Due-Diligence Framework

The buyer problem

Teams often confuse "doing due diligence" with "having a due-diligence framework." The first is an activity; the second is a documented structure that makes the activity repeatable and defensible. Without a framework, one procurement manager's due diligence might mean a five-minute website check while another's means a full financial and security review - for vendors carrying comparable risk. That inconsistency is exactly what an auditor, a board, or a post-incident review will flag first.

What a due-diligence framework engagement covers

Building a due-diligence framework means defining, in writing, before any specific vendor is evaluated: what categories of risk get checked (financial stability, security posture, compliance status, business continuity, reputational/adverse-media exposure), what depth of check applies at each risk tier, what evidence is considered sufficient versus what requires escalation, who has sign-off authority at each tier, and what specific findings automatically trigger rejection or executive review rather than being left to individual judgment.

Methods and techniques

• Scope definition: which risk categories are in scope for every vendor (financial, security, compliance, operational, reputational)
• Tiered depth rules: what level of check applies at each inherent-risk tier
• Evidence-sufficiency standards: what documentation is required and what counts as acceptable versus insufficient
• Decision thresholds: defined score or finding levels that trigger approval, conditional approval, or rejection
• Sign-off authority mapping: who can approve at each risk tier, and when it escalates above procurement to legal, security, or executive review
• Documentation and audit-trail requirements: what gets recorded so a decision can be reconstructed and defended later

What to verify before you retain

• Written thresholds, not case-by-case judgment. Ask what specific finding would automatically trigger rejection or escalation. If the answer is "we'd discuss it," the framework doesn't actually have defined thresholds.
• Sign-off authority is explicit. Confirm who can approve a vendor at each risk tier and what forces escalation above that level. Undefined authority is how high-risk vendors get approved by someone without the standing to accept that risk.
• An audit trail requirement. Ask what documentation the framework requires to be retained per decision. If an auditor asked why a specific vendor was approved eighteen months ago, could the framework reconstruct the answer?
• Depth actually varies by tier. A framework that applies identical scrutiny to every vendor regardless of risk either wastes resources on low-risk vendors or under-checks high-risk ones. Confirm tiered depth is real, not nominal.

Questions to put in your RFP

1. What specific risk categories does your due-diligence framework require checking for every vendor?
2. What are the defined thresholds that trigger automatic rejection or escalation, versus standard approval?
3. Who has sign-off authority at each risk tier in your framework, and how is that enforced?
4. What documentation does the framework require to be retained, and for how long?
5. How would this framework hold up if an auditor asked us to reconstruct why a specific vendor was approved a year ago?

Red flags

• No written decision thresholds - approvals are described as "case-by-case."
• Sign-off authority isn't clearly assigned to a role or tier.
• No stated documentation-retention requirement.
• The same checklist applies to every vendor regardless of risk tier.
• The framework can't describe what happens when a vendor fails a specific check.

Standards & frameworks referenced

Real, named standards bodies and frameworks relevant to this category. Listed for context; they do not endorse this index or any vendor. Verify any framework-alignment claim directly against the issuing body.

ISO 31000

International Organization for Standardization. The general risk-management standard many due-diligence frameworks borrow their scoring and escalation structure from.

SIG

Shared Assessments Program. Provides a standardized evidence-collection instrument that a due-diligence framework can specify as its baseline documentation requirement.