Independent UK governance, risk & complianceOur editorial standards ↗Practical guidance. Accountable decisions.
GRC.ME.UKDisclaimer

Risk working document

Supplier due diligence & decision

Review the supplier’s role, dependencies, evidence and exit arrangements.

Version 1.0 · 1 November 2026Editorial template · adapt to your scope
Working notes stay in this page until you explicitly save or export them. Record evidence references rather than confidential or sensitive source documents. A template does not confirm compliance.

Complete each relevant field and record reasons for exclusions. Keep statutory deadlines separate from internal project targets.

Describe what the supplier supports and what failure would affect.
Map personal data, privileged information, systems and locations.
Record identity, proportionate financial/security checks and limitations.
Review service levels, incidents, subcontractors, information duties and audit terms.
Consider alternative suppliers, backups, handover and deletion evidence.
Record residual uncertainty, owners and actions.
Name the decision-maker, reasons, conditions and review date.

GRC.me.uk · Source-linked guidance at the guidance library · Read the disclaimer.