Supplier Due Diligence: A Practical Guide for US Teams

Supplier due diligence is the work of verifying who a supplier really is, whether it can deliver, and what risk it brings to your business, before you sign and for as long as you buy. Done well, it is proportionate: a deep review for the few suppliers that could hurt you, a light check for the rest, and a refresh whenever something changes. This guide covers what to check, which data to use, a tiered checklist, and how to keep the process from becoming a bottleneck.

TL;DR

• Tier your suppliers by impact first. Spend deep review time only on critical and high-risk suppliers, as the OECD describes a risk-based, tailored process, not a universal checkbox.
• Verify identity and ownership before anything else. A clean questionnaire from the wrong legal entity, or from an undisclosed parent, protects you from nothing.
• Look past Tier 1. Modern slavery, financial fragility and security gaps often sit deeper in the chain.
• Treat onboarding as the start. Set review frequency by risk profile and watch for events between reviews.
• Use independent data to cross-check what suppliers tell you, and keep a record of what you checked and why.

Table of Contents

• What supplier due diligence covers
• Why proportionality matters more than thoroughness
• The supplier risk assessment checklist
• Look past Tier 1
• The rules that shape the work
• Where the data comes from, and where it breaks
• Our perspective: ownership and signals decide most cases
• Building a process that does not stall procurement
• How Milda supports supplier due diligence
• Common mistakes to avoid
• FAQ
• Sources

What supplier due diligence covers

A useful working definition: it is the investigation and verification of a supplier’s capability, financial stability, legal standing and compliance profile. Most teams group the work into six areas.

1. Identity and ownership. Legal name, registration, address, directors, shareholders and ultimate beneficial owners.
2. Financial health. Revenue trend, profitability, leverage, payment behavior, and signs of distress.
3. Legal and compliance. Sanctions exposure, litigation, licenses, certifications, and regulatory actions.
4. Operational capability. Capacity, locations, single points of failure, business continuity.
5. Information security and data handling. Especially if the supplier touches your systems or customer data.
6. Ethical and sustainability conduct. Labor practices, environmental impact, and the same questions for the supplier’s own suppliers.

Vendor risk assessment is best seen as a subset of this work. It focuses on the threats a vendor poses, such as financial distress, cybersecurity gaps or non-compliance. Due diligence is the wider exercise of gathering and verifying the facts that the risk assessment then scores.

Why proportionality matters more than thoroughness

The temptation is to send every supplier the same 200-question form. It burdens good suppliers, slows buyers, and still misses the problem, because a blanket questionnaire does not ask the right things of the right supplier.

The OECD frames due diligence as risk-based and tailored: the depth of investigation should match the severity and likelihood of the potential harm. A packaging supplier you buy from once a year and a sole-source component maker in a high-risk region are different problems.

Practitioners also point to a common pitfall: onboarding without a defined risk appetite. Guidance from a public body recommends a written policy that mandates specific checks according to the supplier’s role, risk profile and level of access to sensitive information. Write that policy before you buy a tool or draft a form.

A simple tiering model

The thresholds are yours to set. Government guidance on supply chain assurance recommends categorizing vendors by level of risk (low, medium, high) and running stricter, recurring assessments for high-impact or critical suppliers, with frequency driven by the risk profile rather than a fixed annual schedule.

The supplier risk assessment checklist

Use this as a starting point and cut it down by tier.

Before you shortlist

• Confirm the legal entity, registration number and registered address against an independent source.
• Identify the parent company and ultimate owners. Note any state ownership or ownership by sanctioned parties.
• Screen the entity, its owners and directors against sanctions and watch lists.
• Check how long the company has operated and whether it has changed names or structure recently.

Before you sign

• Review at least two to three years of financial statements where available, and look at trend, not just the latest year.
• Ask for certifications and verify them with the issuing body rather than accepting a PDF.
• Request a list of key sub-suppliers and the countries where critical inputs originate.
• For suppliers with access to your data or systems, assess security controls and incident history. NIST’s supply chain guidance is a common reference for US buyers; our walkthrough on putting NIST guidance to work for supplier risk monitoring turns it into a 90-day plan.
• Record the risk rating, who approved it, and which exceptions were accepted.

After you sign

• Watch for ownership changes, leadership departures, litigation, adverse media, layoffs, and credit deterioration.
• Re-tier the supplier when your spend, dependency or the supplier’s access changes.
• Reassess on events, not just on the calendar.
• Log remediation actions with owners and dates.

Look past Tier 1

Checking only your direct suppliers is not enough. Public-sector supplier policies make the point that risks such as modern slavery, financial instability or security vulnerabilities often sit in Tier 2 and beyond, which is why third-party access must be risk-assessed before it is enabled.

You rarely need to map the whole chain. Map it where it matters:

1. Start with critical suppliers and ask who supplies their critical inputs.
2. Identify concentration: several of your suppliers may rely on the same sub-supplier or region.
3. Prioritize by the product, not the vendor. If one component is the risk, trace that component.

The rules that shape the work

Regulation is a reason to document your process even if no single law applies to you directly.

United States. For importers, the forced labor question is concrete. U.S. Customs and Border Protection enforces the Uyghur Forced Labor Prevention Act, and its enforcement FAQs say importers facing detention should be ready to supply a list of suppliers with each one’s role in production and the associated documents, and to show that supply chains do not rely on commingled inputs made with forced labor. That is supply chain mapping, in practice.

European Union. If you sell into Europe or have EU subsidiaries, the Corporate Sustainability Due Diligence Directive applies to covered companies. The consolidated text addresses adverse human rights and environmental impacts across a company’s own operations, subsidiaries and business partners in the chain of activities. Check with counsel whether your company is in scope.

United Kingdom. Under the Procurement Act 2023, contracting authorities must assess national security risks posed by suppliers, including connected persons. This matters if you bid for UK public contracts.

Tax exposure. UK government guidance warns that a business connected to fraud in its supply chain can lose the right to recover VAT, and that the burden of proving supply chain integrity rests with the buyer. The example is UK-specific, but the principle travels: your records are your defense.

These rules differ by country and change. Your general counsel or trade compliance lead should confirm which apply to your products and routes.

Where the data comes from, and where it breaks

Supplier risk data usually comes from four places, each with a weakness.

The practical rule is to use a questionnaire to learn what the supplier says and independent data to test it. Where the two disagree, ask a question. Shared assessment platforms can cut repeat questionnaires by letting suppliers provide data once for several buyers, as public procurement practice shows for large supplier assessments. Use them for the self-reported layer, not as a substitute for verifying ownership and finances.

Our perspective: ownership and signals decide most cases

We build a company intelligence platform, so we see the same failure pattern in supplier reviews. The questionnaire is fine and the file is complete, but nobody noticed that the supplier changed owners last quarter, or that a subsidiary the contract names is not the entity that actually ships the goods.

Three convictions shape how we think about this:

• Entity resolution comes first. Every later check is only as good as your confidence that you are looking at the right company, its parent and its related entities. Coverage matters here. A supplier you cannot find in your data is a supplier you cannot screen.
• One source is a hypothesis, two is evidence. We apply this to contacts and to company facts alike. Cross-check ownership, financials and key people against a second source before you rely on them for a critical supplier. We make the same argument for sales data in our piece on finding decision makers and verifying with a second source.
• Risk moves between reviews. A yearly review of a critical supplier is a snapshot. Growth signals, ownership changes and financial indicators are the early warnings, and they are cheap to watch compared with the cost of a surprise.

Our platform covers over 420 million companies and 50 million verified contacts, with ownership, shareholders, financials, risk assessments, trade data and event-driven signals in one place. Our claim is that broader multi-source coverage surfaces more companies than other tools, including smaller and private suppliers that thinner databases miss. You can see what the data covers and judge it against the suppliers you actually use.

— Vilius Stanciauskas, Founder and CEO

Building a process that does not stall procurement

Due diligence that blocks every purchase gets bypassed. Experts stress that it must fit into procurement workflows if it is to last. A few design choices help.

1. Triage at intake. Ask four or five questions at the request stage (spend, data access, criticality, country, substitutability) and assign a tier automatically.
2. Pre-fill what you can. Pull legal identity, ownership and firmographics from data rather than asking suppliers to type them. This shortens forms and removes transcription errors.
3. Define escalation. Decide in advance what triggers a deeper review: a sanctioned owner, negative equity, a high-risk jurisdiction, unexplained ownership layers.
4. Keep an audit trail. Store the sources, dates and the person who approved each decision.
5. Close the loop. Feed findings back into contracts: audit rights, notification duties for ownership change, and exit clauses.

A worked example

Say you plan to make a mid-sized contract manufacturer your sole source for a component. You tier it Critical. Identity checks show the registered entity is a subsidiary. Ownership mapping reveals a holding company acquired it eight months ago. Financials for the parent show rising debt. None of this appears in the supplier’s questionnaire, which was answered accurately for the subsidiary. You do not necessarily walk away: you might negotiate a second source, a longer notice period, or financial covenants. That is the value of the process: informed terms, not just a yes or no.

For related financial checks, the logic overlaps with M&A work. Our financial due diligence checklist lists eight checks that transfer well to assessing a key supplier’s finances.

How Milda supports supplier due diligence

If your team spends hours stitching together registries, filings and news for each supplier, the Milda Data Platform puts company profiles, ownership, financial insights, risk assessments and signals in one place. The browser extension brings that context to any supplier website, and API access can feed the data into your procurement or ERP workflow. Government teams assessing industries and suppliers can see how this applies on our government page. Plans are described on the pricing page, where Browser Analyst, Strategy Terminal and Data Solutions are listed.

Common mistakes to avoid

• Treating onboarding as the finish line. Risk changes after the contract starts.
• Applying one form to everyone. It overloads low-risk vendors and under-tests critical ones.
• Trusting self-reported ownership. Verify it independently.
• Ignoring concentration. Ten suppliers sharing one sub-supplier is one risk, not ten.
• No owner for the findings. A risk rating with no accountable person and no action is paperwork.
• Over-collecting. Gathering data you never use creates storage, privacy and review costs.

FAQ

What is the difference between supplier due diligence and a vendor risk assessment?

Due diligence is the broader process of gathering and verifying information about a supplier’s identity, finances, compliance and conduct. A vendor risk assessment is a subset: it takes those facts and rates the threats the vendor poses, such as financial distress, cybersecurity gaps or non-compliance. In practice teams run them together and use the rating to set the depth and frequency of review.

How often should we reassess suppliers?

Set frequency by risk, not by a single annual date. Critical suppliers need continuous monitoring for events plus a scheduled review, while low-risk suppliers may only need a check at renewal. Re-tier a supplier whenever your dependency, spend or its access to your data changes.

Do we need to check suppliers beyond Tier 1?

For critical suppliers and high-risk categories, yes. Forced labor, financial fragility and security weaknesses often sit deeper in the chain, and rules such as the UFLPA expect importers to show supplier roles and documents across production. For low-risk purchases, a Tier 1 check is usually proportionate.

What data should a third-party risk file contain?

At minimum: verified legal identity, ownership structure, sanctions screening results, financial indicators, relevant certifications, risk tier with rationale, and the approver and date. For critical suppliers add sub-supplier information, security assessments and your monitoring log. Keep the sources so a reviewer can retrace your conclusions.

Sources

• OECD: Due diligence for responsible business conduct
• GOV.UK: Recommended approach to assurance
• Registers of Scotland: Supplier security policy
• Registers of Scotland
• CBP: UFLPA enforcement FAQs
• EUR-Lex: Directive (EU) 2024/1760, consolidated text
• GOV.UK: Procurement Act 2023, national security grounds
• GOV.UK: Supply chain due diligence for labour supply chains
• Public Contracts Scotland: supply chain assessment notice

Recommended

• Financial Due Diligence: 8 Checks for M&A Buyers and Sellers
• Supplier Risk Monitoring: Put NIST Guidance to Work in 90 Days