Vendor Due Diligence Checklist For Practical TPRM Reviews

Vendor due diligence is one of the most searched TPRM topics because analysts need a simple way to decide what to ask before a vendor is approved. Many checklists are either too thin or too long. A useful checklist helps the analyst understand the service, the data, the access, the controls, and the open risk without turning every review into a full audit.

The best starting point is not a giant question bank. The best starting point is a clear picture of what the vendor will do for the business and what could go wrong if the vendor fails, loses data, or gives the wrong person access.

This guide is written for analysts who need practical due diligence that can be used during intake, onboarding, renewal, and material change reviews.

Start with the business purpose

Confirm the service owner

Every review needs a named business owner who can explain why the vendor is needed, which process depends on it, and what would happen if the service stopped. Without that owner, the risk team may collect evidence but still miss the real business impact.

Write the service in plain language

Ask for a short description of the service, the user group, the region, and the expected workflow. If the analyst cannot explain the vendor in two sentences, the review is not ready to move into evidence collection.

Identify business criticality

Decide whether the vendor supports revenue, customer delivery, regulated operations, security, finance, payroll, legal duties, or other important processes. Critical vendors need deeper review and stronger approval.

Understand data and access

List the data fields

Do not stop at labels such as personal data or confidential data. Ask for actual data fields. Names, addresses, identity numbers, health details, payment details, credentials, and support notes create different risk and different notice duties.

Check where data goes

Ask where data is stored, backed up, processed, viewed, and deleted. Include support tools, reporting tools, test environments, and subcontractors because copied data often creates the quietest exposure.

Review access level

Find out whether the vendor has administrator access, production access, remote access, API keys, service accounts, or only a limited portal. Access level should change the depth of review.

Collect evidence that matches risk

Use lighter review for low exposure

If the vendor has no sensitive data, no important access, and low business impact, a short intake record, basic contract check, and owner confirmation may be enough.

Use targeted review for moderate exposure

Moderate risk vendors should provide evidence for the controls that matter most. That may include access control, encryption, backup, incident response, privacy, subcontractor oversight, and business continuity.

Use deeper review for high exposure

High exposure vendors should provide stronger assurance such as recent independent reports, policy evidence, vulnerability management details, incident notice terms, recovery test results, and clear remediation ownership.

Turn findings into decisions

Record open issues clearly

A finding should state the risk, the evidence, the business impact, the owner, the due date, and the decision needed. Avoid vague findings that say a control is weak without explaining why it matters.

Use conditions when approval is reasonable

Some vendors can be approved with conditions. Conditions should be specific, dated, and assigned. A condition without an owner is only a note.

Escalate when risk exceeds appetite

If the vendor handles sensitive data or supports a critical process and cannot provide enough assurance, escalate before contract signature. The business should understand the risk before it becomes hard to exit.

Practical checklist

1. Name the business owner and service owner
2. Describe the service in plain language
3. Classify business criticality and data sensitivity
4. List exact data fields and system access levels
5. Identify hosting, support, reporting, and subcontractor data paths
6. Collect evidence that matches the vendor tier
7. Document findings with owner, due date, and decision path
8. Confirm incident notice, audit rights, and exit support in the contract
9. Set the next review date based on risk and material change triggers

Analyst takeaway

A strong due diligence checklist is not about asking more questions. It is about asking the right questions early, matching evidence to exposure, and giving approvers a clear view of what risk remains.

FAQ

What is vendor due diligence in TPRM

Vendor due diligence is the review of a vendor before approval or renewal to understand business impact, data exposure, system access, controls, and open risk.

What should a vendor due diligence checklist include

It should include business purpose, service criticality, data fields, access level, subcontractors, security controls, privacy duties, resilience, contract terms, findings, and review cadence.

Should every vendor receive the same checklist

No. The checklist should match the risk. Low exposure vendors need a lighter review, while critical or sensitive vendors need deeper evidence and stronger approval.

Sources

• Interagency third party guidance
• Federal Reserve community bank guide
• OCC third party risk bulletin
• NIST cyber supply chain guidance