What this is
What is supplier due diligence?
What is supplier due diligence?
Supplier due diligence is a recorded enquiry into who a prospective supplier actually is, whether they can survive the contract financially, and whether trading with them exposes you to bribery, sanctions, labour or environmental liability. Its depth rises with the risk tier. Under ISO 37001 it is a required control, and it must be documented to have defensive value.
What is beneficial ownership, and why screen it separately?
The beneficial owner is the natural person who ultimately owns or controls the supplier, as distinct from the directors or the corporate shareholder on the register. Screening the trading entity alone tells you nothing if it is held through two holding companies elsewhere. Sanctions and PEP exposure attaches to people, not trading names, so an unresolved ownership chain is a result you cannot rely on.
What does screening actually screen against?
Four distinct source families, and conflating them is the usual error. Sanctions lists cover prohibited persons. Denied party lists cover export control. Politically exposed person data covers bribery proximity. Adverse media, litigation and enforcement registers cover conduct that has reached no list. One tool may cover several, but clearance in one is not clearance in the others.
Scope
When is a supplier due diligence and screening required?
This assessment sits between sourcing and approval in the Supplier Onboarding and Lifecycle programme. It answers whether you may trade with this party at all. It does not answer whether they can make the part, hold the price or hit the date.
Use this template when
- A supplier is shortlisted and commercial discussion is about to become specific
- The rescreen date on a previous record falls due, or the risk tier is raised
- Ownership, control or registered jurisdiction of an existing supplier changes
- The supplier will handle regulated goods, restricted technology or a sanctioned-adjacent lane
- A public-sector, financial or listed customer requires third-party screening evidence in your chain
Do not use it for
- Supplier Sourcing Request, which sets the need and the selection criteria before any supplier is shortlisted, and so precedes this record rather than replacing it.
- Supplier Onboarding Checklist, which takes an already cleared supplier from selected to able to trade across banking, insurance, terms and system setup.
- Supplier Bank Detail Verification, which is a fraud control on payment instructions, run again on every change rather than once at selection.
- Supplier Questionnaire, which collects what the supplier says about itself, where this record captures what you independently verified.
- Supplier Risk Assessment, which scores continuity, capacity and concentration risk rather than the integrity and standing of the party.
Compliance mapping
Which ISO 37001 requirements does this satisfy?
ISO 37001:2016 places due diligence among the controls operated over business associates, with depth proportionate to assessed risk. The mapping below ties each obligation to the section carrying the evidence.
| Clause | Requirement | Where it lands |
|---|---|---|
| ISO 37001:2016 cl.4.5 | Bribery risk assessment identifying categories of business associate and the risk each presents | Header |
| ISO 37001:2016 cl.8.2 | Due diligence on business associates where risk assessment indicates more than low risk | Identity and ownership |
| ISO 37001:2016 cl.8.4 | Non-financial controls over procurement and commercial aspects of business associate relationships | Integrity screening |
| ISO 37001:2016 cl.8.3 | Financial controls managing bribery risk arising from payment arrangements | Financial standing |
| ISO 37001:2016 cl.7.5 | Documented information retained as evidence that the control was operated, and rescreening at defined intervals | Outcome |
| ISO 9001:2015 cl.8.4.1 | Criteria for evaluation, selection and re-evaluation of external providers | Labour and environment |
What it does not cover
- A screening dated after the contract was signed, which shows the enquiry could not have influenced the decision and so evidences a formality, not a control.
- Beneficial Ownership Identified marked Yes on a supplier statement, which records the supplier's assertion as your verification and collapses the distinction the section exists to preserve.
- Every item answered N/A on a supplier tiered High or Very high, which produces a clean Score Percent from an empty denominator and contradicts the proportionality required.
- An outcome of Clear with Findings Requiring Attention populated, which leaves an unresolved concern with no owner, no CAPA ID and no route back into the process.
- Rescreening Interval Set marked Yes with Rescreen Due empty, which asserts a recurring control that nothing will ever trigger.
Global
Supplier Due Diligence and Screening requirements by country
Screening obligations arrive from three directions: anti-bribery liability for associated persons, strict sanctions and export control liability, and the newer supply chain duty of care statutes. They apply by where you trade, not only where you are registered.
Bribery Act 2010, s.7
Corporate offence of failing to prevent bribery by an associated person, adequate procedures being the only defence
A supplier or agent acting for you is an associated person. Ministry of Justice guidance names due diligence as one of the six principles, so an unscreened intermediary in a high-risk market removes the defence rather than weakening it.
Directive (EU) 2024/1760 on corporate sustainability due diligence
Risk-based human rights and environmental due diligence across the chain of activities
Screening becomes a transposed legal duty for in-scope companies and, by contractual cascade, for many of their suppliers. The Labour and environment section holds that evidence, and Site Locations Declared is what makes it auditable.
Executive Order 13224 and OFAC regulations at 31 CFR Chapter V
Strict liability prohibition on dealing with designated persons and entities they majority-own
Intent and knowledge are not defences, and the fifty per cent ownership rule means an unresolved chain can hide a blocked party behind an unlisted trading name. Hence ownership is resolved before any list is run.
How to complete it
How to complete a supplier due diligence and screening, step by step
The form is short; the judgement in it is not. Four decisions determine whether the record survives a regulator, a customer audit or a dispute.
Risk Tier is the field the rest of the assessment hangs from, scored inversely on purpose: Low scores three, Very high zero, because a high-risk relationship is a cost you are accepting. Set it from jurisdiction, sector, public official contact and spend value, not from how much you like the supplier. Tiering down to avoid work is the decision most likely to be examined later.
N/A removes an item from the denominator, so it raises Score Percent rather than lowering it. That is correct where the item cannot apply, indefensible where it merely was not done. Agree the rule once: N/A is inapplicable, No is not completed. Completeness Percent exposes the difference and is read alongside the score, never instead of it.
Screening Outcome offers Clear with conditions and Further investigation because most hits are neither clean nor fatal. A litigation history in a contested market is a condition; a sanctions match on a beneficial owner is not negotiable. Record which item produced the hit in Findings Requiring Attention: an outcome without its finding cannot be reviewed by anyone who was not in the room.
The template requires a Procurement signature and a Finance second signature. That is separation of duties, not formality: procurement owns the relationship it proposes, finance owns the exposure. Where one person or function supplies both, the control is cosmetic, and the record should say so rather than carry two signatures meaning one.
What auditors find
Most common supplier due diligence and screening findings
These findings recur across procurement functions of every size, and each is visible on the face of the completed record.
| Finding | Clause | What fixes it |
|---|---|---|
| Screening Date later than the date of the commercial commitment | ISO 37001:2016 cl.8.2 | Gate award on the record. Make Screening Outcome a prerequisite on the approval record, so a supplier without a Clear or conditional result cannot be approved. |
| Legal Entity Verified Against A Register marked Yes with no company number captured | ISO 37001:2016 cl.7.5 | Treat Registered Company Number as mandatory wherever a register exists in the country of registration, so the verification can be repeated by someone else. |
| Sanctions screening run on the trading name only, never the owners or directors | 31 CFR Chapter V | Sequence the section as designed: resolve Beneficial Ownership Identified and Group Structure Understood first, then screen sanctions and politically exposed persons against the resolved names. |
| Certifications Verified At Source marked Yes on a PDF supplied by the supplier | ISO 9001:2015 cl.8.4.1 | Check the certification body's register and record certificate number and expiry. A supplied PDF is a claim; a register entry is a verification. |
| Subcontracting recorded as Not disclosed, with the assessment still concluded Clear | Directive (EU) 2024/1760 | Make Not disclosed drive Screening Outcome to Further investigation. An undeclared subcontracting chain is exactly the exposure the labour and environment duties attach to. |
| Rescreen Due dates passing with no record raised | ISO 37001:2016 cl.8.2 | Schedule from the Rescreen Due field rather than a spreadsheet, and report overdue rescreens against the active vendor register before an audit finds them. |
Case in point
Case in point: the cleared supplier that changed hands
A component supplier is screened at shortlist, tiered Medium, cleared. Two years later the group is acquired by an investor vehicle in a third country. Nothing in the trading relationship changes: same site, same contacts, same invoices. The file still reads Clear, because it recorded a moment rather than a relationship, and nobody set an interval.
The change surfaces when a customer requires sanctions screening evidence dated within twelve months. The rescreen resolves an ownership chain that would have been flagged on day one had it existed then. The remedy costs a scramble and a delayed audit, which is the cheap version. The expensive version is the customer asking after a shipment rather than before.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
6 sections
- Reference
- LOG-042
- Archetype
- Assessment
- Record ID
- DD-2026-000
- Scoring
- Screening complete before award
- Direction
- High is good
- Singleton
- Yes
- Basis
- ISO 37001
- Links
- Feeds Supplier Approval and Anti-Bribery Assessment
- Tags
- Supplier, Due diligence, Screening
- Sections
- 6
- Fields
- 56
- Follow up fields
- 3
- Repeating sections
- 0
- Links out
- 4
Header
13 fieldsAssessment ID*
Auto sequence. Format DD-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date and Time*
Completed By*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
Supplier Name*
Registered Company Number
Country Of Registration
Risk Tier*
- Low3 pts
- Medium2 pts
- High1 pt
- Very high0 pts
Screened By*
Screening Date*
Cheap Now, Impossible Later
Screening a supplier before you depend on them costs an afternoon. Discovering the same facts once they are your sole source of a critical material costs a great deal more than that.
Identity and ownership
6 fieldsLegal Entity Verified Against A Register*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Trading Address Verified*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Beneficial Ownership Identified*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Ownership Changes In Recent Years*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Related Party To Us Identified*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Group Structure Understood*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Financial standing
6 fieldsAccounts Obtained*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Credit Check Completed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Solvency Acceptable*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Dependence On Us Assessed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Payment Behaviour Toward Others Checked*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Insurance Cover Adequate*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Integrity screening
6 fieldsSanctions Lists Screened*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Denied Party Lists Screened*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Politically Exposed Persons Screened*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Adverse Media Searched*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Litigation And Enforcement History Checked*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Regulatory Actions Checked*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Labour and environment
6 fieldsModern Slavery Position Assessed*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Labour Provider Chain Understood*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Environmental Compliance History Checked*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Certifications Verified At Source*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Subcontracting Declared*
- No subcontracting3 pts
- Declared2 pts
- Not disclosed0 pts
Site Locations Declared*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Outcome
19 fieldsScreening Outcome*
Clear, clear with conditions, further investigation, or reject.
Findings Requiring Attention
Rescreening Interval Set*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Anti-Bribery Assessment ID
Links to CMP-043 Assessment ID
Modern Slavery Assessment ID
Links to CMP-042 Assessment ID
Rescreen Due*
Items Assessed*
Excludes anything marked N/A.
Items Failed*
Score Percent*
Calculated on submission. High is good. N/A items leave the denominator.
Result Band*
- Pass3 pts
- Caution1 pt
- Fail0 pts
Completeness Percent*
How much of the template was actually answered. A high score on a half completed form is not a high score.
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Procurement*
Signature*
Finance*
Second Signature*
LOG-042 · record IDs look like DD-2026-000 · Feeds Supplier Approval and Anti-Bribery Assessment
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
Screening fails on continuity rather than on the individual check. What slips is the rescreen nobody scheduled and the linked record nobody chased.
Runs the record against the active vendor register, holds Rescreen Due dates as scheduled work rather than a field, and blocks award routing where no clear outcome exists.
Ties sanctions, denied party and politically exposed person checks to the resolved ownership names, and raises the linked anti-bribery and modern slavery assessments where the tier requires them.
Carries the outcome forward into supplier approval and audit, so certifications verified here are the ones the approval record relies on rather than a second, divergent set.
Watches for overdue rescreens, Clear outcomes against open findings, and completeness far below score, holding every write for approval before it touches a record.
This template lives in KnowLogistics — supply chain execution. Inbound, outbound, inventory, yard, claims, supplier lifecycle and customs.
Glossary
Supplier Due Diligence and Screening definitions and key terms
- Beneficial owner
- The natural person who ultimately owns or controls an entity, directly or through a chain of holdings, typically identified above a twenty-five per cent threshold.
- Politically exposed person
- An individual entrusted with a prominent public function, with close associates and family, whose involvement raises the bribery risk in a relationship.
- Denied party list
- An export control list of parties barred from receiving controlled goods, technology or software, distinct from a financial sanctions list.
- Adverse media screening
- A structured search of news and public records for conduct that has not led to a listing, prosecution or regulatory action but bears on integrity.
- Rescreening interval
- The period after which a cleared supplier is screened again, set from risk tier, and the mechanism that stops a clearance becoming permanent.
FAQ
Frequently asked questions about supplier due diligence and screening
How deep should screening go for a low-risk supplier?+
Proportionately. For a Low tier supplier, identity, register verification and a sanctions check usually suffice, with the integrity and labour sections largely N/A. The standard asks for depth matched to risk, and over-screening low-tier suppliers is the usual reason high-tier screening gets rushed.
Can we rely on a third-party screening provider's report?+
Yes for list coverage, no for the conclusion. A provider tells you whether a name matched; it cannot tell you whether the ownership chain you fed it was complete, nor whether a hit is material to you. Record the provider and date, then your own disposition in Screening Outcome.
What if the supplier refuses to disclose beneficial ownership?+
That is itself a screening result. Record Beneficial Ownership Identified as No and set the outcome to Further investigation or Reject by tier. A supplier unwilling to say who owns it cannot be sanction-screened, which makes trading with it a strict liability exposure.
How often should suppliers be rescreened?+
Set the interval by tier, not calendar convenience: annually or on trigger for High and Very high, longer for Low. Ownership change, jurisdiction change and adverse media are event triggers that override the interval.
Does this replace an anti-bribery risk assessment?+
No. This screens a counterparty; the anti-bribery assessment scores the exposure of a relationship or activity. The Anti-Bribery Assessment ID field exists so the two remain distinct records that reference each other.
Who should own the screening record?+
Procurement runs it, finance countersigns, neither owns it alone. The dual signature is what makes the record evidence of separated duties rather than one function assessing its own proposal.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Supplier Onboarding and Lifecycle
Conflict of Interest Declaration
Records a declared interest that could affect a business decision, and how it will be managed
Vendor and Contractor Register
Holds every supplier, contractor and service provider you work with, including their status and approval level
Supplier Onboarding Checklist
Takes a new supplier from selected to able to trade, covering banking, insurance, terms, technical approval and system setup
Supplier Sourcing Request
Starts the process of finding a new supplier, stating what is needed, why the existing suppliers cannot provide it and what the selection criteria will be
Supplier Bank Detail Verification
Verifies a supplier's bank details through an independently obtained phone number before any payment is set up or changed
Supplier Master Data Setup
Creates the supplier record in the systems that will use it, covering codes, terms, tax status, addresses and approval scope
More in Supplier Lifecycle
Supplier Onboarding Checklist
Takes a new supplier from selected to able to trade, covering banking, insurance, terms, technical approval and system setup
Supplier Sourcing Request
Starts the process of finding a new supplier, stating what is needed, why the existing suppliers cannot provide it and what the selection criteria will be
Supplier Bank Detail Verification
Verifies a supplier's bank details through an independently obtained phone number before any payment is set up or changed
Supplier Master Data Setup
Creates the supplier record in the systems that will use it, covering codes, terms, tax status, addresses and approval scope
Supplier First Delivery Review
Reviews the first delivery from a new supplier against everything that was promised during approval
Supplier Change Notification
Records a change a supplier has told you about, or one you have discovered, covering manufacturing site, formulation, ownership, subcontracting or certification
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- ISO 37001:2016, Anti-bribery management systems, cl.4.5, 8.2, 8.3, 8.4 and 7.5
- Bribery Act 2010 (UK), s.7, and Ministry of Justice guidance Principle 4
- Directive (EU) 2024/1760 on corporate sustainability due diligence
- 31 CFR Chapter V (OFAC) and Executive Order 13224
- ISO 9001:2015, cl.8.4.1, Control of externally provided processes
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.