Supplier due diligence pack

Use one repeatable review sequence for every proposed supplier. You will finish with a pack that separates received evidence from unverified claims, assigns each gap to an owner, and gives the onboarding decision-maker a clear recommendation.

This is for operations managers and procurement teams handling questionnaires, certificates, service terms and internal controls. It supports a decision. It does not replace legal, security, finance or compliance review by the qualified person.

1. Set up the supplier case folder

Create one folder named [Supplier name] due diligence. Give every file a consistent name so that its source remains clear:

• 01 Supplier questionnaire - received date
• 02 Insurance certificate - expiry date
• 03 Service terms - version or date
• 04 Internal requirements - business area
• 05 Evidence register
• 06 Due diligence pack

Add an evidence register before asking the model to review anything. Use these columns:

Field	Record
Evidence ID	A short identifier, such as INS-01
Document	File name and document type
Received	Date received
Relevant requirement	The internal control or supplier commitment it supports
Status	Received, expired, unclear, missing or needs review
Source location	Page, section, question number or appendix
Owner	Person responsible for resolving the item

This register stops the pack becoming a summary of whatever was uploaded most recently. It also gives reviewers a way to find the original evidence.

2. Turn internal requirements into a test list

Extract the relevant internal requirements from your onboarding checklist, risk policy, information security requirements and operational service needs. Do not paste an entire policy if only five controls apply.

Write each requirement as a testable statement. For example:

• Supplier holds current public liability insurance at the required level.
• Supplier can meet the agreed service hours and escalation route.
• Supplier accepts the required data handling and confidentiality terms.
• Supplier names an accountable service manager.
• Supplier can provide continuity arrangements for a service interruption.

Give every requirement a priority:

Priority	Use it when	Onboarding effect
Blocker	Work cannot start safely or within policy without it	Do not recommend onboarding until resolved
Material	It could disrupt delivery, cost or control	Escalate and set a completion date
Standard	It improves completeness but does not prevent initial onboarding	Track as a follow-up action

Keep the wording factual. Do not ask the model to decide whether a clause is legally enforceable or whether insurance is adequate for your organisation. Ask it to identify what the document says, what is absent, and where a qualified reviewer must decide.

3. Review documents against the same template

Provide the evidence register, the test list and the supplier documents to the model you are using. Use a single prompt for every supplier so the resulting packs are comparable.

Use this prompt, replacing the bracketed text:

Review the supplied supplier evidence against the internal requirements below.

For each requirement, return a table with:
1. Requirement ID and exact requirement
2. Evidence received, including document name and page, section or question reference
3. Supplier claim, if it differs from the evidence
4. Status: met, partly evidenced, not evidenced, expired, contradictory, or needs qualified review
5. Operational risk if unresolved
6. Recommended action and proposed owner
7. Decision impact: blocker, material, or standard

Rules:
- Do not infer that a requirement is met where the document is silent.
- Quote short supporting text only where needed.
- Flag conflicting dates, names, legal entities, service levels and expiry dates.
- Mark uncertain findings as "needs qualified review".
- Do not give legal, financial, medical or regulatory advice.

Internal requirements:
[Paste the test list]

Evidence register:
[Paste the register]

Supplier documents:
[Attach or paste the relevant documents]

If your available upload size, document handling or other capability affects the process, check the current details in the xAI documentation overview. For large packs, split the review by document type, then give the consolidated findings back to the model for a final register.

4. Build the pack from findings, not prose

Create 06 Due diligence pack with these sections, in this order:

1. Supplier and service: supplier legal entity, service being bought, business owner, proposed start date and reviewer.
2. Recommendation: recommend onboarding, recommend conditional onboarding, or do not recommend onboarding. State the conditions in one sentence.
3. Evidence received: list every document with its date, source and status.
4. Requirements assessment: include the review table from the model, edited for accuracy.
5. Missing and expiring items: show the evidence ID, required item, owner and due date.
6. Operational risks: describe the practical consequence, not just the missing document. For example, “No named escalation contact, incident response may be delayed outside business hours.”
7. Decisions and approvals: record who must accept a residual risk or approve an exception.

Write recommendations in controlled language:

• Recommend onboarding once current insurance evidence is received and verified.
• Recommend conditional onboarding, subject to the service owner accepting the unresolved continuity test by [date].
• Do not recommend onboarding while the supplier legal entity in the terms differs from the entity named on the certificate.

5. Check the pack against source documents

Read the pack beside the originals before sending it for approval. The model can organise evidence well, but it can confuse a statement in a questionnaire with proof, miss a qualification in a schedule, or attach the wrong date to the right document.

Check these items manually:

• Every item marked met has a document reference that actually supports it.
• Certificate holder names match the supplier entity you intend to contract with.
• Expiry dates are current and are not confused with issue dates.
• Service terms, order forms and questionnaires do not state conflicting service levels, notice periods or contacts.
• Each blocker and material gap has one owner and a realistic due date.
• The recommendation matches the unresolved blockers, rather than the overall tone of the supplier's response.

6. Keep the pack live through onboarding

Do not file the pack once the supplier is approved. Move open actions into the onboarding tracker and review them at the first service review. Set reminders for certificate expiry, promised evidence and any conditional onboarding date.

Keep the approved pack as the decision record. If the supplier changes legal entity, scope, subcontracting arrangement or key operating contact, reopen the relevant requirements rather than relying on the old recommendation.

When the review does not work

If the output is vague, the input was probably vague. Replace broad instructions such as “check compliance” with a numbered test list and required evidence types. If findings cannot be traced, require page or section references and reject uncited conclusions. If documents conflict, do not ask the model to choose the correct one. Mark the issue as contradictory, ask the supplier for clarification, and send the final decision to the appropriate internal reviewer.