To fill out a vendor due diligence form, gather your entity, financial, insurance, and compliance documents before you open the questionnaire, then work through it section by section — company identification, ownership, financial stability, legal and regulatory compliance, data security, insurance, and subcontractors — answering every field and attaching the supporting document each answer points to. The form is a structured questionnaire a hiring company sends prospective suppliers before signing a contract, and the specifics shift with industry and contract value, but the core sections are predictable. Preparation is what separates a submission that moves through review in a few weeks from one that gets kicked back for missing attachments or blank fields.
Pull Your Documents Together First
Open a folder before you open the form. Having everything in one place prevents the back-and-forth that stalls approvals. A typical submission draws on:
- Entity documentation: articles of incorporation or organization, any DBA filings, and your Employer Identification Number. The EIN is a federal tax identification number issued by the IRS to identify a business entity; it does not, on its own, confirm good standing or debarment status, despite what some older templates imply.1Internal Revenue Service. Employer Identification Number
- Financial records: audited financial statements for the most recent two to three fiscal years, current-year interim statements if available, and a bank reference letter or credit report.
- Insurance certificates: current certificates for general liability, professional liability (errors and omissions), workers’ compensation, and, if you handle data, cyber liability.
- Compliance certifications: SOC 2 Type II reports, ISO 27001 certificates, HIPAA business associate agreements, or any industry-specific accreditations relevant to the contract.
- Legal disclosures: a summary of pending or recent litigation, any regulatory fines or consent orders, and anti-bribery or anti-corruption policy documents.
- Licenses and registrations: professional licenses, state business registrations, and, if asked, a certificate of good standing from your state’s secretary of state confirming your entity is current on filings and fees.
Save every attachment as a non-editable PDF. Name each file so the reviewer can match it to the form section without guessing — something like “AcmeCorp_GenLiability_2026.pdf” saves everyone time.
Company Identification and Ownership
The first section asks for legal entity name, any trade names, principal business address, phone, website, and EIN or equivalent tax identification number. If your company operates in multiple countries, expect to provide foreign tax IDs as well.
Ownership questions follow. The form will ask for the names and ownership percentages of anyone holding a significant stake, usually 25 percent or more. This helps the hiring company identify conflicts of interest and screen owners against sanctions lists. If a principal is a politically exposed person — a current or former senior government official, or a close associate of one — disclose that here. Leaving it blank and having it surface later in a background check is far worse than disclosing it upfront.
Foreign-formed entities registered to do business in the United States should know their beneficial ownership reporting status before starting the form. FinCEN’s March 2025 interim rule exempted all U.S.-created entities from Corporate Transparency Act reporting, but foreign reporting companies that registered to do business in a U.S. state or tribal jurisdiction must still file.2Financial Crimes Enforcement Network (FinCEN). Beneficial Ownership Information Reporting Hiring companies increasingly ask whether you’ve satisfied that requirement.
Financial Stability
This section exists because the hiring company needs to know you won’t go bankrupt halfway through a deliverable. Expect to upload audited or reviewed financial statements — income statement, balance sheet, and cash-flow statement — covering the prior two or three years. Some forms also request a Dun & Bradstreet number so the reviewer can pull a commercial credit report independently.
Reviewers look at debt-to-equity ratios, current ratios, and revenue trends. If your financials show heavy short-term debt or declining revenue, write a brief explanation in the free-text field most forms include for exactly this purpose. A company going through a planned restructuring reads very differently from one spiraling toward insolvency, but only if you supply the context. Don’t hope the numbers speak for themselves.
Smaller vendors without audited financials sometimes get a substitute accepted: tax returns, twelve months of bank statements, or a CPA-prepared compilation. Ask the procurement contact what they’ll accept before uploading something non-standard. Uploading the wrong format is one of the most common reasons forms get kicked back.
Legal and Regulatory Compliance
The compliance section probes whether your company has run afoul of the law and whether you have policies in place to prevent it. Standard questions ask whether you’ve been fined by a regulator, whether any lawsuits are pending, and whether any officer or owner has been convicted of fraud, bribery, or embezzlement.
Anti-Corruption Disclosures
If the contract involves cross-border transactions or government-adjacent work, the form will reference the Foreign Corrupt Practices Act. The FCPA makes it illegal for U.S. persons and publicly traded companies to pay foreign government officials to obtain or retain business.3U.S. Department of Justice. Foreign Corrupt Practices Act Unit It also requires publicly listed companies to maintain accurate books and records and adequate internal accounting controls.4International Trade Administration. U.S. Foreign Corrupt Practices Act Companies with UK exposure will also see references to the Bribery Act 2010.5The Crown Prosecution Service. Bribery Act 2010 Joint Prosecution Guidance of the Director of the Serious Fraud Office and the Director of Public Prosecutions The form typically asks whether you have a written anti-bribery policy, whether employees are trained on it, and whether you’ve self-reported any violations.
Sanctions and Debarment Screening
Hiring companies check vendors against federal exclusion and sanctions databases. SAM.gov maintains the federal government’s debarment and exclusion records; any entity barred from receiving federal contracts or benefits appears there. The Office of Foreign Assets Control separately publishes the Specially Designated Nationals list, covering individuals and entities subject to U.S. economic sanctions.6Office of Foreign Assets Control. Sanctions List Search Tool Some forms ask you to self-certify that neither your company nor its principals appear on these lists; others run the check themselves. A hit on either list is usually a hard stop.
Data Security and Privacy
If the engagement involves access to the hiring company’s systems, customer data, or employee records, this section becomes the heaviest part of the form. The document reviewers most want to see is a SOC 2 Type II report, an independent audit evaluating controls across up to five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Unlike a Type I report, which tests controls at a single point in time, a Type II report covers their operating effectiveness over a period, usually six to twelve months.7Microsoft Learn. System and Organization Controls (SOC) 2 Type 2
Not every vendor has a SOC 2 report, and not every engagement warrants one. If you don’t have one, expect deeper questioning: the form will ask about encryption standards, access controls, incident response procedures, data retention policies, and whether you’ve experienced a breach in the past three years. Answer every question with specifics. “We’re working on it” without detail reads as a red flag.
Contracts touching European personal data will add questions about your lawful basis for processing under the General Data Protection Regulation, cross-border transfer mechanisms, and data protection officer contact details. The California Consumer Privacy Act and similar U.S. state privacy laws carry their own disclosure and deletion requirements, and the form may include separate questions for each.
Insurance Coverage
Insurance protects both parties if something goes wrong during the contract. The form will list minimum coverage amounts and ask you to upload current certificates. Common requirements:
- Commercial general liability, typically $1 million per occurrence and $2 million aggregate, covering bodily injury, property damage, and personal injury claims.
- Professional liability (errors and omissions), required for consulting, technology, and advisory work, with limits often ranging from $1 million to $5 million for mid-size contracts.
- Workers’ compensation, required in nearly every state if you have employees; the form usually just asks you to confirm statutory coverage.
- Cyber liability for any vendor touching data, covering breach notification costs, forensic investigation, regulatory fines, and third-party claims. Minimum limits depend on the volume and sensitivity of data involved.
Two details trip vendors up. First, the hiring company almost always requires being named as an additional insured on your general liability policy; you’ll need to request an endorsement from your carrier before the form can be approved. Second, expired certificates are an automatic rejection. If your policy renews within thirty days of submission, note that on the form and provide the renewal confirmation as soon as it’s available.
Subcontractors
Many forms now ask whether subcontractors will perform any part of the contracted work, who they are, and what controls you impose on them. The hiring company’s data and reputation don’t stop being at risk just because a subcontractor is doing the handling. Expect to identify critical subcontractors by name, location, and function; describe your own vendor management program (whether you conduct due diligence, require compliance certifications, and audit practices); and explain the data flow — whether subcontractors will access, store, or process the hiring company’s data, and what controls prevent unauthorized access.
If you don’t use subcontractors, say so explicitly. A blank field here creates ambiguity that slows the review.
How to Answer Every Section
Work through the form section by section, matching each answer to the supporting document you prepared. Every field needs a response. If a question doesn’t apply — you don’t operate internationally, you don’t handle personal data, you have no pending litigation — enter “N/A” rather than leaving it blank. Automated screening systems flag blank fields as incomplete, and human reviewers can’t distinguish “not applicable” from “forgot to answer” when the field is empty.
For yes/no questions about negative events (breaches, lawsuits, regulatory actions), a “yes” is not automatically disqualifying. What matters is the explanation that follows: what happened, what you did about it, and what controls you put in place to prevent recurrence. A vendor that disclosed a past breach and demonstrated a credible response is more trustworthy than one that checked “no” and gets contradicted by a background check.
Most forms require an authorized officer to sign a certification that the information provided is accurate and complete. Misrepresenting facts — inflating revenue, concealing litigation, or uploading a forged insurance certificate — can lead to immediate contract termination and potential fraud liability. The person who signs should actually review the submission.
One note on scope: the hiring company’s procurement team usually assigns your engagement to a risk tier based on contract value, data sensitivity, and operational criticality, and the depth of documentation flows from that tier. You don’t choose it. If the form feels disproportionately heavy for what you’re providing, ask whether you’ve been categorized correctly before you spend days assembling evidence you may not need.
Submitting the Form
The hiring company specifies the submission method. The most common is a vendor management system, a web portal where you upload the completed form and all attachments. These systems validate entries against predefined criteria, flag missing fields, and route the package through internal approval workflows. You’ll typically receive an automated confirmation and can track status through the portal.
Some companies still accept submission by encrypted email, particularly for smaller engagements or when the portal is being onboarded. If you’re emailing, confirm the correct recipient address and any file-size limits before sending. Physical mail is rare but occasionally required for original notarized documents.
Before hitting submit, run a final check. Every attachment opens correctly. Every “N/A” was intentional. Insurance certificates haven’t expired. Financial statements cover the years the form requested. The most common reasons submissions bounce back are missing attachments, expired insurance, financial records that don’t cover the requested period, and blank fields that should have been marked “N/A.”
After You Submit
The form moves through multiple departments: procurement for completeness, legal for litigation and sanctions, information security for your SOC 2 or security answers, finance for your statements and credit data. Any one of them can send the form back for clarification. The full cycle typically takes two to six weeks, longer for complex, high-risk engagements. The review clock often pauses when a reviewer requests more information, so delayed responses extend the timeline more than people realize. Reply quickly and specifically.
Approval adds your company to the hiring company’s authorized vendor list. Rejection doesn’t always kill the relationship — some companies offer a remediation path where you can address specific deficiencies (missing insurance, a security certification in progress, a pending legal matter) and resubmit within a defined period.
Keeping Your File Current
Approval isn’t permanent. Most organizations re-certify vendors on a schedule tied to risk tier: high-risk annually, medium-risk every two years or at renewal, low-risk every three to five years with lighter check-ins between.
Certain events trigger an immediate, off-cycle review regardless of schedule: a data breach, a significant change in ownership, a major lawsuit, a credit downgrade, or a regulatory enforcement action. Mergers and acquisitions on either side of the relationship are another common trigger.
Keep your core due diligence documents current between review cycles. When your insurance renews, your financials are audited, or your SOC 2 report is refreshed, save copies in the format and naming convention the hiring company expects. The vendors who clear re-certification fastest are the ones who maintain a standing file rather than rebuilding one each time the request comes in.