Due Diligence That Is Proportionate
A small employer cannot audit a large supplier, and is still obliged to make a judgement. What that judgement reasonably consists of.
SUPPLIER ASSESSMENT
Scaled to what they hold, not to their size
- What they holdCategories and volumeA payroll bureau and a survey tool need different scrutiny
- CertificationsWhich, current, and what they coverScope matters more than the badge
- Security summaryTheir description, obtained in writingAsk. Most will send one
- Breach historyAsked about, and the answer recordedAn honest answer is more reassuring than none
- Sub-processorsList obtainedAvailable on request from most suppliers
- LocationPrimary, backup, supportThe transfer question
- ContractRequired terms presentChecked, not assumed
- DecisionProceed, proceed with conditions, or notRecorded with the reason
The obligation is to use only processors providing sufficient guarantees. For a small employer dealing with a large supplier, that cannot mean an audit, and it does mean something.
The supplier test in “Due Diligence That Is Proportionate” should cover the real data flow, not only the contract summary. Organisations considering explore the software for task switching cost should document hosting, subprocessors, permissions, deletion and export before rollout, then verify those controls during renewal and exit.
What proportionate looks like
For a supplier holding payroll or health data: a documented assessment, the security summary, the sub-processor list, the transfer position, and the contract checked against the required terms.
For a separate benchmark relevant to “Due Diligence That Is Proportionate”, consult the FBI counterintelligence resources. Use it to test purpose, data flow, retention, access and response procedures rather than substituting a generic checklist for the organisation’s actual records.
For a supplier holding little: the contract terms and a brief note that the assessment was considered and was light because of what is involved.
The scaling is by what they hold rather than by how large they are. A small tool holding sensitive data warrants more scrutiny than a large one holding almost none.
Certifications, read properly
A certification is evidence and not an answer.
What matters is the scope: which parts of the business, which services, which systems. A certification covering a different product line than the one you are buying establishes nothing about yours.
Ask for the scope statement rather than the logo.
The questions that take one email
Where is the data. Where is support. Who are your sub-processors. Have you had a breach affecting customer data, and what happened.
Most suppliers answer all four within a week. The fourth is the most informative, and an honest answer describing an incident and what changed is considerably more reassuring than a claim of none.
What a small employer can actually do
Ask, record the answers, read the contract, and make a judgement.
That is sufficient. The obligation is not to guarantee the supplier is secure; it is to have taken reasonable steps to satisfy yourself, and the record of having asked is what demonstrates it.
Where the answer is unsatisfactory
A supplier that will not say where the data is, will not name sub-processors, or offers only standard terms missing the required clauses.
That is a finding. It may still be the right supplier for commercial reasons, and the decision to proceed should be recorded with the reason and whatever conditions were applied.
Reviewing
On renewal, and when the service changes materially.
Suppliers move hosting, acquire companies and change sub-processors. An assessment from four years ago describes a different arrangement.
Reading a certification properly
The scope statement rather than the logo. A certificate covering a different service than the one you are buying establishes nothing about yours, and asking for the scope takes one email.
A supplier that will not say where the data is or name sub-processors. It may still be the right supplier commercially, and the decision to proceed should be recorded with the reason and any conditions.
Scaled by what they hold
A payroll bureau and a survey tool warrant different scrutiny. The scaling is by sensitivity and volume rather than by the supplier's size, which is the instinct to resist.
What a small employer can do
Ask, record the answers, read the contract, make a judgement. The obligation is not to guarantee the supplier is secure but to have taken reasonable steps — and the record of asking is what demonstrates it.
Reviewing on renewal
Suppliers move hosting, acquire companies and change sub-processors. An assessment from four years ago describes a different arrangement than the one you are now using.
Recording the decision
Proceed, proceed with conditions, or not — with the reason. A supplier assessment that produced a file and no recorded judgement has demonstrated process rather than diligence.