Skip to content
EMPOBase
en

How to check suppliers before you buy

By the EMPOBase team · · 4 min read

Short answer

Supplier due diligence is a set of checks you do before you place an order with a new supplier. Confirm who they are, that they are legally registered, that they can deliver, that nobody on your staff has a conflict with them, and that they are not on a sanctions or exclusion list. Do more checks for larger or riskier purchases, and keep the evidence.

Key points

  • Scale the checks to the value and risk of the purchase.
  • Confirm identity and registration from documents you verify yourself.
  • Ask staff to declare any link to the supplier before selection.
  • Check your donors' exclusion and sanctions requirements.
  • Keep the evidence in the supplier file and review it on a schedule.

Why check before you buy?

Once you have signed a contract and paid a deposit, a bad supplier is expensive to fix. The checks cost little compared with a lost advance, a failed delivery or a donor finding. They also protect your staff, who can show they followed a fair process.

What should you check?

Use this list as a base. Add or remove items for your context.

  1. Identity. Full legal name, trading name, physical address, phone and email. Visit or call to confirm the address exists.
  2. Registration. Proof of legal registration and, where it applies, a tax registration. Check the document with the issuing body where you can. Rules differ by country, so check what applies locally.
  3. Capacity. Can they supply the quantity and quality, in the time you need? Ask for similar past work, stock levels or site photos.
  4. References. Contact two or three other customers, and ask about delivery, quality and honesty.
  5. Financial standing. For large contracts, ask for recent accounts or a bank reference.
  6. Ownership and conflicts. Ask who owns the business. Ask your own staff to declare any family, business or personal link.
  7. Exclusion and sanctions. Check the supplier and its owners against the lists your donors and national law require.
  8. Bank details. Confirm the account is in the supplier’s name. Treat any request to change bank details as a warning sign, and verify by calling a known contact.

How much checking is enough?

Match the effort to the risk:

PurchaseValue and riskSuggested checks
Small, one-offLowIdentity, a basic registration check, price comparison
Mid-range, repeatMediumFull list above, with at least two references
Large or long-termHighFull list, site visit, financial review, committee approval
Safety-critical (medicines, food, construction)High, whatever the valueFull list plus quality certificates and inspection

Write these tiers in your policy, with value limits set by you. Our guide to approval limits uses the same banding idea.

How do you handle conflicts of interest?

Ask every person who takes part in selecting a supplier to sign a short declaration: do they have any link to the bidder? If yes, they step out of that decision. Record both the declaration and the step-out. Our article on managing conflict of interest in procurement goes further.

What should you do with the results?

  • File each check with the supplier’s record, with the date and the name of who did it.
  • Mark the supplier as approved, approved with conditions, or not approved.
  • Set a review date.
  • If a check fails, record why and do not buy until it is resolved.

Approval is not permanent. After a supplier has worked with you, add performance evidence using a vendor scorecard.

What are the common gaps?

  • Checking only at the start, never again.
  • Taking registration documents at face value.
  • Skipping checks for “urgent” purchases. Urgent buys are where fraud is easiest.
  • Relying on one person who knows the supplier personally.
  • Paying advances without any check on the supplier’s capacity.

A short example. An office wants to buy generators from a supplier it has not used before. The value is high, so the team does the full checks. Registration documents are confirmed with the issuing office. Two other customers confirm that deliveries were on time. A visit to the workshop shows real stock. A staff declaration form turns up one officer whose cousin works for the supplier, so that officer steps out of the selection. The supplier is approved with a condition: payment on delivery, not in advance. All of this is filed under the supplier’s name.

What about suppliers recommended by a partner or donor? A recommendation is a reason to look, not a reason to skip the checks. Do the same checks, and note the source of the recommendation on the file.

How do you protect the bank details? Take bank details on the supplier’s letterhead, confirm them by calling a known number, and require a second person to approve any change. Fake change-of-bank requests are a common fraud, so build the habit early.

Who should do the checks? Pick someone who is not the requester and not the person who will approve the purchase. Give them a standard checklist, so the work is the same for every supplier, and ask them to sign and date the result. If your office is very small, ask a second person to review the file before the supplier is approved. The point is that no single person both finds and approves the supplier alone.

Where EMPOBase fits

In EMPOBase, Vendors holds supplier records, and a purchase order is issued to an eligible vendor. Vendor Scorecard keeps supplier performance on the record after the first order. The checks themselves, such as confirming registration or screening against lists, are work your team does outside the software; EMPOBase is where you keep the result and the history. Conflict of Interest is also a feature in the governance area. See the procure-to-pay workflow for where vendors sit in the chain.

Questions people ask

Do we check every supplier?

Check every new supplier at a basic level. Do deeper checks for large contracts, long-term agreements and higher-risk categories such as construction or medical items.

How often should we repeat the checks?

Review approved suppliers on a fixed cycle, such as once a year, and again if something changes, such as ownership, a complaint or a new contract type.

What is a red flag?

Examples are a supplier who cannot show registration, pressure to pay in advance, an address that does not exist, a bank account in another person's name, or a price far below all others.