Vendor due diligence: asking questions, assessing evidence

The assessment follows the risk scenario

Questions and evidence are derived from access, data, technology, continuity and the context of use. A generic catalogue of 300 identical questions for every provider creates effort, but not a better decision.

Evidence needs scope, date and substance

Certificates, audit reports, pentest summaries or policies can be relevant. Check whether the specific service and location are covered, which exceptions exist and how current the evidence is.

• record the claim and the required evidence separately
• document validity and scope
• decide gaps as a risk or a measure
• name the approval and the accepted residual risk