Written and maintained by CASRAI Editorial Board
Last updated
Short answer: vendor due diligence is the documented check a buyer makes of a vendor or supplier before signing, covering what the vendor says it does, what public records show, and what evidence it can hand over. A useful checklist records each item, the evidence seen, who checked it and when. This page is general information, not legal or compliance advice.
Definition and scope
Vendor due diligence is the verification step that happens before a contract, as distinct from scoring candidates against each other or ranking risk by criticality. For those, see the guides on vendor selection criteria and supplier risk assessment for lab procurement. Due diligence asks a narrower question: for the vendor already on the shortlist, is what it claims supported by evidence we can see?
Vendor vs supplier due diligence
The two phrases describe the same activity with a different emphasis. In common usage, “supplier” due diligence leans toward quality, ethics and supply-chain questions for goods, while “vendor” due diligence leans toward systems, data and service questions. The method is the same: define what must be true, ask for evidence, check what can be checked independently, and record the result.
How it is done in practice
A repeatable process has three parts, each tied to a requirement the buyer set in advance.
- State the requirement. The purchase specification and the contract terms define what the vendor must meet. Under the purchasing-control text of 21 CFR 820.50, purchasing data must “clearly describe or reference the specified requirements.”
- Evaluate against it and document the evaluation. The same text requires suppliers, contractors and consultants to be evaluated “on the basis of their ability to meet specified requirements,” and requires the evaluation to be documented.
- Keep the record. What was asked, what came back, who reviewed it and when is the audit trail.
Note on currency: the 820.50 wording above is the text shown by Cornell LII (checked 2026-11-03) as the purchasing-control requirement that applied to device manufacturers before FDA’s Quality Management System Regulation (QMSR). FDA states the QMSR became effective February 2, 2026 and incorporates ISO 13485:2016 by reference. A checklist that still cites 820.50 as its basis should be re-based on the current regulation.
Vendor due diligence checklist
The rows below are limited to items that a named public source supports. Each row separates what a buyer can verify itself from what it must request.
| What is being verified | What the source says | Source (checked 2026-11-03) |
|---|---|---|
| Exclusion status of the vendor or its people | The HHS Office of Inspector General maintains the List of Excluded Individuals/Entities (LEIE) of all currently excluded individuals and entities. OIG says health care entities need to routinely check it, and that no payment will be made under Medicare, Medicaid and other federal programs for items or services furnished, ordered or prescribed by an excluded individual or entity. | HHS OIG, LEIE background (oig.hhs.gov/exclusions/background.asp) |
| Quality-system basis for a device manufacturer | FDA’s QMSR is effective February 2, 2026 and incorporates ISO 13485:2016 for medical device quality management systems. If an ISO clause conflicts with the FD&C Act or its regulations, the Act and regulations control. | FDA, Quality Management System Regulation (QMSR) page |
| Documented evaluation against specified requirements | Purchasing procedures must ensure purchased product and services conform to specified requirements; supplier evaluation must be documented (pre-QMSR text). | 21 CFR 820.50, Cornell LII |
What a checklist record must show
Because the documented evaluation is the part regulators emphasize, each checklist line should capture four things: the item checked, the evidence seen (a document, a record number, a screenshot of a public list), the person who checked it, and the date. An unticked box with no evidence is not a record of due diligence.
Supplier due diligence checklist
For suppliers of goods, the same four-field record applies. The sourced items are the exclusion check above and, for a device manufacturer, a request for evidence of its quality-system basis under the QMSR and ISO 13485:2016. Other items, such as financial, legal, ownership and site-visit checks, are common in vendor templates; this page does not present them as regulatory requirements. Add them from your own contract and policy requirements.
Where it matters for labs and clinics
Labs and clinics that buy consumables, equipment and services from outside vendors carry the exclusion question on the buyer side: OIG describes the LEIE as a list health care entities need to check routinely, and the consequences it names (civil monetary penalties for hiring an excluded person, no federal program payment for their items or services) are why exclusion screening appears on health care checklists. The OIG page speaks about hiring individuals; apply it to vendors only as part of your own policy. For related areas see hospital vendor credentialing, service level agreements in medical supply vendor contracts and, for software and data vendors, assessing third-party AI vendor risk.
For cyber and supply-chain items, NIST SP 800-161 Rev. 1 (May 2022) gave guidance on identifying, assessing and mitigating cybersecurity risk in supply chains, noting that products and services may contain malicious functionality, be counterfeit or be vulnerable. NIST’s page shows the original May 2022 publication was withdrawn on 2024-11-01 and superseded by an updated version of SP 800-161 Rev. 1, so a checklist should cite the current version rather than the May 2022 text.
Common misunderstandings
- Due diligence is not a one-time form. The record is only as good as its dates; an evaluation from before a rule changed may cite a basis that no longer applies.
- A vendor’s own statement is not verification. A claim becomes a checked item only when you hold evidence or have checked a public record.
- A checklist is not a score. Ranking vendors is selection; due diligence confirms what is true about the one you intend to sign.
- Old regulatory citations do not carry over. The 820.50 text and the May 2022 NIST SP 800-161 Rev. 1 text both need the currency checks described above.
FAQ
What is the difference between vendor and supplier due diligence?
The activity is the same. In usage, supplier due diligence emphasizes quality and supply-chain questions for goods; vendor due diligence emphasizes systems, data and service questions.
What goes on a vendor due diligence checklist?
Each line needs the item, the evidence seen, who checked it and the date. Sourced items on this page are exclusion screening against the OIG LEIE, the quality-system basis under the QMSR and ISO 13485:2016 for device manufacturers, and a documented evaluation against specified requirements.
Does a supplier due diligence checklist differ from a vendor one?
The record format is identical; the items differ by what is being bought. Start from your purchase requirements and add only checks you can evidence.
Sources
- FDA, Quality Management System Regulation (QMSR), checked 2026-11-03.
- Cornell LII, 21 CFR 820.50 Purchasing controls, checked 2026-11-03.
- HHS OIG, Exclusions background (LEIE), checked 2026-11-03.
- NIST, SP 800-161 Rev. 1, checked 2026-11-03.
