How to use: adapt this template to your organisation's jurisdictions, sector, risk appetite and delegation of authority. Assign accountable owners and obtain legal or specialist review where required.
| Domain | Check | Applicability | Evidence | Owner |
|---|---|---|---|---|
| Identity | Legal name and registration status | All vendors | Official registry extract | Procurement |
| Tax | Tax/VAT status | Where applicable | Authority verification | Finance |
| Ownership | Beneficial owners and signatory authority | Risk-based | Official records/declaration | Compliance |
| Cyber | Security and incident controls | Technology/data vendors | Assessment and evidence | Information Security |
| Privacy | Purpose, processing, transfers and deletion | Personal-data processors | DPA and assessment | Privacy |
| HSE | Licences, competence and incident controls | Site/field vendors | Certificates and records | HSE |
| Financial | Stability and concentration | Material/critical vendors | Accounts and analysis | Finance |
Related: Vendor onboarding policy guide · Risk-tiering framework · Vendor master governance
General information only, not legal advice. Verify requirements with the relevant competent authority and qualified advisers.