vendor-due-diligence-patrick-munro

What this skill does

# Vendor Due Diligence Framework

## Overview
Comprehensive vendor assessment and due diligence framework for IT service providers, technology vendors, and third-party service providers. Creates structured risk assessments, evaluation reports, and ongoing monitoring frameworks across financial, operational, compliance, security, and reputational dimensions.

## LEGAL DISCLAIMER
**IMPORTANT: This skill provides general information and frameworks for vendor assessment purposes only. It does NOT constitute legal, financial, or professional advice. Users should:**
- Consult qualified legal counsel for specific legal requirements in their jurisdiction
- Engage appropriate financial and security professionals for detailed assessments
- Verify all regulatory requirements independently
- Adapt all frameworks to their specific organizational needs and risk tolerance
- Not rely on this skill as a substitute for professional due diligence services

**The frameworks provided are templates only. Actual vendor assessments require expertise in law, finance, cybersecurity, and risk management. Neither the skill creator nor Claude/Anthropic assumes any liability for decisions made based on this skill's output.**

## When to Use This Skill
Use this skill when you need to:
- Evaluate new vendors, technology providers, or service partners
- Conduct third-party risk assessments for procurement decisions
- Perform critical vendor due diligence for regulatory compliance (DORA, NIS2, GDPR, SOX, etc.)
- Create vendor onboarding documentation and assessment frameworks
- Establish ongoing vendor monitoring and review processes
- Assess vendor concentration risk and business continuity implications
- Generate executive-level vendor risk reports

## Core Capabilities

### 1. Three-Phase Assessment Process
**Phase 1: Initial Screening (Days 1-5)**
- Financial stability assessment (credit ratings, financial statements, market position)
- Basic compliance verification (certifications, licenses, regulatory status)
- Preliminary security posture review (ISO 27001, SOC 2, cyber insurance)
- Reputational check (news screening, litigation history, sanctions lists)
- Business continuity basics (disaster recovery, backup systems)

**Phase 2: Detailed Assessment (Days 5-15)**
- In-depth security evaluation (penetration testing, vulnerability management, incident response)
- Operational deep-dive (SLAs, performance metrics, capacity planning, change management)
- Compliance audit (GDPR, industry-specific regulations, data residency, cross-border transfers)
- Financial analysis (cash flow stability, debt ratios, insurance coverage, bonding capacity)
- Contractual risk review (liability caps, indemnification, IP ownership, termination rights)
- Subcontractor and fourth-party risk assessment

**Phase 3: Final Evaluation & Decision (Days 15-20)**
- Comprehensive risk scoring and rating (1-5 scale across all dimensions)
- Executive summary with recommendation (approve, approve with conditions, reject)
- Risk mitigation plan for identified gaps
- Onboarding roadmap with specific requirements
- Ongoing monitoring framework and KPIs

### 2. Multi-Factor Risk Scoring System
Each vendor receives scores (1=Low Risk to 5=Critical Risk) across:
- **Financial Risk**: Creditworthiness, revenue stability, insurance adequacy, concentration risk
- **Operational Risk**: Service delivery capability, business continuity, dependency/single points of failure
- **Compliance Risk**: Regulatory adherence, audit findings, data protection practices, certification status
- **Security Risk**: Cyber resilience, access controls, incident response, data encryption, vulnerability management
- **Reputational Risk**: Public perception, litigation history, ethical practices, ESG factors
- **Strategic Risk**: Service criticality, exit/transition difficulty, vendor lock-in, innovation capability

**Enhanced Feature**: Weighted risk calculations based on service criticality. Critical services (payment processing, customer data systems) receive 2x weight on security and compliance factors.

### 3. Regulatory Compliance Checklists
Pre-built assessment templates for:
- **GDPR**: Data processing agreements, sub-processor management, cross-border transfers, breach notification
- **DORA (Digital Operational Resilience Act)**: ICT third-party risk management, concentration risk, exit strategies
- **NIS2**: Supply chain security, incident reporting, security measures for essential/important entities
- **SOX**: Internal controls for financial reporting, audit trail requirements
- **PCI DSS**: Payment card data security (if applicable)
- **ISO 27001/SOC 2**: Information security management, control frameworks
- **Industry-specific**: HIPAA (healthcare), FINMA (financial services), FedRAMP (government)

**Enhanced Feature**: Regulatory gap analysis that identifies which requirements the vendor currently fails to meet and severity classification (blocker, major concern, minor gap, acceptable with mitigation).

### 4. Document Request Lists
Comprehensive documentation requirements organized by assessment phase:
- **Financial**: Audited financials (3 years), D&B reports, insurance certificates, bank references
- **Legal/Compliance**: Certifications (ISO, SOC 2), audit reports, privacy policies, DPAs, sub-processor lists
- **Security**: Penetration test results, vulnerability scan reports, incident response plans, disaster recovery documentation
- **Operational**: SLA templates, performance metrics, customer references, org charts, escalation procedures
- **Contractual**: Standard agreements, liability caps, indemnification terms, IP assignment provisions

### 5. Vendor Interview Frameworks
Structured interview guides for:
- **Executive Leadership**: Strategic vision, financial outlook, growth plans, M&A activity
- **Security/IT Teams**: Architecture reviews, access controls, encryption practices, patch management
- **Compliance Officers**: Regulatory adherence, audit processes, remediation tracking
- **Operations Managers**: Service delivery, incident management, change control, capacity planning
- **Legal/Contracts**: Negotiation flexibility, standard terms, liability frameworks

**Enhanced Feature**: Red flag detection prompts - specific questions designed to uncover hidden risks (e.g., "Describe your three most recent security incidents and response," "What percentage of revenue comes from your top 3 clients?")

### 6. Ongoing Monitoring Frameworks
Post-onboarding continuous oversight:
- **Quarterly Reviews**: Performance metrics, security updates, compliance status, financial health
- **Annual Assessments**: Full re-evaluation of risk scores, certification renewals, contract renegotiation
- **Event-Triggered Reviews**: M&A activity, security breaches, regulatory violations, leadership changes, service disruptions
- **KPI Dashboards**: Uptime, response times, security metrics, compliance status, financial indicators

**Enhanced Feature**: Early warning indicators (EWIs) that trigger immediate re-assessment - bankruptcy filings, mass layoffs, major customer losses, data breaches, audit failures, regulatory fines.

## Output Formats

### Vendor Risk Report
Comprehensive assessment report including:
- Executive summary with risk rating and recommendation
- Detailed findings by risk category with evidence
- Risk score matrix (visual heat map)
- Gap analysis against regulatory requirements
- Mitigation recommendations with priority levels
- Onboarding requirements and conditions
- Monitoring and review schedule

### Vendor Comparison Matrix
Side-by-side evaluation of multiple vendors:
- Risk scores across all dimensions
- Compliance coverage comparison
- Cost-benefit analysis
- Strengths/weaknesses summary
- Recommended vendor with justification

### Onboarding Checklist
Structured requirements list:
- Pre-contract deliverables (certifications, insurance, references)
- Contract negotiation priorities (liability, SLAs, termination rights)
- In