# Partner and supplier due diligence on your company How partner and supplier due diligence on your company works: what buyers find, what they weigh, and how to audit and fix your file before they ask. --- Partner and supplier due diligence on your company starts with public registers and filings, then court and sanctions records, then news, reviews and social accounts, and increasingly an AI assistant. A prospective partner, supplier, distributor or enterprise buyer runs it. They are not hunting for a perfect company. They are looking for facts that do not match, records you did not mention, and risks that would be hard to explain to their own compliance team later. Almost everything they find is already public, and most of it can be read in an afternoon. A company that has read its own file first can correct what is wrong, explain what is true but unflattering, and hand over a complete pack of documents before it is asked. A company that has not learns what is in the file from the other side of the table, usually as a delayed onboarding or a quiet "we will get back to you". This article covers commercial counterparties only: those deciding whether to sign a contract, list you as a vendor, appoint you as a distributor or give you payment terms. Investors and acquirers run deeper, separate processes.
The short version
## How partner and supplier due diligence works before signing Counterparties research in layers. Published vendor checklists show the shape. One spend-management software vendor's checklist lists 44 checks in eight groups, among them company and legal, financial health, security and data privacy, reputation, sanctions and ESG, and insurance. A security-ratings vendor groups its list into five: basic company information, financial information, political and reputational risk, cyber risk and operational risk. Several items on those lists can be researched without asking the vendor: sanctions and watch lists, lawsuits and regulatory violations of the company or its key individuals, negative news, social media activity, and customer complaints and reviews. A large buyer splits the work between procurement, finance, compliance and information security. A small buyer has one person with a search engine and an afternoon. Either way, someone writes a short internal note that decides whether you move forward without friction. ### Risk decides the depth The UK Ministry of Justice [guidance to the Bribery Act 2010](https://assets.publishing.service.gov.uk/media/5d80cfc3ed915d51e9aff85a/bribery-act-2010-guidance.pdf) (Principle 4, UK law) says due diligence on people who perform services for an organization should be proportionate and risk based, and gives a plain contrast: contracting for IT services may need only light checks, while appointing an intermediary to help set up in a foreign market usually needs much more. For higher-risk cases it points to direct enquiries, indirect investigation and general research, and notes that ongoing monitoring may be needed. So what they find depends on what you ask them to trust you with. A supplier of office furniture is read lightly. A distributor, agent or reseller that touches the buyer's customers, data, money or regulators is read hard. ## Registers and filings: the layer they trust most Registers and filings come first because they are produced by the company or the state, not by critics, so a buyer treats them as the baseline against which everything else is compared. If your website, your contract and the register disagree, the register wins. In the UK, [GOV.UK](https://www.gov.uk/get-information-about-a-company) says anyone can get company information such as the registered address and date of incorporation, current and resigned officers, document images, mortgage charge data, previous company names and insolvency information from Companies House for free. In the United States, the SEC offers free public access to EDGAR, with company search by name or ticker and a full text search covering more than 20 years of filings. That mostly matters for public companies and their subsidiaries. If you are private, no EDGAR record is not a red flag; it tells the buyer to look at state registries, credit files and the documents you provide. Three further lookups sit beside the register: - **Credit and business identity data.** Dun and Bradstreet says getting a D-U-N-S Number is free and that organizations use it to assess a company's creditworthiness and to onboard it. For U.S.-based privately held companies, it says you can review your details and request changes at no cost through its D-U-N-S Manager tool. - **Legal entity identifier.** The Global Legal Entity Identifier Foundation describes the LEI as a 20-character code that gives anyone free access to identification data about a legal entity, including who owns whom. - **Official notices.** The Gazette in the UK publishes company and insolvency notices, among them administrations, liquidations, company director disqualification orders and companies removed from the register. ### What a filing pattern says about you Buyers read filing behavior as a proxy for management discipline. Late accounts say nothing about your product, but they say something about the business behind it. GOV.UK sets a ladder of penalties for a private company, and says not filing accounts or confirmation statements is a criminal offence for which directors or LLP designated members could be personally fined in the criminal courts. These are UK rules.
Late filing penalty for a private company's accounts, UKPenalty in pounds by how late the accounts are, private company or LLP; bar widths are relative to the largest amount
More than 6 months late£1,500
More than 3, up to 6 months£750
More than 1, up to 3 months£375
Not more than 1 month late£150

Source: GOV.UK late filing penalties guidance, as read. The penalty is doubled if accounts are filed late in two successive financial years. Public companies pay different, higher amounts. These are UK rules.

The fine is minor money. The cost is the pattern: a buyer who sees late filing year after year concludes the business is disorganized or short of cash. ## Litigation, sanctions and regulatory records Court, sanctions and regulatory searches decide whether a file is escalated to a person. A hit does not end a deal, but an unexplained hit slows it, and so does a hit on a name that is not even yours. ### Court records In the United States, federal court records sit in [PACER](https://pacer.uscourts.gov/pacer-pricing-how-fees-work). Its fee schedule, as read, is ten cents a page, with a three dollar cap per document and no charge if quarterly fees stay at 30 dollars or less. That is cheap enough that a careful buyer simply searches it. State and local courts keep their own systems, so PACER is a floor, not the full picture. What a buyer wants from a court record is not the existence of a dispute. Companies of any size get sued. They look for a pattern: payment disputes, repeated claims about the same issue, regulatory enforcement, and claims that suggest fraud. A single resolved commercial dispute is background. Five similar claims in two years is a finding. ### Sanctions and watch lists The U.S. Treasury's Office of Foreign Assets Control runs a [Sanctions List Search tool](https://ofac.treasury.gov/sanctions-list-search-tool) covering the SDN list and the non-SDN consolidated lists, and says it uses fuzzy logic on the name field to find potential matches. The word to take from that is "potential". Because matching is fuzzy, a company with a name close to a listed party, or a director who shares a name with a listed individual, can produce an alert, which a person then clears by looking at registration numbers, addresses and ownership. If your name is common or resembles a listed one, put a short name clearance note in your pack: legal name, registration number, registered address, ownership summary and a statement that you are not affiliated with similarly named parties. It saves the analyst an email. ### Distributors, agents and intermediaries For distributors, agents and consultants, research goes further. The U.S. Department of Justice and SEC Resource Guide to the Foreign Corrupt Practices Act (second edition, July 2020; U.S. law) lists third-party red flags that include excessive commissions to agents or consultants, unreasonably large discounts to distributors, consulting agreements with only vaguely described services, a consultant in a different line of business than the one it was engaged for, and a third party closely associated with a foreign official. If you sell through, or as, an intermediary, expect questions about your fee structure, ownership and the people you deal with. They are not accusations; they are what a compliance program is expected to ask. ## News and adverse media: how it is searched and weighed Adverse media screening means searching news and other published sources for unfavorable information about a company or its people, and buyers weigh the result by source quality, age and what you have said about it. A UK screening provider's explainer, published April 2023, defines adverse media as unfavourable news or information reported across a range of sources, and says checks look for suspected or confirmed links to money laundering, organized crime or fraud, political links, and a poor reputation including regulatory breaches. The same explainer says sources include newspapers, online outlets, blogs, social media, press releases and news archives; that keyword-based software flags stories and a person then decides whether to do business; and that accusations may be false, so flagged results inform a decision rather than settle it. It adds that social media chatter often appears before traditional news coverage. An analyst reading a flagged item asks a few questions. You can answer them in advance: - **Is it about you?** Same-name companies and former owners cause many false alerts. - **How old is it, and is it resolved?** A dispute from years ago that ended in a settlement or correction reads very differently from an open case. - **Who published it?** A regulator notice or a national outlet outweighs an anonymous blog. - **Is it accurate?** Errors can be corrected with the publisher; accurate coverage cannot. ## Reviews, complaints and social footprint Reviews and social accounts are corroboration, not proof. Buyers read them for patterns that match or contradict the register and the references: unpaid invoices, missed deliveries, staff turnover, or public posts that conflict with how the company presents itself. A sourcing guide for marketplace sellers lists the Better Business Bureau and LinkedIn among the places to check a supplier's legitimacy. Buyers can also ask peers informally, a channel you cannot see or answer. For a business-to-business company, three sets of signals usually matter more than consumer star ratings: customer-side review platforms and complaint listings; employee-side review sites, read for stability because high turnover in the team a buyer would deal with is a delivery risk; and the public profiles of directors and senior staff, checked for consistency with the company. ## AI answers: the first look many buyers now take A growing share of first looks happens through an AI assistant, and what it says is built from what it finds in the other layers. [Google says](https://developers.google.com/search/docs/appearance/ai-features) AI Overviews and AI Mode use query fan-out, running several related searches across subtopics and data sources, and show supporting links. For a page to be eligible as a supporting link it must be indexed and eligible to appear in Search with a snippet, with no additional requirements. OpenAI says ChatGPT search looks up the web when a question could benefit from current information, and its responses include inline citations and a list of sources. An assistant's answer about you is only as good as the pages it can retrieve, and because answers cite sources, the fix is usually at the source, not in the assistant. Typical errors are a wrong entity (a similar name elsewhere), former facts such as previous owners or addresses, merged histories where a predecessor's dispute is attributed to you, and gaps that suggest a thin footprint. Run the questions a buyer would ask on more than one assistant, and save the answers with the date. Our page on [AI search reputation](/ai-search-reputation) explains how those answers are formed and what can be corrected. ## What counterparties weigh when the signals disagree Counterparties weigh agreement across layers more than any single item. A tidy file passes; a file with unexplained contradictions gets slow-walked, however small each is. The table shows how common signals tend to be read. It describes how screening teams reason, not a published scoring rule.
SignalHow it is usually readWhat changes the readingYour move
Name or address differs between site and registerSloppiness, or a different entityA clear trading-name noteAlign site, contracts and register
Accounts filed lateWeak controls or cash pressureA stable filing run sinceFile on time, explain once
One resolved commercial disputeBackground noiseSettlement, small amountPrepare a two-line factual note
Repeated disputes, same issueA patternEvidence of a changed processShow what changed and when
Sanctions alert on a similar nameFalse positive until clearedRegistration and ownership dataSupply a name clearance note
Accurate, old negative articleContext, not disqualifyingAge, resolution, your responsePublish a dated factual statement
Inaccurate negative articleSerious until disprovedA published correctionAsk the publisher to correct it
Clustered payment complaintsCredit and conduct concernDated replies, resolved casesAnswer publicly, fix the cause
AI answer describes another companyUnreliable until correctedClear entity data at the sourceFix source pages and entity data
No certifications or policiesImmature, higher-risk vendorCompleted questionnaire, referencesShip a standing pack
## Audit your own file in the order a buyer would Audit yourself the way a buyer does, from the records they trust most to the answers they trust least, and write down every mismatch. The result is a one-page list, each item with an owner and a fix.
The self-audit, step by step
  1. Fix the legal identityWrite down the exact legal name, former names, registration number, registered address, officers and ownership as the register shows them. Compare them with your website footer, contracts, invoices and directory listings.
  2. Pull your filingsRead your last accounts, confirmation statements and any charges or insolvency data. Note anything overdue or filed late and when it was resolved.
  3. Search courts and noticesSearch the company name and each director in the court systems and official notices that apply where you operate. Record what is about you, what is not, and what is resolved.
  4. Screen your nameRun the company and its directors through a sanctions list search. Note near matches and write the clearance reasoning for each.
  5. Read the news as an analystSearch the company, former names, founders and products in news and social platforms. Log each item with date, source, accuracy and status.
  6. Ask the assistantsPut the same buyer questions to several AI assistants and save the answers. Mark each wrong, outdated or merged statement and the page it probably came from.
### A worked scenario This is a scenario, with invented generic parties. A 40-person parts distributor is preparing to bid for a framework supply contract with a large manufacturer. The audit finds four things. The website footer uses a trading name that differs from the registered name. Accounts were filed five months late two years ago and on time since. A supplier payment dispute from three years ago appears in a court listing and was settled. And an AI assistant describes the company with its previous owner's name and an old address. None of the four is disqualifying. Together, unexplained, they look like a company that does not control its own records. The fixes are small: align the footer and contracts to the registered name; note the filing history in the pack; prepare two sentences on the settled dispute; and correct the old directory pages the assistant draws on. Done before the bid, the analyst finds a consistent file; done after, four loose ends and four questions. ### A realistic schedule In most files a first pass takes about four weeks, and much of that is waiting on third parties. Treat these ranges as experience, not promises.
WeekWorkOutput
1Identity, filings, courts, sanctions, news and AI answers read and loggedOne-page discrepancy list with owners
2Own-property fixes: site, contracts, listings, credit data, entity pages; filing catch-upConsistent identity across owned sources
2 to 4Requests to directories, trade press, data providers and publishersCorrections requested and tracked
3 to 4Standing pack and short factual statements draftedPack ready to send on request
AfterRe-run the six checks on a scheduleNew mismatches caught early
Third-party corrections often outlast the four weeks, and some requests are refused. ## Fix each discrepancy at its source Every discrepancy has a source, and the fix belongs there. Fixing the symptom, an AI answer or a search result, rarely works while the source stays the same. Register errors go through the register's own process. For credit data, D&B says a U.S.-based privately held company can request changes through its free tool. Your own website, contracts and profiles are the quickest fix: put the legal name, registration number, registered address and a line on former names on a company page, with a short leadership and ownership page. Search engines and AI assistants read these when they decide which company is which. For inaccurate coverage, ask the publisher to correct or update the story, with documents that prove the error. For accurate coverage, a removal request will usually fail and can draw attention to it, so the route is context: a dated statement on your site and, where it fits, evidence of what changed. For reviews, reply factually and consistently; never post or buy reviews, and never ask staff to. For AI answers, correct the pages the answer cites and the entity data you control, then re-run the prompts. Our service page on [reputation monitoring](/reputation-monitoring) covers watching these layers once they are right. ## Build a due diligence pack that answers before it is asked A standing pack turns the questionnaire from a project into an attachment. It holds the facts buyers ask for most, in one place you keep current, so each counterparty gets the same consistent answers. - **Identity:** legal name, former names, registration number, registered address, officers, ownership summary, D-U-N-S Number and LEI if you have them, and a name clearance note. - **Financial:** latest filed accounts and your payment terms. - **References:** a few customers who agree to take a call. - **Legal:** a short note on any disclosed disputes and the licenses your sector needs. Where it applies to you, section 54 of the UK Modern Slavery Act 2015 requires a commercial organization carrying on business in the UK above a turnover threshold set by regulations to publish a slavery and human trafficking statement for each financial year and link to it prominently from its homepage; without a website it must supply a copy within 30 days of a written request. - **Security:** a completed standard questionnaire, insurance certificates and continuity plans. The ISO page for ISO/IEC 27001 says companies implementing it can decide whether to go through a certification process. The AICPA describes SOC reports as reports on controls at a service organization that help users assess outsourcing risk. - **Anti-bribery and sanctions:** a policy, a statement on third parties and agents, and the sanctions screening note. Keep a version date on the pack and one named owner. Two versions with different facts are treated as a finding. ## The next step: read your file before the next questionnaire Run the six-step audit while no deal depends on it. Most mismatches sit in your own properties and third-party directories and can usually be fixed within weeks. Reputation Partners runs the same audit as a private service.
If a deal is waiting on a check

If a buyer has asked for documents or a question about a record is holding up onboarding, send us the company name and the deal timeline. We will read your file the way their analyst will and tell you what to fix first. Start with a private audit.

## Questions people ask ### Do suppliers and partners really search the web about a small company? Yes, but the depth follows the risk. A low-risk subscription may get only a questionnaire. A distributor, agent or anyone handling money, data or customers is usually checked on registers, court and sanctions records, news and, increasingly, AI answers. Assume a search will happen, and prepare for it. ### Will I know when someone has researched my company? Usually not. Searching a public register, a court index or the web does not notify you. The visible signs are indirect: a questionnaire, a request for a specific document, a call about a record, or a delay with no reason. Ask the buyer for any finding they want you to address. ### Is one bad review a deal breaker for a business-to-business sale? Rarely. Buyers read reviews as a pattern across customers, employees and complaint listings, and a single unfavorable item without a pattern is background. What hurts is a cluster on the same issue with no visible answer. A factual, dated reply showing the cause was fixed does more than the review costs. ### Does a small company need ISO 27001 or a SOC 2 report to win enterprise work? Not always. Certification is a choice, and the buyer decides whether the work requires it. Many accept a completed security questionnaire, insurance cover and clear policies for lower-risk work. If you sell software, handle personal data or connect to a buyer's systems, expect the question and plan for it. ### Can an old lawsuit be removed from public records? Generally no, if it is an accurate court record. Whether any record can be sealed or limited depends on the court, the country and the case, and your counsel decides that. What you control is the explanation: a short, dated note stating what the case was, how it ended and what changed.