During any large IT service procurement, there should be a formal supplier due diligence exercise. A structured period that gives bidders enough access to information, systems, and people to produce firm, reliable quotes. Without it, you risk receiving prices that are conditional, vague, or padded with contingency.
Too often, procurement due diligence is treated as an afterthought. It gets compressed into a week, bolted onto the end of a timeline, or skipped altogether. The result is predictable, with suppliers issuing quotes that are “subject to further due diligence,” and once the contract is signed and competitive tension disappears, costs climb.
This guide sets out a practical supplier due diligence checklist, with 10 steps that can help your procurement team plan, co-ordinate, and close out due diligence properly. Whether you’re running a tender for managed services, a technology contract, or a large outsourcing deal, the principles apply.
What is supplier due diligence?
Supplier due diligence is the process of giving shortlisted bidders controlled access to the information they need. This might be operational data, technical environments, commercial records, and subject matter experts, and the purpose is to help suppliers price accurately and commit to firm contractual terms.
The supplier due diligence process typically fits between the request for proposal (RFP) stage and best and final offer (BAFO). It might involve a virtual data room, site visits, system access, and structured interviews with your internal teams. The goal is to remove ambiguity so that every bidder prices on the same basis, and reducing the risk of suppliers later claiming gaps in information.
This step directly affects contract value, negotiation strength, and long-term supplier performance. And poorly run due diligence creates cost exposure that can last the full life of a contract.
Why the supplier due diligence process fails
When due diligence on suppliers goes wrong, the consequences are commercial and procedural. Bidders who haven’t completed their own checks will caveat their pricing. Those caveats become cost increases after award (sometimes substantial ones), at a point where you have no competitive pressure to push back.
Common failure points include leaving due diligence too late, underestimating how long it takes, providing incomplete or inaccurate data, and failing to co-ordinate multiple bidders across a single organisation. Each of these is avoidable with proper planning.
A practical supplier due diligence checklist
1) Schedule due diligence before final pricing is submitted
Due diligence should take place after initial RFP responses, but before bidders submit their final pricing (typically at BAFO). This allows suppliers to refine their solutions and pricing based on a detailed understanding of your environment, while preserving competitive tension.
In some cases, elements of due diligence can be introduced earlier in the process to improve the quality of initial bids. However, the critical point is that bidders complete sufficient due diligence before committing to firm pricing.
If due diligence takes place after BAFO, you lose control. Negotiations will happen without a firm baseline, and the risk of cost increases after contract signature becomes significantly higher. Timing is one of the most important decisions in the due diligence procurement process.
2) Allocate enough time in the plan
Due diligence exercises take time. For both bidders and the customer, the work is detailed and resource-heavy. Compressing it into an unrealistic window results in bidders who can’t commit to firm pricing because their own governance standards weren’t met.
Barkers Procurement recommends allowing 4–8 weeks depending on the complexity and number of services being let. This is typically the time needed for bidders to do the work properly and for your team to manage the process.
3) Co-ordinate bidder access carefully
Due diligence shouldn’t be an open door. Multiple bidders need managed, structured access to data, people, and systems. And that access needs to be fair, consistent, and controlled.
In many procurement exercises, this co-ordination role becomes a full-time task for a member of the project team. It’s worth planning for that from the start. Without a single point of co-ordination, bidders approach different parts of the organisation independently, and the customer loses sight of who has seen what.
4) Set up and populate a data room before the exercise starts
A data room is a centralised area, usually virtual, where all relevant documents are stored and made available to bidders. Setting it up takes longer than most teams expect. Access permissions, folder structures, document formats, and version control all need to be right before bidders log in.
Start gathering data early. Ask bidders in advance what they’ll need. If your procurement team treats data room preparation as a pre-exercise workstream, rather than something done in parallel, you can avoid the most common delays.
5) Confirm the accuracy of all data provided
Bidders will base their pricing on the data you provide. If that data later proves inaccurate, the successful bidder may seek to justify a price increase. And you’ll have no competitive tension to moderate the demand.
Where data quality is known to be poor, be upfront with bidders. Agree on a pricing mechanism in advance so that any corrections carry a pre-agreed cost impact. The same applies to missing data: issue estimates to all bidders so everyone quotes on the same basis and agree how variances will be handled.
6) Let bidders collect their own data where possible
Bidders often have their own preferred methods for extracting data. This can include running scripts, pulling system reports, or conducting technical audits. Letting them collect data directly has a clear advantage: it makes the bidder responsible for the quality of what they’ve gathered.
Where this requires system access, your information security team will need to review and approve the approach. Build that approval step into the timeline. It often takes longer than expected, and a delayed InfoSec review can stall the whole exercise.
7) Schedule access to your subject matter experts (SMEs)
Bidders will want to interview your SMEs, the people who run the systems, manage the contracts, and understand the operational detail. In most cases, the bidder records the output of each interview and sends it back for validation, so the information can be formally relied on in their pricing.
SMEs have day jobs. Their time needs to be booked in advance, and bidders should be asked early which roles they’ll want to speak to. Failing to plan SME access is one of the most common reasons due diligence exercises run over schedule.
8) Review and challenge requests for additional information
Bidders will ask for data throughout the process, sometimes in large volumes. Not all of it will be relevant to pricing. Some requests are “nice to have” rather than directly linked to the cost of the service.
Run all requests through a formal, centralised process and challenge anything where the link to pricing isn’t clear. This reduces the burden on your team and keeps the exercise focused. A well-managed request process is a sign of mature procurement due diligence. And bidders generally respond well to clear boundaries.
9) Monitor bidders’ progress throughout
Each bidder will manage their own workload, but the customer should track progress centrally. Weekly reports from each bidder give you early visibility of problems, such as one supplier falling behind, or all suppliers flagging the same concern.
This monitoring also feeds directly into risk management for the overall procurement timeline. If every bidder is running behind, you may need to extend the due diligence window rather than accept incomplete pricing at the end of it.
10) Confirm that bidders will offer firm pricing
This is the purpose of the whole exercise. Before due diligence closes, ask every bidder to formally confirm that they’ve completed the work needed to offer firm pricing. If there are still gaps, identify them and either fill them or agree pricing mechanisms to cover them.
Confirmation should be documented. This approach is commonly used in larger or more formal procurements, where it records that the bidder has completed due diligence and acknowledges responsibility for the basis on which their pricing has been submitted.
What to do after due diligence closes
Once all bidders have confirmed their ability to price firmly, close the exercise formally and issue clear written confirmation that due diligence is complete. This creates a contractual reference point, and any future cost claims can be tested against the data and access that were made available.
It’s also worth reviewing how the exercise went. Where did data arrive late? Which requests caused the most friction? What would you change next time? A short debrief with the project team turns a one-off exercise into a repeatable process for future procurement events.
If your team needs support running a competitive procurement, including structuring and managing the supplier due diligence process, speak to a procurement specialist.