Vendor Vetting Checklist: Score, Screen and Shortlist

The provider sounds perfect on the call. They can meet your deadline, their quote fits, and they promise to handle everything. Then their insurance certificate expires halfway through the project, and nobody knows who was supposed to check it.

That's the problem a useful vendor vetting checklist solves. Not by collecting more answers, but by making someone responsible for verifying evidence, recording a decision, and checking again when something changes. A short checklist that someone maintains beats a long questionnaire nobody reopens.

Vendor Vetting Checklist Items and the Evidence Behind Each

Start with the work, not the vendor's presentation. Write down what they'll do, what information or accounts they'll access, and what happens if they fail. A gardener and a payroll provider shouldn't face identical security reviews, but neither gets a free pass on identity or accountability.

Use a shared spreadsheet for the checklist and a restricted folder for supporting documents. Give each vendor a named reviewer, decision status, evidence location, and next review date.

The working checklist

Vendor vetting checklist items, evidence and pass gates

These items cover the operational concerns in CISA's safe and secure ICT procurement guidance, including supplier governance, information security, physical and personnel security, supplier integrity, and resilience. That broader view helps prevent an unfamiliar service from slipping through a review designed only for familiar vendors.

Match evidence to the actual exposure

Equivalent evidence doesn't mean accepting a reassuring email. For a small scheduling provider, it could mean documented access restrictions, a demonstration of account permissions, and a tested deletion procedure rather than an enterprise audit report. For a vendor holding identity documents, ask for stronger independent assurance.

Check the substance of each document. An insurance certificate establishes policy details, not that every activity in your scope is covered. A license should match the person or entity performing the regulated work.

Convert material promises into written obligations. For delegated account access and confidentiality, the practical issues in virtual Assistant contracts are useful starting points: define authority, permitted access, deliverables, and termination responsibilities.

Say a property-maintenance provider relies on a replacement technician. Record who that person is, whether their credentials cover the work, and who confirms availability before the booking.

Practical rule: A completed form proves nothing on its own. An item passes only when supporting evidence exists and a named person owns its review date.

Weighting and Scoring Vendors Before You Compare Quotes

Set weights before quotes arrive. Otherwise, it's easy to adjust your priorities until the cheapest or most persuasive vendor wins.

The following is a proposed scoring model, not an industry benchmark. Score each criterion from 1 to 5, then calculate points = score ÷ 5 × weight. The maximum total is 100.

Vendor scoring weights and minimum scores

Reliability, quality, communication, and capacity carry 65% of this model. That prioritizes successful delivery without pretending price doesn't matter.

Use this sequence to keep the comparison consistent.

A reproducible worked example

Suppose Vendor B scores 4 on reliability, quality, communication, and capacity, and 3 on the remaining criteria.

Vendor A has the lowest price but scores 2 on reliability, below the proposed minimum of 4. It fails regardless of its total.

Legal identity, current insurance, privacy controls, and business continuity are also pass-or-fail gates. Don't award a high-weight score without written evidence, and don't mistake years trading or insurance for proof of financial strength. For a business-critical supplier, inspect financial evidence more closely.

Interview and Reference Check Questions That Expose Gaps

A vendor's written answers may look complete while leaving delivery risks unresolved. Use the interview to test whether the people doing the work can explain how they handle missed commitments, staff changes, subcontracting, and sensitive information. A short checklist that you revisit as the work changes is more useful than a long questionnaire no one maintains.

Questions for the vendor

1. Walk me through a commitment you missed and what you did next.
2. Who is my escalation contact if you're unreachable for six hours?
3. Which parts of the work do you subcontract, and to whom?
4. What is the backup if your lead person is sick during my booking window?
5. Where does my information live, and who can access it?

Ask for names, steps, and supporting records. A specific account of how a missed commitment was handled gives you something to assess; a promise that nothing ever goes wrong does not. For property work, a trade-specific list of questions to ask before hiring a contractor can help you prepare a more targeted conversation.

Questions for past clients

1. Would you hire them again for a deadline-sensitive job?
2. How quickly were problems resolved, and who resolved them?
3. Did the final invoice match the quote?
4. Were there surprise fees or scope changes?
5. What would you want them to fix first?

Choose references whose work resembles yours, not just the most enthusiastic clients. Successful routine maintenance does not show whether a provider can handle an urgent repair with restricted access. Use the video as a discussion aid, then record any follow-up questions your checklist raises.

Record each answer beside the criterion it supports, and revisit unresolved answers as the arrangement changes. A named backup with confirmed availability supports capacity; an unnamed person who might help does not establish continuity. Trust and accountability depend on observable commitments, not confidence alone. If an answer is vague, clarify it before approval rather than turning missing evidence into an average score.

Whistic's midyear update reports that 75% of companies surveyed used customized questionnaires and 83% used a centralized exchange for vendor security documentation. Those figures show that questionnaires and document exchanges are common tools, but neither replaces follow-up on the answers that affect your work. For teams tracking commitments over time, trust and accountability are practical standards: record what was promised, who owns it, and whether it was delivered.

Pricing Comparison Matrix and Negotiation Prompts

A headline rate is rarely the whole price. Compare the cost of completing the same scope, within the same window, under the same assumptions.

For example, a cleaning quote that excludes supplies and access arrangements isn't directly comparable with one that includes them. When checking the market, Gmaids' guide can help you find local commercial cleaning rates; use that context to question a quote, not to replace a scope-specific estimate.

Put the written quotes side by side before negotiating.

Pricing comparison matrix for vendor quotes

Compare completed-job totals

Consider a hypothetical two-hour job. Quote A lists $1,200 for a four-hour minimum, plus $180 travel, making its real cost $1,380. Quote B is $1,300 all-in, with a two-hour minimum and no travel fee.

Quote B is therefore $80 cheaper, despite having the higher headline price. Confirm that both quotes include the same materials and completion standard before selecting it.

Negotiation prompts to paste

Can you put travel and materials inside one number so we can compare on the same basis?

For a hypothetical booking with a month's lead time:

We can sign at 30 days if you accept a 20 percent deposit with the balance due on completion.

For vendors handling accounts or information, use this contract prompt:

Before any payment, we need written obligations on data protection, breach notification and recovery testing, because verbal assurances aren't a substitute for enforceable terms.

CISA's small-business vendor assessment guidance specifically addresses contractual protection of information, access controls, incident detection, and recovery with integrity verification. Have appropriate counsel settle enforceability rather than assuming a purchase order covers everything.

Red Flags That Go Beyond the Pass Gates

A vendor who refuses a written scope has already shown you how a disagreement is likely to unfold. Pause before paying, even if their portfolio looks excellent.

Some warnings concern behavior rather than missing documents. Others emerge when a vendor resists clarifying information already required for approval.

Vendor red flags, what they signal and the action to take

Geography doesn't settle data risk

Being US-based doesn't automatically make a vendor low risk. Confirm where its systems, backups, support staff, and subprocessors operate. A domestic address tells you little about who can open a shared document.

GBQ's guidance on vendor AI use highlights the need for visibility throughout the relationship. Ask whether customer information enters AI tools, whether it's retained for training, and what approval is needed before tools or models change.

For sensitive personal services, technical competence is only part of suitability. Bornbir's discussion of red flags when hiring a doula offers a service-specific lens for evaluating boundaries and fit.

We don't provide legal, medical, tax, or financial advice at Approved Lux, but we research and shortlist licensed professionals who do. Keep that boundary clear when delegating research: finding a professional isn't the same as supplying their advice.

An unresolved red flag ends the vendor's place on the shortlist.

Email and Text Scripts for Every Vetting Step

Use the channel that gets a useful response fastest, whether that's call, text, or email. Don't turn document collection into an extended correspondence project.

These scripts keep the ask clear without making the vendor decode your procurement process. Adjust the service, dates, and evidence requirements before sending.

Initial request by email

Hi [Name], we're reviewing providers for [service] starting [date]. Could you send your scope, insurance certificate, license number and two recent references by Friday?

This is an opening request, not the complete reference gate. Request the remaining comparable reference before making the approval decision.

Text nudge after 48 hours

Hi [Name], following up on the request I sent two days ago. Happy to take the documents by email or arrange a call if easier.

Offer a call to remove friction, but still obtain the actual documents. A conversation shouldn't replace the evidence you requested.

Call opener

I'm calling on behalf of a member comparing three providers. I have five questions on scope, subcontractors and timing. Is now a good time?

Use this when the comparison involves that number of providers. Otherwise, change the wording rather than inventing competitive pressure.

Reference request

May I ask three quick questions about your experience with [vendor] on a recent job?

Start with timing, problem resolution, and whether they'd hire the vendor again. Ask permission to continue if their answers reveal something that needs clarification.

Decline with the door open

Thanks for the quote. We're going with another provider this round, but please keep us in mind for future work.

Use that version for a suitable provider who lost the comparison, not for a supplier you've ruled out on integrity grounds.

For your own vendor file, log each contact attempt with its date and channel, and retain the scope and substantive replies. That lets a replacement reviewer continue without restarting the conversation.

Our member preferences and history are stored with the account, so whichever Assistant team member picks up already knows how the member likes things done. That shared context supports continuity without relying on the same person being available every time.

Approve, Condition or Reject, Then Keep Reviewing

Gates beat scores. A vendor that fails a mandatory gate is rejected regardless of its weighted total. A commercial concession can manage an acceptable exposure; it can't cure an identity mismatch or missing required protection.

Use the following as a proposed internal decision policy. Set it before evaluating candidates so exceptions don't become favors to persuasive suppliers.

Approve, condition, hold or reject decision matrix

In the hypothetical scoring example, Vendor B qualifies for conditional approval, assuming every gate and criterion minimum is satisfied. A tighter reporting obligation or milestone-based payment arrangement could address a remaining commercial concern. Record the condition, who verifies it, and what happens if it isn't met.

Keep the decision workflow visible to whoever authorizes work.

Screen before authorizing the relationship

Sanctions screening belongs inside the gate review, proportionate to the relationship's exposure. The OFAC sanctions compliance framework emphasizes management commitment, risk assessment, internal controls, testing and auditing, and training.

Record the approver, assess the vendor's owners, countries, and payment route, and screen relevant parties against applicable lists. Escalate potential matches rather than making an informal judgment, and rescreen when ownership, banking details, countries, or service scope changes.

Review when the relationship changes

Give every approval a dated review and named owner. Reassessment triggers should include:

• Organizational changes: New ownership, operating locations, or financial distress.
• Delivery changes: New subprocessors, AI tools, models, or service scope.
• Performance events: A breach, missed commitment, or unresolved complaint.
• Expiring evidence: Insurance, licenses, or assurance documents requiring replacement.

At renewal, rerun the gates with fresh evidence and confirm the exit arrangements still work. Practical vendor management best practices help turn approval into ongoing ownership rather than another forgotten administrative task.

Our research service includes comparing, vetting, and shortlisting vendors. Both Approved Lux plans include a step-by-step onboarding intake, and Lux Solo includes a dedicated onboarding intake, helping establish preferences before delegation begins.

Copy the checklist, set your weights, and run your first two vendors through it this week. Assign the review owner before you approve either one.

---

Approved Lux Personal Assistant offers vendor research, review synthesis, price negotiation, and shortlisting to reduce the follow-up work behind a sound decision. Visit Approved Lux Personal Assistant to delegate the comparison work to a human Assistant team and reclaim mental bandwidth for the decisions that need your judgment.