Supplier due diligence for corporate communications, from identity to verified exit

Due diligence should leave an evidence trail that another reviewer can challenge. The fictional buyer, Cedar Vale Engineering Ltd, is considering support for one England site-consolidation communication. No provider is assessed here. Use each question as pass, fail or unresolved, and preserve the buyer-owned manual route.

The official sources were reviewed on 6 September 2026.

Identity and exact service

• Record the contracting legal entity, company or register identifier, trading name, address and authorised signatory.
• Name the exact service, edition, version, modules, buyer type and written UK availability.
• Distinguish a supplier group, reseller and subprocessor from the contracting party.

Companies House explains its available data products, but its disclaimer says filed information is not verified or validated. Treat register data as stated facts only. Stop if the entity selling the service is unclear.

Contract and money

• Obtain the applicable terms, order form, service description and change policy.
• State currency, VAT position, charging unit, period, minimum term, volume, extras, overages, renewal and termination.
• Define inputs, deliverables, acceptance, support boundary, correction and withdrawal.
• Leave uncertain prices and service levels blank rather than borrowing another edition's claim.

Contracts allocate tasks but cannot create claim substantiation, PECR permission or legal compliance. Commercial and legal owners review separately.

Content authority and rights

• Identify who supplies facts, approves objective claims and can withdraw a disputed statement.
• List every text, image, recording, data set and software component, together with ownership or licence evidence.
• Separate buyer-controlled publication from monitoring and independent editorial use.
• Require a versioned correction route that retains the authoritative source without republishing restricted material.

Stop if the supplier claims rights simply because it created or hosted an asset. An IP reviewer must inspect the actual work, licence, territory, duration and permitted edits.

Data and transfers

• Map each purpose and decide roles from actual conduct, not the template label.
• List personal-data fields, instructions, subprocessors, access locations, retention, rights support, incidents and deletion.
• Identify the legal entity receiving any restricted transfer and the mechanism relied upon.

The ICO's Article 28 guidance is currently under DUAA review. Its international transfer guide was updated 15 January 2026. Qualified privacy review must use the current law and specific arrangement.

Accessibility and security

• Request dated accessibility evidence, known limitations and a correction route.
• Test the configured task with agreed assistive methods and an alternative format request.
• Examine privileged roles, authentication, logs, alerts, recovery, backups and incident coordination.
• Tie every assurance or certificate to its scope and validity date.

GOV.UK's accessible-format guidance is aimed at government communicators, not supplier certification. The NCSC's supply-chain guidance supports building assurance and review into supplier management without declaring a universal control set.

Change, correction and exit

• Define notice for material service, subprocessor, term or feature changes.
• Prove who can halt publishing, restore the authoritative version and export the audit history.
• Exercise account recovery and a synthetic correction before approval.
• Specify data and asset export, usable formats, continuity, account transfer and verified deletion.

Ask who owns each evidence item and when it expires. Marketing copy, a badge and a demonstration are not substitutes for applicable terms or observed buyer configuration. Any failed identity, legal, privacy, security, accessibility, correction or exit gate rejects the candidate. A strong demo cannot compensate. Procurement remains on hold until named reviewers sign the evidence and recheck time-sensitive records.