6 Third-Party Due Diligence Best Practices

Video Transcript

Welcome to today’s Third Party Thursday! My name is Stephanie DellaCamera and I’m the Pre-Sales Technical Pricing Consultant here at Venminder. Today, we’re talking about vendor due diligence best practices.

Due diligence is a science and an art – by that, I mean there are times when not everything will be available, and you have to get creative. But let’s think about the basic facets of due diligence:

1. Due diligence should be risk based and reasonable. For example, if one of your service providers is the guy who mows the lawn, you obviously aren’t going to ask him for his SSAE 18 report – well, you could but he would mostly not understand what you are asking for.
   
   
2. The request list and the nature of the items should match the service provided. One element of due diligence may lead you to ask for others. For example, if you’re looking at a call center’s compliance policies and they refer to training materials, you’re likely going to need to request those as well.
   
   
3. Your due diligence should be done, at least as much as possible, pre-contract. That means well before the contract is signed, but not in a frantic effort to get things done to hit a specific contract date. There will be times that you cannot complete due diligence prior to the contract – some items you may even have to contractually oblige them to provide, but make sure you document it and commit them to supply as soon as reasonably possible. A few examples are things like evidence of audits, financials and customer records. It’s understandable that they want to hold on to these, but at the same time, if you need them, make sure the contract provides you the means to obtain.
   
   
4. Due diligence must be timely. This is a common pitfall that we turned into a best practice. One of the things that is easily received outdated is the financial reports. If you simply choose to request due diligence on a particular month of each year, you could be looking at financials that are a year old. We changed this to initiate the due diligence lifecycle 90 days after their fiscal year end, to ensure we always have the most updated information. From a workload standpoint, there may be times where you need to follow that designated calendar request – especially if there are hundreds or even thousands of third parties to review, but we try to get financials as the most timely item. And it’s paid off several times. 
   
   
5. Due diligence must be thorough. It’s easy to cut corners, but that can lead to ugly surprises, particularly if you follow a checklist mentality and just obtain the document without sufficiently reviewing them.
   
   
6. Due diligence must be ongoing. This doesn’t mean everything has to be constantly updated, but it should be tracked so major documents and major milestones are not missed. The lifecycle approach to due diligence can be a grind, as this diagram shows, but it can also be a well oiled machine.

Again, I’m Stephanie and thank you for tuning in! Don’t forget to subscribe to the Third Party Thursday series.