Maintain a Vendor Due Diligence File Without Scoring Risk

Define required artifacts and versions

List the artifacts the company requires for a vendor file, such as registration evidence, insurance certificates, security attestations, ownership disclosures, and signed terms. Record the acceptable version, the issuing authority, the validity period, and whether an original or certified copy is required. The list should come from the company's policy, not from a generic checklist.

For each artifact, name the field that proves it applies to the vendor entity being onboarded. A certificate for a parent company may not cover the contracting subsidiary. If the policy is silent, record the question and route it rather than assuming the broader document is acceptable.

Track completeness as states, not opinions

Use states such as received, verified present, missing, expired, superseded, not applicable, and awaiting owner review. Do not use a percentage complete as the only measure, because a file can be 90 percent complete and still lack the one artifact that blocks onboarding. Count the blocking items separately.

Record who supplied each artifact and when it was received. A vendor's assertion that a document was sent is not the same as the company holding it.

If an artifact is missing, note the request date, the follow-up owner, and the next action. A completeness view should tell a reviewer what is missing without opening every file.

Detect expired and inconsistent documents

Compare each validity date with the planned onboarding date and the current review date. A certificate that expires during the contract term needs a renewal action, not just a green check today. Record the expiry, the renewal owner, and the reminder date.

Look for inconsistencies across artifacts: legal name, address, tax identifier, signatory, and scope of coverage. When two documents disagree, preserve both and describe the difference.

Do not correct one document to match the other. The inconsistency itself is the finding the owner needs to see.

Route discrepancies with a neutral summary

Write a short discrepancy note that names the artifacts, the fields that conflict, the source of each value, and the decision requested. Avoid recommending a risk rating. The coordinator can say that the insurance certificate names a different entity; the owner decides whether that is acceptable.

Route the note to the named vendor-risk owner and record the response. If the owner requests additional evidence, add the request to the file and keep the prior state. A file that is routed but never decided should remain open and appear in the aging report.

Control access to sensitive attestations

Vendor files can contain security reports, financial statements, and personal data about owners. Restrict access by role and by vendor, and keep the documents in the approved repository. Do not paste sensitive content into the tracking sheet; use a reference and the minimum status fields.

Log access where possible and remove temporary access after the review. If an auditor or another team needs a copy, use the company's approved sharing method and record the recipient. A due diligence file that spreads across inboxes and shared drives is difficult to protect and difficult to defend.

Recertify the file on a fixed cadence

Set a review cadence based on the artifact type and the vendor's risk profile as defined by the company. At each review, confirm the document is still current, the vendor entity is unchanged, and the owner has re-accepted the file. Record the review date and the reviewer.

When a vendor changes ownership, bank details, or scope, reopen the relevant artifacts rather than updating the file silently. Keep the prior version and the reason for the change. The output of this lane is a reconstructable file with an owner decision, not a score that hides which document is missing.