Pass supplier due diligence with evidence on file

You pass supplier due diligence by giving the buyer evidence it can verify, not just answers to its questionnaire. Banks, insurers and large corporates ask for the evidence behind each answer, so each answer needs a dated document the buyer can check and keep on file, owned by someone who keeps it current. This guide follows the work in order: finding the duty behind the questionnaire, checking what the buyer may reasonably ask, building the evidence pack, answering with evidence, meeting gaps with a plan, keeping evidence current, then what changes when the buyer is a public body.

Who owns the answers and what to have ready

Named topic owners across the business own the answers, and this guide is for the bid team that coordinates them when a supplier answers due diligence questionnaires from banks, insurers, institutional investors, and large corporates, whether the check comes before a first contract, a renewal, or a place on an approved supplier list. These questionnaires often run to hundreds of questions with regulatory weight, and the wider work of answering them is covered in DDQ response. No bid manager can answer them alone.

Most of the answers sit with people outside the bid team. Agree a named owner for each topic before the next questionnaire lands: finance for accounts and insurance, legal for ownership, sanctions, anti-bribery and contract terms, information security for certifications and controls, HR for workforce and human rights policies, and sustainability for environmental and supply-chain risks. Each owner supplies the evidence for their topic and stands behind it. The bid manager keeps the final sign-off.

Have these ready before you start:

• your most recent completed questionnaires, with the documents you attached to them
• the current version of every certificate, policy and report you expect to cite
• a list of topic owners, with a deputy for each
• the buyer's questionnaire, its covering letter and any code of conduct it asks you to sign

Find the duty behind the questionnaire

Read the questionnaire, its covering letter and any attached code of conduct for the law or regulator that drives the request, because that duty decides what the buyer must hold on file, and so what will satisfy it. A questionnaire citing a supply-chain law or a sector regulator asks for proof, not reassurance. For how the buyer frames the check from its side, see vendor due diligence.

The EU's Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470, applies only from 26 July 2029 and only to companies above 5,000 employees and EUR 1.5 billion net worldwide turnover, so read a request that cites it as preparation, not a current legal requirement.

Record the driver in the project before anyone drafts. It tells you whether a signature might settle a question or whether the buyer needs a document it can verify and keep.

Check what the buyer may reasonably ask

Query any request that the risk in your business does not warrant, because a questionnaire sent to every supplier alike can ask for far more than your business gives reason to.

Run four questions on any request that looks out of proportion:

1. Which law or policy does the buyer cite, and does the buyer fall within it?
2. Does the question touch a risk that could plausibly arise in your business?
3. Can the buyer get the information from a public register or a report you already publish?
4. Would the answer disclose a trade secret?

If the buyer falls outside the law it cites, the question touches no risk your business could plausibly carry, or the information already sits in a public register or a report you publish, answer what you can, point to the other source and ask which risk the question is meant to cover. If the answer would disclose a trade secret, answer what you can without it and say why you're holding it back. If none of the four applies, answer the request in full.

Build the evidence pack before it is asked for

Gather one current document per topic before any questionnaire arrives, each with a named owner, an issue date and an expiry or review date, because the buyer verifies against the document, not against your wording. Use this as a template:

Hold each document in the form a buyer can file: final, signed and dated, never a working draft. Name each file by topic, document and date so an answer can point to it exactly.

If you take part in an industry or multi-stakeholder initiative, keep its latest report in the pack and point to it whenever a question repeats what it already covers.

Answer with evidence, not assurances

Tie every answer to a named, dated document and the clause that supports it, because a buyer that has to verify can't file "yes, we comply". A short pattern covers most questions: "Yes. [Policy name], version [x], approved [date], section [y]. [Certificate] attached, valid to [date]." The answer states the fact, and the reference lets the buyer check it without asking you again. For the security questions in particular, see defensible security questionnaire answers.

Write as though the answer will be read long after you send it. Someone may open your answer years later with only the attachment beside it, so leave out "as discussed" and never refer to a document you haven't sent.

Keep answers consistent. The buyer can set your answer beside what you told it at the last renewal and beside your public filings. Answer the same question the same way across buyers unless the facts have changed, and when they have, say what changed and when.

Check every draft that general-purpose AI helped write. Gartner predicts that by 2028, 70% of organisations and vendors will use GenAI to complete and analyse third-party cyber risk questionnaires, says this makes the output less usable, and advises human analysts to validate GenAI work for critical third parties. Have each topic owner check their answers against the cited document before anything goes. A fluent answer that cites the wrong version does more harm than a short one.

In SEQUESTO: your team drafts each answer in SEQUESTO aOS with a citation to the policy document and clause it comes from, attaches evidence such as a SOC 2 report to the answer itself, and has the reviewer named on that question approve it before export.

Meet a gap with a remediation plan

Answer a gap with a dated remediation plan, never with silence or a vague assurance, because an unsupported claim is exactly what gives a verifying buyer reason to come back. Before you send, check for three kinds of answers that leave a buyer with a question: a claim with no document behind it, a document that has expired, and an answer that contradicts another answer or an earlier submission. Clear the second and third before you send. For the first, where the evidence doesn't exist yet, the plan is your answer.

Put these in every plan:

• the requirement you don't yet meet, in the buyer's words
• what you're doing about it, and who owns it
• the date each step will be done
• the evidence that will show it's done, and when the buyer will receive it

A buyer that finds a gap needs a plan credible enough to justify keeping you. Once you've sent one, report against its dates without waiting to be asked.

Keep the evidence current between checks

Give every document a review date and a list of events that trigger an early review, because an answer that was true at signing can be contradicted later by what the buyer sees. Where a buyer monitors, a lapsed certificate can surface long before your next questionnaire.

Set review dates by document type:

• For a document with an expiry, such as an insurance certificate or an ISO 27001 certificate, review it ahead of expiry by at least the time renewal takes.
• For a policy, use its own approval cycle.
• For accounts, review at each new filing.
• For ownership and control, review at each change on the register.

Review early when any of these happens: a change in ownership, control or directors; a certificate that lapses or narrows in scope; a policy update; or an incident. Update the document first. Then find every answer that relied on the old version and decide with its owner whether a buyer needs to hear about the change. That step only works if the library behind the pack keeps owners and versions traceable, which an auditable library sets out.

In SEQUESTO: each item in the Knowledge Hub keeps its owner, review cycle and expiry date, so expired material is flagged before it reaches a draft. When a policy is updated, every answer drawn from it is flagged for your team to review.

When the buyer is a public body

In a public tender, the check runs in the opposite order: you declare first and prove later.

EU tenders and the ESPD

In EU public tenders, the European Single Procurement Document is a self-declaration, and the supporting documents are requested later. Fill the ESPD from the evidence pack, not from memory, and check each declaration against the document you'd have to produce if you won.

UK tenders under the Procurement Act 2023

In England, Wales and Northern Ireland, the Procurement Act 2023 has governed new public procurements since 24 February 2025. Suppliers keep a record on Find a Tender with basic information, accounts from recent financial years, connected persons such as persons with significant control, and exclusion details under schedules 6 and 7 of the Act. The GOV.UK factsheet on the Central Digital Platform says the supplier is responsible for the accuracy of what it shares, the platform provides no assurance, and the buying organisation checks the information through its own due diligence. Treat the record as part of the pack: when ownership, accounts or your exclusion position change, update it the same day you update the document.

Supplier due diligence checklist

• The law or regulator behind the questionnaire is recorded in the project.
• Every extensive request has been tested for scope, relevance, other sources and trade secrets, and any query has gone to the buyer.
• Each topic in the evidence pack has one current document, a named owner, an issue date and an expiry or review date.
• Every answer names its document, version, date and clause, and its topic owner has checked it.
• Every gap carries a remediation plan with an owner, dates and the evidence that will close it.
• Each document has a review date and a list of events that trigger an early review.
• In a public tender, each ESPD declaration and Find a Tender entry matches the document you would produce.

Start with the questionnaire you answered most recently. Map each answer to the document behind it; answers with nothing behind them will show you where the pack needs work first.