Vendor due diligence for accounting suppliers, from identity and tax links to exit terms

Due diligence should connect a vendor's identity and promises to the service the practice will actually configure. Use this checklist before a trial receives live client information, then scale the depth to sensitivity, dependency and deadline risk.

What to take away

Link the vendor's identity and promises to the service you will configure.
Scale checks to sensitivity, dependency and deadline risk.
Record each answer, its status, owner and due date.
Repeat checks after material changeincidents, ownership, subprocessors, renewals or wider use.

Identity and authority

Identity and authority checks

Record contracting legal entity and company number
Check current Companies House filings and status
Identify entity operating platform and holding data
Confirm who can bind the supplier
Preserve the signed contract version
Record adverse-media findings with date

Record the contracting legal entity, company number, trading names, address and ownership.
Check current Companies House filings and status. A live company record confirms filed information, not competence or financial strength.
Confirm the VAT number using HMRC's VAT number checker on GOV.UK.
Identify the entity operating the platform, providing support, invoicing and holding data.
Confirm who can bind the supplier and preserve the signed contract version.
Investigate material insolvency, litigation, regulatory or adverse-media findings with fair context and a recorded date.
Where the supplier handles client money, payments or credit, check whether it is authorised by the Financial Conduct Authority and view the Financial Services Register.

Product and UK workflow

Product and workflow verification

Write full product, edition, plan and version
Map required accounting, payroll and tax tasks
Demonstrate difficult cases using agreed script
Verify tax compatibility independently
Check unsupported user, entity and record types
Retain demonstration result and exceptions

Write the full product, edition, plan, add-ons, environment and version.
Map each required accounting, payroll, tax, filing and communication task.
Ask the vendor to demonstrate difficult cases using an agreed script.
Verify tax compatibility independently. HMRC's MTD for Income Tax software finder is circumstance-sensitive and changes as products develop.
Confirm support for Making Tax Digital for VAT, mandatory since 1 April 2022, and for MTD for Income Tax from April 2026.
Check which user, entity, period and record types are unsupported.
Retain the demonstration result and unresolved exceptions.

Personal data and confidentiality

Inventory people, data fields and retention periods
Determine controller, joint-controller and processor roles
Obtain processing terms and subprocessor list
Review international-transfer arrangements
Establish rights request and deletion routes
Prohibit unapproved reuse including model training

Inventory people, data fields, sources, purposes, recipients and retention periods.
Determine controller, joint-controller and processor roles from actual decisions. The ICO's role guidance explains the underlying concepts.
Obtain the supplier's processing terms, subprocessor list and location information.
Review international-transfer arrangements where relevant.
Establish routes for rights requests, correction, restriction, return, deletion and audit support.
Prohibit unapproved reuse of client material, including model training or product experiments.
Check the supplier's entry on the ICO register of fee payers and note the data protection fee tier that applies to it on the ICO fee page.
State retention periods in the contractVAT records normally run six years, and payroll records three years after the tax year.

Security and access

Require individual identities, strong authentication and appropriate role separation.
Examine privileged support access, joiner and leaver controls, logging and review.
Ask about encryption, secure development, vulnerability management and independent assurance.
Ask whether the supplier holds Cyber Essentials or Cyber Essentials Plus certification.
Test backup restoration, not just the existence of backups.
Agree incident notification content, contact routes and rapid escalation.
Check device, browser, integration and interface dependencies.

The NCSC's cloud security principles provide a structured set of considerations for cloud services. The practice must still decide how each principle applies to its own use and configuration.

Reliability and service

Review availability definitions, exclusions, maintenance and service-credit limits.
Request a relevant incident history and evidence of corrective work.
Document support hours, channels, targets, severity rules and escalation contacts.
Check capacity at tax, payroll and filing peaks.
Note UK peak dates, including the 31 January Self Assessment deadline and PAYE real time information deadlines.
Identify critical subprocessors and single points of failure.
Exercise a vendor outage using accessible contact and deadline procedures.

Commercial terms

Compare total cost at present, forecast and stressed volumes.
Confirm whether prices include VAT at the standard rate of 20%.
Read renewal, indexation, suspension, feature-change and termination clauses.
Renewal notice periods of 30 to 90 days are typical; confirm the actual period in the order form.
Align confidentiality, intellectual property, liability and insurance with the risk analysis.
Require advance control over material subcontracting or service changes where appropriate.
Ask for a clause giving 30 days' written notice before a subprocessor is added or changed.
Reconcile the proposal, order form, data terms and master agreement.

Migration and exit

Define import ownership, data cleansing, reconciliation and acceptance.
Produce a sample export containing transactions, attachments, identifiers and audit information.
Confirm format, timing, assistance, charges and read-only access after termination.
Typical exit terms allow CSV export with an audit trail, a read-only period of about 30 days and a full export within 10 working days.
Require deletion or return evidence and address backup copies.
Note that statutory retention can outlast the contractVAT records normally run six years.
Name an alternative process for urgent statutory work.

Decision record

Summarise the service dependency, worst credible failure, safeguards and remaining exposure. State which evidence expires and who must refresh it. Keep a declined-vendor note as well, so a later buyer does not unknowingly repeat the same investigation. Record the date of each check, including the Companies House and ICO lookups.

Give each unresolved item an owner and due date. Approval should state accepted residual risks and review triggers. Repeat checks after a material incident, ownership change, subprocessor addition, contract renewal or expansion of the practice's use.

For example, a decision record entry might read:

Item	Status	Owner	Due date
ICO registration and fee tier	Observed	Data protection lead	14 March 2026
Subprocessor list dated	Supplied	Vendor manager	21 March 2026
Export tested in CSV with audit trail	Absent	Finance systems lead	4 April 2026

Before you act

Record the contracting legal entity and ownership details.
Map required accounting, payroll, tax and filing tasks.
Inventory personal data and confirm controller or processor roles.
Check the supplier's ICO registration and data protection fee tier.
Test backup restoration and agree incident notification routes.
Compare total cost at present, forecast and stressed volumes.
Produce a sample export with transactions and audit information.

Common questions

What should be checked about a vendor's identity and authority?

Start from the contract. The entity that signs, invoices, operates the platform and holds the data can differ. A free Companies House search shows status and filings only. Use HMRC's VAT number checker to confirm a VAT number, and check the Financial Conduct Authority register where the supplier handles money or credit.

How should personal data and confidentiality be handled during due diligence?

Work out the roles first. A practice that decides why and how client data is used is likely to be a controller, not a processor. Ask for the processing terms and the current subprocessor list. Check the supplier's ICO registration and fee tier. Put retention periods in the contract, since VAT records normally run six years.

What should be included in migration and exit planning?

Test the exit before you sign. Ask for a sample export in CSV, with a PDF or CSV audit trail. Typical terms allow a read-only period of 30 days after termination and a full export within 10 working days, but confirm the figures in the contract. Ask for deletion evidence and a plan for urgent statutory work.