Buyer evaluation

Due Diligence

A provider should be evaluated on the entity you will contract with, the operating model it proposes, the evidence it can provide, and the obligations it is prepared to accept—not the breadth of its marketing claims.

Build diligence around the proposed service.

Vendor-risk and procurement reviews are most useful when they reflect the work, information, systems, locations, third parties, continuity requirements, and retained client authority in the proposed engagement.

AdvanPath can respond to relevant questionnaires and document requests during the evaluation process. The information available, level of detail, confidentiality, and contractual status depend on the request and stage of the relationship.

Review domains

Six areas to evaluate before work moves.

The same domain may require different evidence depending on the service, risk, jurisdiction, information, and client policy.

01

Business and legal identity

Confirm the contracting entity, ownership and affiliations where relevant, founding and operating history, authorized contacts, insurance questions, financial review process, and authority to enter the engagement.

Review related information
02

Delivery capability

Review the proposed scope, operating method, roles, staffing, systems, locations, qualifications, transition plan, quality model, and evidence the service will produce.

Review related information
03

Information protection

Identify information categories, legal and contractual roles, access, locations, transfers, suppliers, retention, incidents, offboarding, and any client-required assurance.

Review related information
04

Compliance and contractual readiness

Confirm regulated-work boundaries, required licenses or qualifications, privacy and security terms, audit support, subcontractor provisions, records, remedies, and change obligations.

Review related information
05

Service levels and governance

Review measure definitions, baselines, targets, exclusions, reporting, forums, decision owners, dependencies, escalation, remediation, and controlled change.

Review related information
06

Continuity and exit readiness

Review critical activities, dependencies, fallback, recovery priorities, communications, data return or deletion, knowledge transfer, transition assistance, and unresolved work at exit.

Review related information

Document pack

Information that may support the review

  • 01Legal-entity and authorized-contact information relevant to the proposed agreement
  • 02Proposed scope, responsibility matrix, service model, locations, and supplier roles
  • 03Transition, governance, quality, continuity, and information-handling approach
  • 04Responses to relevant procurement, privacy, security, compliance, and insurance questions
  • 05Available policies, attestations, certificates, or supporting records that are current and applicable
  • 06Draft contractual schedules or exhibits appropriate to the stage of the discussion
  • 07References or client evidence only where authorized and appropriate

Evidence discipline

Distinguish current evidence from future obligations.

Current information

Documents and facts that exist today should be identified by owner, scope, date, status, and relevance to the proposed service.

Engagement-specific design

Controls, staffing, locations, suppliers, service levels, reporting, and responsibilities that will exist only for the engagement should be documented as proposed or contractual—not implied to be current.

Unavailable or not applicable

Where a requested record is unavailable, confidential, not applicable, or better addressed through another form of assurance, the response should say so and identify the available alternative.

Use a focused pilot when documents cannot answer the operating question.

A limited paid pilot can test representative work, access, review, exceptions, reporting, client dependencies, and the working relationship before a broader commitment.

The pilot should have a defined scope, duration, evidence, acceptance criteria, data handling, responsibilities, commercial terms, and decision about what happens next.

Common questions

Will AdvanPath complete our vendor questionnaire?

AdvanPath can review and respond to questionnaires relevant to a proposed engagement. Timing and available evidence depend on the scope, confidentiality, requested detail, and stage of the evaluation.

Can we request certifications, insurance, policies, or financial information?

You may request information relevant to the proposed relationship. AdvanPath will identify what can be provided, what requires confidentiality, what is not applicable, and what must be addressed through contractual terms or another form of evidence.

Can we begin with a pilot?

Yes, where a paid pilot is appropriate to the work and risk. The parties must define the pilot scope, information, controls, responsibilities, acceptance, and exit before it begins.

What can be confirmed only in a signed agreement?

Final scope, service levels, remedies, data-processing roles, security obligations, locations, suppliers, audit rights, insurance requirements, continuity objectives, and other commitments are established in the applicable written agreement.

Request the information your review requires.

Share the proposed service, diligence domains, questionnaire, evidence requests, decision timeline, and confidentiality requirements.