# Supplier Onboarding and Due Diligence: [Supplier name]

> Record of the checks done before a new supplier is created in the
> vendor master and allowed to receive orders: identity and ownership
> ("know your supplier"), sanctions screening, anti-bribery and
> corruption, financial health, information security and privacy,
> sustainability and human rights, and verification of bank details.
> Due diligence depth follows a risk tier, in line with the
> proportionate approach of ISO 37001:2025 clause 8.2 (cited by name
> and clause number only). Replace every `[bracketed]` value and every
> row marked *Example*. This is a documentation format, not legal
> advice: check the current official text and a qualified professional.

<!--
Guidance: How to use this template
- Purpose: make sure the organisation knows who it is paying, that it
  may legally deal with them, and that the risks the supplier brings
  are understood and accepted by someone with authority.
- Fill section 1 (risk tiering) first: the tier decides which checks
  in section 2 are mandatory. Do not run every check on every supplier;
  do run every mandatory check before the first order.
- Each check links to the specialist template that holds the detail,
  so this file stays a summary record with a decision.
- Worked example: the fictional Corvanna Instruments Ltd onboards the
  fictional Pellacourt Logistics B.V. (freight, Netherlands) before
  contract CTR-005 (`procurement/contract-register`). All results are
  invented and marked *Example*.
- Related templates: Procurement Policy (`procurement/procurement-policy`),
  Supplier Code of Conduct (`procurement/supplier-code-of-conduct`),
  Procure-to-Pay and Expense Policy
  (`finance/procure-to-pay-and-expense-policy`), Supplier Security
  Assessment (`compliance/supplier-security-assessment`), Sanctions
  Compliance Procedure (`compliance/sanctions-compliance-procedure`),
  ISO 37001 Anti-Bribery (`compliance/iso-37001-anti-bribery`), CSDDD
  Due Diligence Plan (`finance/csddd-due-diligence-plan`).
-->

## Document control

<!-- Guidance: One record per supplier legal entity. Keep the record for the life of the relationship plus your retention period. -->

| Field | Value |
|---|---|
| Record ID | [ONB-YYYY-NNN] *Example:* ONB-2025-041 |
| Supplier legal name | [Name] *Example:* Pellacourt Logistics B.V. |
| Requested by | [@name, department] *Example:* [@logistics-manager] |
| Category | [Category] *Example:* Logistics and freight |
| Prepared by | [@procurement-analyst] |
| Decision owner | [Role per tier, section 6] |
| Status | [In progress / Approved / Approved with conditions / Rejected] |
| Next review | YYYY-MM-DD |
| Classification | [Confidential] |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Record opened |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved with conditions, security follow-up due |

## 1. Risk tiering

<!-- Guidance: Score the inherent risk of the relationship before looking at the supplier's answers. Questions: what does the supplier do for us, where, with what access, and how replaceable is it? Pitfall: tiering on spend only, so a small supplier with admin access to a core system gets a light check. -->

Answer each question; the highest triggered tier applies.

| Question | Triggers | Answer |
|---|---|---|
| Expected annual spend | Above [GBP 1,000,000] = Tier 1; [GBP 100,000 to 1,000,000] = Tier 2 | *Example:* EUR 1,450,000 per year, above the GBP 1,000,000 trigger at recent exchange rates = Tier 1 |
| Supports a critical process (production, customer delivery, regulated activity)? | Yes = Tier 1 | *Example:* Yes, inbound parts and outbound deliveries |
| Processes personal data or connects to our systems? | Yes = at least Tier 2 | *Example:* Yes, shipment data and portal access |
| Interacts with public officials on our behalf (customs, permits, licences)? | Yes = Tier 1 for bribery risk | *Example:* Yes, customs brokerage |
| Country or sector with elevated sanctions, corruption or labour risk? | Yes = at least Tier 2 | *Example:* Subcontracted road haulage, labour risk in the sector |
| Replaceable within [3] months? | No = Tier 1 | *Example:* Yes, within 3 months |

**Result:** Tier [1 / 2 / 3]. *Example:* Tier 1.

## 2. Checks by tier

<!-- Guidance: Mark each check as mandatory (M), conditional (C) or not required (n/a) per tier, then record the result and the evidence location. -->

| ID | Check | Tier 3 | Tier 2 | Tier 1 | Detail template |
|---|---|---|---|---|---|
| CHK-01 | Legal identity, registration and tax numbers against official registers | M | M | M | This record |
| CHK-02 | Ultimate beneficial owners and directors | C | M | M | `compliance/kyc-cdd-profile` |
| CHK-03 | Sanctions screening of entity, owners and directors | M | M | M | `compliance/sanctions-compliance-procedure` |
| CHK-04 | Anti-bribery and corruption due diligence | n/a | C | M | `compliance/iso-37001-anti-bribery` |
| CHK-05 | Conflict of interest check against employee declarations | M | M | M | `compliance/conflicts-of-interest-register` |
| CHK-06 | Financial health (accounts, credit report) | n/a | M | M | This record |
| CHK-07 | Information security and privacy | C | M | M | `compliance/supplier-security-assessment`, `legal-lite/dpa` |
| CHK-08 | Sustainability, human rights and environment | C | M | M | `procurement/supplier-code-of-conduct`, `finance/csddd-due-diligence-plan` |
| CHK-09 | Insurance certificates | C | M | M | This record |
| CHK-10 | Quality approval (for production materials) | C | C | M | `procurement/supplier-performance-review` |
| CHK-11 | Bank details verification | M | M | M | Section 4 |
| CHK-12 | Code of conduct accepted | M | M | M | `procurement/supplier-code-of-conduct` |

## 3. Results

<!-- Guidance: Record the result, the date, who checked it and where the evidence is. A "pass" without evidence is a fail at audit. Pitfall: screening the company but not its owners. -->

| ID | Result | Date | Checked by | Evidence |
|---|---|---|---|---|
| CHK-01 *(Example)* | Registered in the Netherlands trade register, VAT number valid in the EU VIES check | 2025-08-11 | [@analyst] | DMS ONB-2025-041/01 |
| CHK-02 *(Example)* | Two owners above 25%, both individuals, identity confirmed from registry extract and supplier declaration | 2025-08-11 | [@analyst] | /02 |
| CHK-03 *(Example)* | No match on UK Sanctions List, EU consolidated list, OFAC SDN list for entity, owners and four directors; added to ongoing screening | 2025-08-12 | [@analyst] | /03 |
| CHK-04 *(Example)* | Questionnaire complete; customs brokerage uses own licensed staff; anti-bribery clause and audit right required in contract | 2025-08-15 | [@compliance] | /04 |
| CHK-05 *(Example)* | No employee declarations relate to the supplier | 2025-08-12 | [@analyst] | /05 |
| CHK-06 *(Example)* | Three years of filed accounts, profitable, credit score in the low-risk band | 2025-08-13 | [@finance] | /06 |
| CHK-07 *(Example)* | Security assessment rated medium; MFA on the shipment portal missing for customer users, fix by 2025-12-31 | 2025-08-20 | [@security] | SSA-2025-018 |
| CHK-08 *(Example)* | Sustainability questionnaire complete; subcontracted hauliers not yet covered by its own code; condition set | 2025-08-19 | [@sustainability] | /08 |
| CHK-09 *(Example)* | Carrier liability and public liability certificates valid to 2026-06-30 | 2025-08-13 | [@analyst] | /09 |
| CHK-10 *(Example)* | n/a, service supplier | | | |
| CHK-11 *(Example)* | Verified by call-back, see section 4 | 2025-08-21 | [@ap-master-data] | /11 |
| CHK-12 *(Example)* | Signed 2025-08-18 | 2025-08-18 | [@analyst] | /12 |

## 4. Bank details verification

<!-- Guidance: Payment redirection fraud enters through new and changed bank details. Verify through a channel that the requester did not supply. Pitfall: calling the phone number printed on the letter that asked for the change. -->

| Step | Rule | Result |
|---|---|---|
| Source of details | On supplier letterhead or portal, signed by an authorised person | *Example:* Portal submission |
| Independent call-back | Phone number from an independent source (registry, contract, previous correspondence), not from the submission | *Example:* Called the finance director on the switchboard number from the contract, 2025-08-21 |
| Name check | Payee name verification service where available: Verification of Payee for euro credit transfers (euro-area payment service providers offer it since 2025-10-09 under Regulation (EU) 2024/886), Confirmation of Payee in the UK | *Example:* Match |
| Account ownership | Account in the supplier's own legal name and in its country of establishment, unless justified | *Example:* Yes |
| Second person review | A second person in master data approves the record | *Example:* [@ap-lead] |
| Test payment | Optional for Tier 1: small payment confirmed by the supplier through the call-back contact | *Example:* Not used |

Changes to bank details later follow the same steps and the vendor
master controls in `finance/procure-to-pay-and-expense-policy`.

## 5. Onboarding workflow

<!-- Guidance: Keep the diagram consistent with sections 1 to 6: tier first, checks second, decision third, creation last. -->

The supplier record is created in the ERP only after the decision in
section 6, so no order or payment can happen while checks are open.

```mermaid
flowchart TD
  A["Request for new supplier"] --> B["Duplicate check in vendor master"]
  B --> C["Risk tiering"]
  C --> D["Run mandatory checks for the tier"]
  D --> E{"Any red flag?"}
  E -- "No" --> F["Decision owner approves"]
  E -- "Yes" --> G["Escalate to compliance"]
  G --> H{"Mitigation acceptable?"}
  H -- "Yes" --> I["Approve with conditions"]
  H -- "No" --> J["Reject and record reason"]
  F --> K["Verify bank details, create supplier"]
  I --> K
```

## 6. Decision and conditions

<!-- Guidance: The decision owner must be senior enough to accept the residual risk. Record conditions with owners and dates and track them. -->

| Tier | Decision owner |
|---|---|
| Tier 1 | Head of procurement and compliance officer |
| Tier 2 | Category manager |
| Tier 3 | Buyer |

| Field | Value |
|---|---|
| Decision | *Example:* Approved with conditions |
| Decided by | *Example:* [@head-of-procurement], [@compliance-officer] |
| Date | *Example:* 2025-08-22 |

| Condition ID | Condition | Owner | Due | Status |
|---|---|---|---|---|
| COND-01 *(Example)* | Enforce MFA for all shipment portal users | Supplier, tracked by [@security] | 2025-12-31 | Closed 2025-11-28 |
| COND-02 *(Example)* | Flow down the Corvanna Supplier Code of Conduct to subcontracted hauliers | Supplier, tracked by [@sustainability] | 2026-03-31 | Open |
| COND-03 *(Example)* | Anti-bribery clause and audit right in CTR-005 | [@legal] | Before signature | Closed 2025-09-15 |

## 7. Ongoing monitoring and re-assessment

<!-- Guidance: Due diligence is not a one-off. Set triggers and a calendar. -->

| Trigger | Action |
|---|---|
| Daily sanctions list updates | Automatic re-screening; hits reviewed within [1] working day |
| Change of ownership or control | Repeat CHK-02 to CHK-04 |
| Bank detail change request | Repeat section 4 |
| Adverse media, data breach, labour allegation | Compliance review within [5] working days |
| Calendar | Tier 1 every [12] months, Tier 2 every [24] months, Tier 3 every [36] months |

## 8. References

<!-- Guidance: List the laws and lists you screen against, with the date you checked them. -->

| Reference | Version or date | Official source |
|---|---|---|
| ISO 37001, *Anti-bribery management systems* | 2025, clause 8.2 due diligence | Official text: ISO, purchase or licensed access: https://www.iso.org/standard/85816.html |
| UK Sanctions List (sole UK list since the OFSI Consolidated List closed on 2026-01-28) | Current | https://www.gov.uk/government/publications/the-uk-sanctions-list |
| EU consolidated financial sanctions list | Current | https://data.europa.eu/data/datasets/consolidated-list-of-persons-groups-and-entities-subject-to-eu-financial-sanctions |
| OFAC Specially Designated Nationals list | Current | https://sanctionssearch.ofac.treas.gov/ |
| Regulation (EU) 2024/886 on instant credit transfers (Verification of Payee) | Euro-area obligation since 2025-10-09 | https://eur-lex.europa.eu/eli/reg/2024/886/oj |

## Standard and licence note

Structure aligned with ISO 37001:2025 (proportionate due diligence on
business associates), cited by name and clause number only; no
standard text is reproduced. Sanctions lists and payment regulation
facts are from the official sources named above and must be checked on
the date of use. Corvanna Instruments, Pellacourt Logistics and all
results are fictional. The text is original and is not legal advice.
Template licence: MIT.