A due diligence questionnaire is a structured set of questions and document requests you send a prospective vendor before contract, to confirm they are financially, operationally and legally fit to work with.

How many questions should a DDQ have?

For low-risk vendors, 15 to 25 questions across the essentials is enough. Higher-risk vendors (data processors, on-site contractors, safety-critical) warrant 40+.

Which sections are legally required?

Nothing here is compulsory in itself. Data protection questions matter under UK GDPR when personal data is processed. Modern slavery reporting is required for buyers above £36m turnover.

Should we re-run the DDQ each year?

For material vendors, yes - annually at minimum. Insurance renewals, personnel changes and certifications all lapse in a year.

Can Credbase send this out?

Yes. Credbase turns the DDQ into a shareable form, chases replies and files the answers and returned documents against each vendor automatically.

Free tool

Vendor due diligence questionnaire builder

Pick the sections that matter for this vendor and generate a clean, professional due diligence questionnaire in seconds. Copy or download the finished DDQ.

Who this is for

Procurement and vendor management teams onboarding new suppliers
Compliance and risk leads standardising DDQs across the business
Founders and ops leads running their first formal vendor reviews

Problem it solves

Most DDQs are copy-pasted from an old Word doc and either ask nothing useful or ask 200 irrelevant questions. This builds a proportionate DDQ for each vendor in under a minute.

Vendor (optional)Your organisation (optional)

Sections to include

Company detailsConfirm you are dealing with the legal entity you think you are.Financial standingSense-check the vendor can deliver over the contract term.InsuranceConfirm cover is in place at the levels your contract requires.Health and safetyEstablish the vendor's H&S maturity before any on-site work.Information securityScreen the vendor's controls before they touch your systems or data.Data protectionOnly ask when personal data will be processed on your behalf.Modern slaveryRequired for suppliers to UK organisations with turnover over £36m.ESG and sustainabilityUse when the buyer has net-zero or ESG reporting commitments.Client referencesGet warm references before signature, not after.

DDQ preview

6 sections · 26 questions · 13 documents

Company details

Confirm you are dealing with the legal entity you think you are.

Registered company name and Companies House number.
Registered address and any trading addresses.
Ultimate parent company, if any.
Primary contact name, role, email and phone.
VAT registration number.

Documents requested: Certificate of incorporation, Latest Companies House filing summary

Financial standing

Sense-check the vendor can deliver over the contract term.

Turnover for the last two full financial years.
Confirmation of no ongoing insolvency or CVA proceedings.
Number of full-time employees.
Are more than 25% of your revenues concentrated with a single client?

Documents requested: Most recent filed accounts, Bank reference letter (on request)

Insurance

Confirm cover is in place at the levels your contract requires.

Public liability cover level and insurer.
Employers' liability cover level and insurer.
Professional indemnity cover level, basis (claims-made / occurrence) and insurer.
Renewal date of each policy.
Any cyber liability cover in place, if applicable.

Documents requested: Public liability certificate, Employers' liability certificate, Professional indemnity certificate, Cyber liability certificate (if held)

Health and safety

Establish the vendor's H&S maturity before any on-site work.

Do you hold an SSIP-accredited scheme (CHAS, Constructionline, SafeContractor, Achilles)?
RIDDOR reportable incidents in the last 3 years.
Named competent H&S adviser (internal or external).
Is your H&S policy signed by a director and reviewed annually?

Documents requested: Health & safety policy, SSIP accreditation certificate (if held)

Information security

Screen the vendor's controls before they touch your systems or data.

Do you hold Cyber Essentials, Cyber Essentials Plus or ISO 27001?
Named information security lead.
Do you use MFA on all administrative accounts?
Do you have a documented incident response plan?
Where is customer data physically hosted?

Documents requested: Cyber Essentials / ISO 27001 certificate, Information security policy

Client references

Get warm references before signature, not after.

Two comparable client references with contact name, role and email.
Brief description of the scope delivered for each reference.
Contract length and value banding for each reference.

Documents requested: Case studies (optional)

How it works

Step 1
Set the vendor
Add vendor and your organisation name so the finished DDQ is ready to send.
Step 2
Pick sections
Toggle sections in or out based on the risk profile - data processors need more, one-off suppliers less.
Step 3
Send it out
Copy or download the DDQ, or turn it into a live request in Credbase to track replies.

Questions and answers

Where this tool stops

A questionnaire is only useful if suppliers actually complete it.

A neat DDQ in Word is the easy bit. Sending it to every vendor, chasing the ones who ignore it and reviewing the answers alongside their live documents is where DDQ programmes stall.

Credbase sends the DDQ as a shareable form, files the answers against each vendor and keeps them next to the actual evidence documents.

Run DDQs from Credbase Back to all tools

This tool is a plain-English guide for teams handling third-party paperwork. It is not legal, insurance or compliance advice. Confirm specifics with the counterparty or your own adviser before you rely on any output.