Actually Deliver?

A supplier can pass every legal and financial check and still fail to deliver on time. Operational due diligence verifies that the supplier has the capacity, equipment, and processes to meet your volume and quality requirements. This is especially critical for first-time suppliers or those in new geographies. For example, a European auto parts manufacturer signed a contract with a Chinese supplier that looked perfect on paper—but when the first batch arrived, 30% was defective, and the supplier had no quality control system in place. The result: a 4-month delay and $2 million in expediting costs.

How to Assess Operational Capability

The most reliable way to verify operational capability is a physical audit. A pre-shipment inspection costs $300–$600 per day per inspector, and a full factory audit (including capacity and quality systems) costs $1,000–$2,500. If you can't visit in person, hire a local third-party like QIMA, AsiaInspection, or V-Trust to do it for you. They'll provide a detailed report with photos and recommendations within 5–7 business days.

Geopolitical and Country Risk: The Overlooked Factor

In 2024, 68% of supply chain leaders reported that geopolitical risk is now a top concern, yet many still don't factor country risk into their supplier vetting. A supplier in a politically unstable country can face export bans, currency controls, or even civil unrest that halts production. For example, after the 2022 Russia invasion of Ukraine, many Western companies found their Ukrainian suppliers unable to deliver, and their Russian suppliers sanctioned overnight. You need to assess the risk of the country where your supplier operates, not just the supplier itself.

What to Evaluate

You can access free country risk assessments from organizations like the World Bank, IMF, or Coface. For a more detailed report, companies like Control Risks or Verisk Maplecroft offer country-specific risk analyses for $2,000–$10,000 per country. This is a worthwhile investment if you're sourcing from high-risk regions like Bangladesh, Pakistan, or parts of Africa.

How to Run the Process: A Step-by-Step Guide

Now that you know what to check, here's how to operationalize it. Due diligence doesn't have to be a bureaucratic nightmare—it can be a streamlined process that takes 2–4 weeks for a standard supplier. The key is to tailor the depth of due diligence to the risk level of the supplier and the size of the contract.

Step-by-Step Process

Use technology to automate parts of this. Platforms like KYC-Chain, Onfido, or even a simple Excel tracker can help you manage the process. For high-volume screening, consider a global due diligence provider like Acuris, Dow Jones, or Exiger, which can handle thousands of entities at scale.

Common Mistakes and How to Avoid Them

Even with the best intentions, enterprises make avoidable errors in third-party due diligence. Here are the most common ones we see, and how to steer clear of them.

Conclusion: Your Next Steps

Third-party due diligence is not a formality—it's a strategic investment that protects your enterprise from legal, financial, and reputational harm. The three most important takeaways: (1) screen for ownership, sanctions, and financial health; (2) verify operational capability with on-site audits; and (3) monitor continuously, not just at signing. Your next step is simple: create a risk-tiering framework for your current supplier base and start vetting your top 10 suppliers this quarter. Use the tools and providers mentioned in this article, and document everything. The cost of due diligence is a fraction of the cost of a failure—so make it a non-negotiable part of your sourcing process.