Most small businesses have a version of vendor due diligence that goes like this: someone recommends a tool or service, the price looks reasonable, the contract gets reviewed briefly, and it goes ahead. The thinking is that rigorous supplier assessment is something enterprises do, and that a company of 50 or 80 people can move faster by trusting its instincts.
That approach works until it doesn’t. A vendor that goes bust mid-project. A supplier that loses your customer data because their security practices hadn’t been checked. A contract with an auto-renewal clause that triggers a $40,000 commitment nobody noticed.
Vendor due diligence for a small or mid-size business isn’t about replicating an enterprise procurement process. It’s about asking a defined set of questions before you sign, rather than discovering the answers later when they’re more expensive.
Why this matters more than it used to
The risk profile of vendor relationships has changed. Businesses now share data with more suppliers than they did five years ago. Software vendors, contractors, agencies, and cloud services all have access to some portion of your systems, your customer data, or your financial records.
Third-party vendors are now involved in 48% of all data breaches, up from 30% the previous year.
The increase isn’t because vendors are less careful. It’s because the attack surface has expanded. Every SaaS integration, every agency that has access to your systems, every contractor with admin credentials is a potential entry point. A business with 40 vendors has 40 places where a compromise could start.
The cost of getting it wrong is material.
Third-party and supply chain compromises are the second costliest type of breach, averaging $4.91 million per incident. They also take the longest to detect and contain, at an average of 267 days from breach to resolution.
For a small business, a breach of that scale is not a setback. It’s potentially a company-ending event. The due diligence questions below won’t eliminate risk entirely, but they give you a structured way to identify the vendors that represent the most exposure before you’re committed to them.
The financial and commercial checks
Before agreeing to any commercial relationship, understand the commercial stability of the vendor and the terms you’re agreeing to.
Is the vendor financially stable? For small software vendors and boutique agencies, it’s worth asking directly. A company running on thin margins with no outside funding is a meaningful delivery risk. For Australian entities, ASIC company checks are free and give you incorporation status, registered address, and credit information.
What does the contract commit you to? Annual contracts with monthly payment schedules are common in SaaS. Look for: auto-renewal terms and notice periods, early termination penalties, and whether the price can be changed mid-contract.
Are there hidden costs? Implementation fees, onboarding fees, data migration charges, API access fees, and overage charges are common. Ask for a total cost estimate for the first 12 months, not just the monthly or annual licence cost.
Who is the commercial contact if something goes wrong? Knowing the account manager’s name before you sign costs nothing and saves time if there’s a billing dispute six months in.
The security and data handling checks
For any vendor that will have access to your systems, your customer data, or your financial records, security due diligence is not optional.
What data will they access? Be specific. A payroll provider needs payroll data. They don’t need access to your CRM. Map the data they’ll touch before agreeing to anything.
How is the data stored and protected? Ask: Where is data stored (country/region)? Is it encrypted at rest and in transit? Who within the vendor organisation can access it?
What certifications do they hold? ISO 27001 is the international standard for information security management. SOC 2 Type II is common for US-based SaaS vendors. Not every vendor will have these certifications, but their absence for a vendor handling sensitive data is a question worth asking.
What is their incident response process? If there is a breach, how will they notify you, how quickly, and what support will they provide?
Do they subcontract any work involving your data? Many cloud vendors use third-party infrastructure and subprocessors. Reputable vendors disclose their subprocessors in their privacy documentation.
The legal and contractual checks
Liability and indemnity. Most vendor contracts cap the vendor’s liability at the amount you’ve paid them in the past 12 months. For high-risk relationships, negotiate a higher cap or require professional indemnity insurance.
Data ownership and portability. Who owns the data you put into the system? What happens to it if you cancel? Can you export it in a usable format? Get the specifics.
Intellectual property. For any vendor producing creative work, code, or strategic outputs, the contract should specify who owns the deliverables. Work for hire gives you ownership. Licensing arrangements give you usage rights. Both can be appropriate, but you need to know which you have.
Governing law. A contract under a foreign jurisdiction can make disputes significantly more expensive to resolve. For contracts with international vendors, confirm the governing law clause and consider whether you need Australian law to apply.
For more on what to look for in vendor contracts before signing, our guide to vendor contract management covers the common clauses and how to negotiate them.
The operational checks
What is their uptime or delivery track record? SaaS vendors publish SLA documentation. Agencies and service providers don’t always, but you can ask for client references and check review platforms.
What are their support terms? Email support with a 72-hour response time is not the same as a dedicated account manager with a phone number. Be clear about what you need before you sign.
What does the offboarding process look like? The best time to understand how to exit a vendor relationship is before you enter it. Vendors that make exit difficult are using lock-in as a retention strategy.
Is there a dependency risk? If this vendor went down tomorrow, what would break? How long could your business operate without them?
Putting it together
You don’t need to apply the full checklist to every vendor. A $20-per-month productivity tool doesn’t warrant the same scrutiny as a data processing partner handling your customer records.
A practical approach is to tier your vendors by risk. High risk: vendors with access to sensitive data, vendors handling compliance-sensitive work, or vendors whose failure would significantly disrupt operations. Run the full checklist. Medium risk: vendors with limited system access or complex commercial terms. Run the financial, legal, and basic security checks. Low risk: commodity tools, low-cost SaaS with no data access. A brief commercial and contractual review is usually sufficient.
For a broader view of how vendor spend connects to your overall financial picture, the guide to vendor spend management explains how to track and categorise your full vendor base.
The companies that manage vendor risk well didn’t build elaborate risk management programs. They asked the right questions before signing, documented the answers, and made the process repeatable enough that it didn’t depend on one person remembering to do it.
Connect your Xero account and see every vendor your business pays, with spend categorised by type, in under an hour.
