Guide · Compliance Foundations

Supplier Due Diligence: What It Is and How to Do It

By Mandy-Lynn Aitken — 30 years on both sides of the supply-chain auditUpdated July 13, 2026

Short answer: supplier due diligence is the process of verifying and evaluating the companies you buy from, before you sign and continuously after, confirming they are legitimate, financially sound, and compliant with the regulatory and internal standards that apply to you. Almost every compliance and security failure starts somewhere you don't control — a supplier, a sub-supplier, a labour broker two tiers down. Supplier due diligence is how you see that exposure before a regulator, an auditor, or an incident sees it for you.

What is supplier due diligence?

Supplier due diligence is the process of verifying and evaluating the companies you buy from — before you sign, and continuously after. It confirms a supplier is legitimate, financially sound, and compliant with the regulations and internal standards that apply to you, then digs deeper into ethical practices, ESG, labour conditions, and security readiness.

It is two things at once: a risk discipline — you genuinely want to know who you depend on — and a legal obligation. Programs like C-TPAT, PIP, AEO, Bill S-211, ESG directives, and GFSI food-safety standards all make the same demand in different words: you are responsible for the partners in your chain, and you must be able to prove you checked them.

That demand is hardening fast. The U.S. “Strengthening Customs Enforcement” executive order, signed June 3, 2026, makes C-TPAT a practical requirement to import — foreign importers of record must be CTPAT-validated (where eligible) or file through a CTPAT-validated and licensed customs broker, roughly within 180 days (about November 30, 2026) — alongside a 50% minimum penalty floor and an importer good-standing requirement. On the Canadian side, Bill S-211 was clarified for 2026 on thresholds, definitions, and mandatory disclosures. The through-line: the supplier due diligence underneath these rules is no longer optional.

Why is supplier due diligence important?

Most failures don't happen inside your own four walls. They happen with third parties — and regulators increasingly hold you legally responsible for those third parties. A thin or undefensible answer isn't just a compliance gap; under Bill S-211— whose annual report is due May 31 each year, and whose thresholds, definitions, and mandatory disclosures were clarified for 2026 — it can mean a fine of up to $250,000, with directors and officers personally liable.

But the goal is not a flawless supply chain. No chain is ever perfect, and pretending otherwise is how people get caught flat-footed. The goal is provable diligence:

No supply chain will ever be at 100% — but you will prove your due diligence at 100%.

How do you conduct supplier due diligence?

Don't treat every supplier the same. A risk-based approach concentrates effort where it matters and keeps the process manageable:

• Categorize by risk. Sort suppliers low-to-high based on what they handle, where they operate, and what they could expose you to.
• Apply proportional scrutiny. Light-touch checks for low-risk vendors; deep assessment for high-risk ones.
• Verify the basics. Legal existence, ownership, registrations, required certifications, financial solvency.
• Assess ESG, labour, and security. The areas where the real exposure — and the legal liability — concentrates.
• Monitor continuously. Event-based, not just an annual snapshot. Risk changes between reviews.
• Standardize the criteria. Judge every supplier the same way so the results are comparable and defensible.

One thing to capture that checklists almost always miss: not only what a supplier tells you, but how they tell you. A supplier guided through a live scenario assessment — answering realistic situations out loud while behavioral signals like hesitation and low-confidence wording are read in the background — reveals the gap between the written procedure and the lived reality.

Due diligence vs. a supplier audit — what's the difference?

People use the terms interchangeably, but they aren't the same. A supplier audit is usually a point-in-time, often self-reported or checklist-based snapshot — useful, but easy to rehearse. Due diligenceis the broader, ongoing discipline of verifying and monitoring a supplier's legitimacy, compliance, and risk over time.

The practical difference is what each one misses. A static, self-reported audit can be filled in perfectly by a supplier who does none of it. A living assessment that is determined by the evaluation — never self-scored — and that reads behavioral signals surfaces the things a form hides: coercion, rehearsed answers, and the quiet gap between policy and practice.

What should a supplier due-diligence checklist include?

At a minimum, a defensible program covers:

• Legal existence and ownership structure
• Financial solvency and stability
• Required certifications and regulatory compliance for the programs you carry
• ESG and labour practices (including forced- and child-labour exposure)
• Cybersecurity and data-handling posture
• Geographic, geopolitical, and concentration exposure
• A remediation plan — with named owners and deadlines — for every gap found
• Ongoing monitoring, not a one-time pass

The most useful upgrade to a static checklist is to score it against the specific programs you actually carry, organized the way regulators read it — for example, against the ten C-TPAT Minimum Security Criteria categories — so each requirement can be evidenced individually.

How often should I assess my suppliers?

Frequency should follow risk. Review your most critical suppliers quarterly, the broader chain at least annually, and keep continuous, event-based monitoring running in between. Trusted-trader programs generally expect a roughly 12-month re-attestation cadence — and a supplier that keeps scraping by with a borderline rating year after year is a trend worth flagging even before the score actually fails.

A practical rhythm: begin renewal outreach 60–90 days before any program or reporting deadline, so the evidence is in hand before the report is finalized rather than scrambled for afterward.

How do I assess suppliers I didn't know I had?

Tier-1 visibility isn't enough. The risk that hurts you usually hides in the sub-suppliers and FOB partners you never see. You cannot do due diligence on a supplier you can't name — so the first job is discovery: have each supplier name their own sub-suppliers, carriers, and transit points. That cargo-mapping step routinely surfaces parties no one knew existed and puts them on the map where they can finally be assessed.

What is a supplier risk score?

A supplier risk score quantifies a supplier's compliance and security posture so you can rank and prioritize. A robust composite weights the live assessment answers most heavily, then documentation, cargo data, and reputation/screening — producing a clear designation (for example, Verified, Conditional, or Not Verified at a defined threshold). The key property: it should be determined by the assessment, never self-reported, so the score reflects evidence and behavior rather than a supplier's own claim about itself.

The programs this maps to: Bill S-211 · C-TPAT