Critical Outsourcing Due Diligence Checklist

Use this working checklist to convert critical outsourcing checklist UAE into a reviewable record. It is designed for completion by a named preparer and an independent approver, with applicability confirmed before evidence is requested.

*Reviewed: 5 October 2026. Owner: __________. Supplier: __________. Risk tier: __________. Review date: __________.*

Completion rules

• Use N/A with rationale rather than leaving an item blank.
• Link or identify the evidence; do not paste unnecessary identity data into the checklist.
• A possible match, missing result or discrepancy requires review, not an automatic pass or fail.
• Every exception needs an accountable approver, compensating control, remediation owner and expiry date.
• Set both an evidence-expiry reminder and event-driven reassessment triggers.

1. Criticality and materiality

• ☐ Define the exact requirement and confirm whether criticality and materiality applies to this supplier and transaction.
• ☐ Record the legal entity, evidence source, retrieval date and reviewer.
• ☐ Compare supplier-declared information with the authoritative or independent evidence available.
• ☐ Mark the result as verified, supplier-declared, expired, unavailable or unresolved.
• ☐ Escalate material mismatches; record the decision, approver, conditions and next trigger.

Evidence note: Attach only evidence relevant to criticality and materiality; avoid unnecessary personal data. The reviewer should write one sentence explaining what the evidence establishes, one sentence recording any limitation, and the date or event that requires criticality and materiality to be checked again.

2. Financial and operational capability

• ☐ Define the exact requirement and confirm whether financial and operational capability applies to this supplier and transaction.
• ☐ Record the legal entity, evidence source, retrieval date and reviewer.
• ☐ Compare supplier-declared information with the authoritative or independent evidence available.
• ☐ Mark the result as verified, supplier-declared, expired, unavailable or unresolved.
• ☐ Escalate material mismatches; record the decision, approver, conditions and next trigger.

Evidence note: Attach only evidence relevant to financial and operational capability; avoid unnecessary personal data. The reviewer should write one sentence explaining what the evidence establishes, one sentence recording any limitation, and the date or event that requires financial and operational capability to be checked again.

3. Security and resilience

• ☐ Define the exact requirement and confirm whether security and resilience applies to this supplier and transaction.
• ☐ Record the legal entity, evidence source, retrieval date and reviewer.
• ☐ Compare supplier-declared information with the authoritative or independent evidence available.
• ☐ Mark the result as verified, supplier-declared, expired, unavailable or unresolved.
• ☐ Escalate material mismatches; record the decision, approver, conditions and next trigger.

Evidence note: Attach only evidence relevant to security and resilience; avoid unnecessary personal data. The reviewer should write one sentence explaining what the evidence establishes, one sentence recording any limitation, and the date or event that requires security and resilience to be checked again.

4. Subcontracting and concentration

• ☐ Define the exact requirement and confirm whether subcontracting and concentration applies to this supplier and transaction.
• ☐ Record the legal entity, evidence source, retrieval date and reviewer.
• ☐ Compare supplier-declared information with the authoritative or independent evidence available.
• ☐ Mark the result as verified, supplier-declared, expired, unavailable or unresolved.
• ☐ Escalate material mismatches; record the decision, approver, conditions and next trigger.

Evidence note: Attach only evidence relevant to subcontracting and concentration; avoid unnecessary personal data. The reviewer should write one sentence explaining what the evidence establishes, one sentence recording any limitation, and the date or event that requires subcontracting and concentration to be checked again.

5. Contract and regulatory access

• ☐ Define the exact requirement and confirm whether contract and regulatory access applies to this supplier and transaction.
• ☐ Record the legal entity, evidence source, retrieval date and reviewer.
• ☐ Compare supplier-declared information with the authoritative or independent evidence available.
• ☐ Mark the result as verified, supplier-declared, expired, unavailable or unresolved.
• ☐ Escalate material mismatches; record the decision, approver, conditions and next trigger.

Evidence note: Attach only evidence relevant to contract and regulatory access; avoid unnecessary personal data. The reviewer should write one sentence explaining what the evidence establishes, one sentence recording any limitation, and the date or event that requires contract and regulatory access to be checked again.

6. Exit testing and monitoring

• ☐ Define the exact requirement and confirm whether exit testing and monitoring applies to this supplier and transaction.
• ☐ Record the legal entity, evidence source, retrieval date and reviewer.
• ☐ Compare supplier-declared information with the authoritative or independent evidence available.
• ☐ Mark the result as verified, supplier-declared, expired, unavailable or unresolved.
• ☐ Escalate material mismatches; record the decision, approver, conditions and next trigger.

Evidence note: Attach only evidence relevant to exit testing and monitoring; avoid unnecessary personal data. The reviewer should write one sentence explaining what the evidence establishes, one sentence recording any limitation, and the date or event that requires exit testing and monitoring to be checked again.

Final approval record

Important limitation

This checklist is general information and an operating aid, not legal, tax or regulatory advice. Tailor it to the buyer's legal status, sector, jurisdiction, transaction and policy; obtain specialist review where required.

Continue the workflow in Vendoreye

Use the vendor verification workflow to organise evidence, route accountable review and retain the decision record across the supplier lifecycle.