Vendor compliance audit checklist
4 min read · Last updated
An insurer, lender, owner or internal auditor may ask to see how you verified your vendors. This checklist covers the evidence to keep, how reviewers sign off, the audit trail and the exports to prepare in advance. General information, not legal or insurance advice; check your contracts and your insurer.
What an auditor usually wants to see
Auditors look for three things: that each vendor was checked against a written requirement, that the check happened before work started and again at each renewal, and that someone can show the evidence. They rarely expect perfection. They do expect a record that is complete, consistent and dated.
Evidence to keep
Keep these items for every vendor in scope for the audit period.
- The current certificate or policy document for each required coverage
- Earlier certificates for the same coverage, so the history can be shown
- The written requirement each vendor was checked against, including minimums
- The dates each document was received, reviewed, approved or rejected
- The name of the reviewer and the backup reviewer
- Correspondence about missing, expired or below-minimum documents, and how each one was resolved
- Any written exception, with the approver and the reason
Reviewer sign-off
A review is credible when a named person signs it off. Use the same short checklist for every document: the insurer is named, the policy is in force on the review date, the certificate holder is correct, the limits meet the minimum, and any endorsement the contract requires is checked on the policy or endorsement itself.
VendorVault includes a reviewer checklist on each vendor page, so a reviewer can tick each check and the record keeps the ticks after a reload. Where your organization turns on document review, staff approve or reject each upload, and only approved documents count toward compliance.
The audit trail
The audit trail should show who did what and when: uploads, edits, approvals, rejections, role changes and exports. VendorVault keeps an activity log of uploads, vendor edits, role changes and exports, with who made each change and when.
Corrections should be new, dated entries that refer to the old value. Do not overwrite history to make a gap disappear.
Prepare exports before the request
Prepare the exports before the request arrives. VendorVault exports vendors and documents as CSV and zip files, and the compliance report is available as a CSV and as a printable page. Label each export with its date and the filter used, and keep a copy with the audit file.
Before the audit
Run these steps a few days ahead of the request.
- Check the status of every vendor, and close each expired item with a document or a recorded decision.
- Confirm that every reviewer and backup still holds the right role.
- Check that certificate holder names on file match your company's current legal name.
- Produce the exports and a short index that maps each vendor to its file.
During and after the audit
Answer from the record rather than from memory. If you find a gap, state it, show the action taken and its date, and leave the past entry unchanged. Keep a note of every question asked and every file provided, so the response can be repeated consistently.
Questions
How far back should the evidence go?
Cover the period the auditor asks about, and keep records for as long as your contracts require. Confirm the period with the person requesting the audit.
Can I edit old records during an audit?
No. Make corrections as new, dated entries that explain the change, so the history stays intact.
Is a spreadsheet acceptable?
It can be, if it is complete, dated, protected from casual edits and linked to the source documents. Auditors usually ask for the source documents.
Who should answer the auditor?
Name one contact to gather the records, and have the reviewer confirm each answer that depends on a judgment.
Related guides
Track every vendor document in one place.
Start a 14-day free trial. No credit card required.