Article
Vendor due diligence questionnaire template for Australian risk teams
Adapt 18 service-provider due diligence questions, evidence requests and reviewer follow-ups, with a fictional SaaS answer worked through to a decision.
Contrata editorial team ·
A vendor due diligence questionnaire helps a buyer understand whether a service provider can deliver the proposed service and manage the risks it creates. A useful answer identifies the service, explains the control and points to evidence a reviewer can examine.
The template below contains 18 original questions for Australian risk and procurement teams. Copy the relevant rows into your own assessment and adapt them before sending. This is service-provider due diligence, rather than due diligence for buying a company. It is a starting question bank, not a complete legal checklist or a test that certifies a supplier as safe.
Scope the service before sending the questionnaire
First ask the internal sponsor what the supplier will actually do. Record the contracting entity, service owner, intended users, information involved, systems connected and proposed start date. Identify what happens if the service stops, returns incorrect results or exposes information.
Then decide which questions need supplier answers. A stationery supplier with no system access creates different questions from a customer-contact platform holding personal information. A low contract price does not make a sensitive data flow unimportant.
For each selected question, agree who will review the answer and what decision it could change. Mark exclusions with a reason. An unanswered question is not the same as a question that does not apply.
An ISACA practitioner article on third-party resilience recommends considering access, data sensitivity and business importance when directing assessment effort. That is useful professional commentary, rather than an Australian regulatory requirement.
Use these 18 vendor due diligence questions
The evidence suggestions are examples. Request the smallest relevant material that allows a sound review. Where documents contain sensitive security, financial or personal information, agree an authorised sharing method, redaction or controlled inspection. Do not ask a provider to email credentials, customer records or complete account lists.
Service identity and delivery capability
| Question and when to use it | Why it matters | Evidence to request | Reviewer follow-up |
|---|---|---|---|
| 1. Which legal entity will contract with us, and which entity delivers each part of the service? Use for every proposed arrangement. | A group brand may cover several operating entities. | Entity details and a service responsibility map. | Does the evidence concern the entity and service we will rely on? |
| 2. What is included, excluded and dependent on our team? Use before agreeing the service scope. | Unassigned work can undermine delivery. | Service description, exclusions and buyer/provider responsibilities. | Who owns each hand-off, exception and acceptance check? |
| 3. How will you meet our expected volumes, operating hours and quality needs? Use where capacity or timeliness matters. | A generic capability statement may omit peak demand. | Relevant capacity assumptions, performance history or a scoped demonstration. | What happens under the buyer's peak workload or staff absence? |
| 4. What supports your ability to keep providing this service financially? Scale depth to dependence and exposure. | Financial pressure can affect staffing, investment and continuity. | Appropriate entity-level financial information and explanations of relevant changes. | Does a finance specialist need to assess the period, entity coverage or limitations? |
| 5. Which specialist skills or permissions does delivery depend on? Use for specialist or regulated activities. | Capability may depend on particular people or authorisations. | Relevant qualifications, authorisation details where applicable, staffing and succession arrangements. | Who verifies applicability and what happens if key capability is lost? |
| 6. How do you check delivery quality and correct errors? Use where mistakes affect customers or downstream work. | Availability alone does not establish accurate delivery. | Quality checks, exception handling and a redacted example of corrective action. | Can we identify an error, its owner and how the result is checked? |
Data, access and dependencies
| Question and when to use it | Why it matters | Evidence to request | Reviewer follow-up |
|---|---|---|---|
| 7. What information will you receive, create, retain or use for another purpose? Use when information enters the service. | The intended data flow determines the review scope. | Data-flow description, retention approach and proposed uses. | Does the proposal include support copies, analytics or AI use we have not assessed? |
| 8. Where will our information be stored and where can delivery or support staff access it? Use for hosted or remotely supported services. | Hosting location and access location can differ. | Relevant countries, service components and access arrangements. | Which locations require privacy, security or legal review in our circumstances? |
| 9. How is access approved, limited, reviewed and removed? Use for supplier or customer access to systems or data. | Access can outlast a role or reach more information than needed. | Service-specific process, recent scoped review results and unresolved exceptions. | Does it cover administrators, support access, integrations and non-human accounts? |
| 10. Which security controls and assurance cover the proposed service? Use for technology or information exposure. | A policy or certificate may cover a different environment. | Relevant assurance scope, period, exceptions and customer responsibilities. | What can we rely on, and what remains outside the evidence? |
| 11. Which subcontractors or platforms are needed to deliver and recover our service? Use where external dependencies matter. | Several supplier brands can depend on the same infrastructure. | Roles of relevant dependencies, locations and continuity assumptions. | Is a supposedly separate fallback exposed to the same failure? |
| 12. How will you tell us about relevant changes to the service or delivery chain? Use for an ongoing arrangement. | A later change can invalidate the original assessment. | Change-notification process and proposed contractual commitments. | Which changes need review before implementation, and who receives the notice? |
If the service includes AI, use the AI supplier due diligence guide to examine authority, model dependencies, tests and human fallback. The data questions above do not cover that specialist assessment on their own.
Disruption, incidents and exit
| Question and when to use it | Why it matters | Evidence to request | Reviewer follow-up |
|---|---|---|---|
| 13. What disruptions have you planned for, and what can the service deliver during recovery? Use where interruption has a consequence. | A recovery target needs to fit the buyer's operational needs. | Service-specific recovery approach, assumptions and dependencies. | What must our team do while the service is unavailable? |
| 14. What did the latest relevant recovery test demonstrate and exclude? Use when relying on recovery capability. | A plan describes intent; a scoped result supports a narrower conclusion. | Test date, scenario, actual results, exclusions and open actions. | Did it test our service path, data recovery and relevant hand-offs? |
| 15. How will you detect, escalate and communicate an incident affecting us? Use for ongoing service or data exposure. | The buyer needs usable information and a reachable contact. | Incident process, contact arrangements and proposed notice commitments. | Can both teams explain the initial information, channel and escalation? |
| 16. How will you investigate failures and verify corrective actions? Use when unresolved issues could recur. | A promised fix does not show that a control now works. | Redacted issue record, root-cause approach and closure evidence. | What result must be demonstrated before our finding closes? |
| 17. How can we retrieve and transfer the information needed to leave? Use when the buyer depends on supplier-held records. | A contractual export right may leave practical migration questions. | Export format, sample using synthetic data, transition support and dependencies. | Can the receiving team use the export, and what resources or costs remain? |
| 18. What happens to retained information and access after the service ends? Use for data or system access. | Contract closure may leave copies or permissions in place. | Retention/deletion process, treatment of backups and evidence available. | Who decides any retention basis, and what can actually be verified? |
For ICT suppliers, NIST SP 1326, published in July 2026, provides due-diligence considerations covering ownership or influence, provenance, resilience, cyber practices and supply-chain tiers. Its scope is ICT supply chains. The wider service questions here are our own adaptable template, not a reproduction of NIST or a claim that US guidance creates Australian obligations.
Work a vague answer through to a finding
Consider a fictional customer-contact SaaS provider. The buyer proposes to store customer names, contact details and service notes. All names, circumstances and outcomes in this example are invented.
Question 9 receives the answer: “Yes, all access is reviewed regularly.” The provider attaches a group access policy. The policy describes a process but does not establish whether it ran for the proposed service.
The reviewer asks a bounded follow-up: “For the customer-contact production service, what did the latest review cover? Please describe its date, whether support and non-human accounts were included, unresolved exceptions and the evidence available for controlled inspection.”
The provider then supplies a review summary covering employee accounts at 30 September. It excludes support service accounts. The reviewer records the supported conclusion and the gap separately:
| Record field | Fictional assessment entry |
|---|---|
| Supported finding | The supplied summary records a September employee-account review for the production service. |
| Evidence limit | Support service accounts are outside that review. The summary does not establish their permissions or review status. |
| Consequence | We cannot yet assess the access path used for support, including its reach into customer information. |
| Next action | Security reviewer to inspect the support access model and available review evidence with the provider before recommending production access. |
| Decision status | Open. Receipt of the employee review has not resolved the support-access question. |
This is why a yes/no answer needs space for evidence and reviewer reasoning. The response narrowed the uncertainty without eliminating it. For more examples, use the targeted evidence follow-up guide.
Keep the questionnaire separate from the approval
For each finding, retain the question, supplier answer, evidence reference and version, scope, date, reviewer conclusion, limitation, owner and next action. The assurance-report review guide helps when a report's coverage or exceptions determine the conclusion.
Use a short decision matrix to bring the answers together. These are suggested dispositions, subject to your organisation's authority and policies:
| Evidence position | Suggested next decision |
|---|---|
| Relevant evidence supports the needed conclusion | Record the rationale and any ongoing assumptions for the authorised decision-maker. |
| A significant question remains unanswered | Obtain targeted evidence or specialist review; identify whether it prevents commencement. |
| A known weakness remains | Consider remediation, a changed service or a documented decision within delegated authority. |
| The proposed arrangement cannot meet the buyer's requirements | Reconsider the scope, provider or proposal rather than averaging away the problem. |
For APRA-regulated entities, CPS 230 requires appropriate due diligence and financial and non-financial risk assessment before entering into or materially modifying a material arrangement, subject to applicable provisions. CPG 230 provides supporting guidance, including retained in-house capability. The guide does not itself create enforceable requirements. Neither source makes these 18 questions a mandatory questionnaire or a guarantee of compliance.
Your organisation retains the decision and its responsibilities. Route legal, privacy, financial, security and continuity questions to the appropriate specialists where needed. Finish with a decision record another reviewer can challenge: what is proposed, what the evidence supports, what remains unresolved and who is authorised to decide.