Vendor Due Diligence: A Practical Guide for People Teams Buying Equipment for the First Time

By [Author Name] · [Date] · [X] min read · [Table of Contents]

TL;DR

• Vendor due diligence is the work of finding out whether a supplier can actually do the thing it says it does, before you depend on it.
• If you're buying one batch of laptops from a reseller on a credit card, you don't need a diligence process and running one will just annoy everybody.
• It does four jobs: confirm the vendor exists properly, test capability in your hardest market, price the exit, and record what you were told.
• Three depths exist: a reference check, a documented review, and a full security and financial assessment.
• Pick the depth from how badly a failure would hurt you, not from the contract value.
• Done right, you can answer a customer's security questionnaire about your supply chain in an afternoon rather than a fortnight.

The questionnaire arrives from a customer's security team on a Tuesday and it has a section nobody in your company has thought about. Who ships your laptops. Where those laptops are stored between users. How you prove a leaver's device was wiped and who issued the certificate. You know the vendor's name, you know roughly what you pay them, and you discover that the contract was signed by somebody who left in March and lives in a folder nobody can find.

This isn't unusual. It isn't a sign of a badly run company either, because it's exactly what you would expect when a purchase made for operational convenience quietly becomes part of your control story. It's what happens when a purchase that started as an operational convenience becomes part of the story you tell customers about your controls. The same thing happens with a funding round, a first enterprise deal or an insurance renewal. Somebody outside asks a reasonable question and the answer turns out to live in three people's memories.

Recommended Tools

Best tools for HR Operations

B BambooHR HR management system R Rippling HR & IT automation W Workday Enterprise HRIS

View all recommended tools

The real issue isn't paperwork. It's that nobody tested whether the vendor can perform in the situation where you'll need it most, and nobody wrote down what they promised. Those two gaps cause almost every equipment vendor disappointment I've seen, and neither one is fixed by a longer contract. This is what vendor due diligence is supposed to solve.

When You Don't Actually Need Vendor Due Diligence

When the manual way is genuinely fine. You're buying hardware from a reseller, paying on delivery, and no supplier ever holds your data or touches a device after it leaves the box. There's nothing to assess beyond whether the invoice matches the quote. Running a questionnaire here tells you nothing you can act on and costs you the relationship's goodwill.

When the friction starts showing. The first sign is usually a question you cannot answer quickly, and the giveaway is that answering it requires emailing the supplier rather than opening a document you already hold. A manager asks which countries your supplier covers and you have to email them to find out. Somebody asks what happens if a device goes missing in transit and three people give three answers. The vendor is probably fine. Your record of the vendor is the thing that's failing.

When it becomes a liability. Two triggers, and they tend to arrive in the same quarter. A customer security questionnaire that asks about subprocessors and physical custody, or an auditor who wants evidence that leaver devices were wiped by somebody accountable. At that point the absence of diligence is itself the finding. You can't retrofit a conversation you never had.

The edge case that breaks everything. The vendor fails at the worst possible moment. A collection in a market they turn out not to cover properly, a delivery that stalls at customs because the importer of record was always going to be you, or a supplier who quietly stops responding during a market exit when you have forty machines in their warehouse. I'd rather spend two hours on diligence than two weeks on that.

What People Teams Actually Need from Vendor Due Diligence

> "Can they actually do the hard country on our list?" > A named process for that specific market, in writing, not a number on a map. > Coverage totals are marketing arithmetic, and the market that breaks you is always the one nobody asked about.

> "If this goes wrong, what do I show the auditor?" > A signed contract, a data processing agreement and a wipe certificate you've actually seen an example of. > Auditors are satisfied by evidence and accountability, not by assurances from a supplier you cannot produce.

> "What does leaving look like?" > A written answer covering who holds the devices, who ships them where, and what that costs. > Exit terms are the cheapest thing to negotiate before signing and the most expensive thing to discover afterwards.

> "Who is actually doing the work?" > The subcontractors behind the brand, because most logistics capability is partnered rather than owned. > You're inheriting their subcontractors' failure modes, so you should at least know they exist.

> "Will they still be here in three years?" > Some sense of funding, customer base and whether the product is their main business or a side module. > A vendor pivot is more likely than a vendor collapse, and it has the same effect on your roadmap.

The Three Depths of Equipment Vendor Diligence

The reference check. What it is: two or three conversations. One with a reference the vendor gives you, one with somebody you found yourself, and one internal check that the contract exists and somebody owns it. When it's right: contract value under roughly thirty thousand a year, no personal data beyond names and addresses, and no single market where failure would stop hiring. When it fails: it misses structural problems entirely. A vendor can have delighted customers in Germany and no real capability in Brazil, and a reference call will never surface that, because the reference is in Germany.

The documented review. What it is: a short written questionnaire, a request for four or five specific documents, and a decision recorded with a date and a name against it. When it's right: this is the right default for almost every mid-sized company buying equipment logistics. It's a day of work and it produces the artefact that answers next year's customer questionnaire. When it fails: when it becomes a form-filling ritual. A questionnaire the vendor answers in marketing language and nobody reads is worse than no questionnaire, because it creates a false record that somebody later relies on.

The full assessment. What it is: security review, financial review, penetration test summaries, subprocessor lists, insurance certificates and sometimes a site visit to the warehouse. When it's right: regulated industries, large contract values, or any arrangement where the vendor holds devices containing customer data at rest. When it fails: when applied to a small supplier who cannot resource it. You'll either get refused or get a pile of documents assembled to pass a test, and the smaller vendor who would have served you well walks away. Depth should match consequence.

How to Choose a Depth: Five Questions Before You Start

What's the worst thing that happens if this vendor disappears next month? Write the actual sentence. If the answer is "we'd buy laptops somewhere else and be mildly annoyed", you're in reference-check territory. If the answer involves forty devices in a warehouse you cannot access or a hiring freeze in two countries, you need the documented review at minimum. The consequence sets the depth, and contract value is a poor proxy for consequence.

Does the vendor hold personal data, devices, or both? These are different risks with different evidence. Holding a home address is a data processing question answered by an agreement. Holding a laptop that was issued to an employee and may still contain data is a physical custody question answered by a wipe process and a certificate. Vendors who are good at the first are not automatically good at the second, and the second is the one auditors ask about.

How many of your markets does the vendor treat as exceptions? Get the list. Mark your own markets against it, one by one, and keep the ones where the answer is partnered rather than owned in a separate column, because that column is the real subject of the conversation. Then ask, for each of your markets, whether the vendor operates there directly or through a partner. The partnered markets are not worse, but they're where the service level changes and where the answers get vaguer. Three vague answers in a row is a result, not a coincidence.

Who inside your company will own this afterwards? Diligence with no owner decays immediately. Somebody has to hold the contract, the renewal date and the record of what was promised, and that somebody should not be the person who happened to run the purchase. If you cannot name the owner before you start, the output will be a folder nobody opens, which is the most common outcome in this whole category.

What would make you say no? Decide this in advance and write it down. No data processing agreement, no answer on the importer of record in your two hardest markets, no exit terms in writing: pick your own, but pick them first. Criteria invented after you've met a likeable salesperson are not criteria. They're a rationalisation with a document attached.

The Documents Worth Requesting, and What Each One Tells You

Most diligence templates ask for too much and read none of it. Five documents do almost all of the useful work, and the thing to notice is what each one reveals beyond its face value.

The example certificate is the one I'd never skip. Ask for a real one with the customer details removed, and watch what happens. A vendor who produces it in a day generates these as a matter of course, which means the evidence will exist when you need it. A vendor who takes three weeks and sends something freshly made is telling you that it's an exception process, and exception processes fail under load.

The subprocessor list is the second most informative. Almost nobody in equipment logistics owns every warehouse and every courier relationship in every market, and that's fine. What matters is whether they'll tell you, because a vendor who presents partnered coverage as owned coverage has made a choice about how it handles awkward facts, and that choice will recur.

The Pricing Question, and Why Silence Is Information

Here's something specific to this category that general diligence advice will not tell you. Most equipment logistics vendors publish no pricing at all, and the pattern of who does and who doesn't is a usable signal.

I checked the main vendors in this space on 28 October 2026. The result was lopsided. Workwize, Firstbase, GroWrk, allwhere, Deel IT and Esevel publish no rate card. Among the asset-management vendors it's the same picture: Lansweeper publishes nothing a reader can price a fleet from, Asset Panda returned no currency figures at all, and both Oomnitza and Ivanti have no pricing page in the first place. CDW did not return a readable page to either a server request or a real browser, so nothing is quoted from it here.

That's not a scandal. Costs genuinely vary by country, device and volume, and a vendor that publishes one figure for a service priced differently in nineteen markets has created a support problem for itself rather than a transparency win. But it has three practical consequences for diligence, and they're worth planning around.

First, your evaluation calendar is longer than you think. Every quoted vendor is a sales cycle, and three quoted vendors in parallel is a month of calendar time before you can compare anything. Build that into the timeline you give your own stakeholders rather than discovering it in week three.

Second, you cannot compare without normalising the unit yourself. One vendor quotes per device per month, another per user, another as an annual platform fee with per-shipment charges on top. Take your own headcount, your own country split and your own joiner and leaver counts from the last two quarters, and run every quote through those numbers. The vendor's worked example is always sized to flatter the vendor.

Third, and this is the part people miss: a published figure is a diligence signal in its own right. A vendor willing to put a number on a public page has decided it can defend that number, and it has removed one round of negotiation from your process. Among the vendors in this lane, that's rare. RemoAsset publishes $1,499 a year for its Subscription tier. Electric AI publishes $10 per user per month at Essentials. Snipe-IT publishes a free self-hosted edition, with hosted tiers from $399.99 per year. Everyone else quotes. Disclosure: RemoAsset is our own product, so treat that entry as the one with an interest attached and check the other two yourself.

The Decision Table: How Much Diligence to Run

Most teams need the middle row and run either the top one or the bottom one. Running too little is the common error, and running too much is the expensive one.

Testing Capability Instead of Reading About It

The single highest-value hour in this whole process is not spent reading documents. It's spent making a vendor walk you through one real case, in detail, in your hardest market.

Pick an actual person. Not a persona: a real joiner you have coming up, or a real leaver from last quarter, in whichever country has given you the most trouble. Give the vendor the city, the device spec and the date. Then ask them to narrate it, step by step, and keep asking "and then who does that?" until you reach a named party for every step.

What you're listening for is specific, and it is worth writing the list down before the call so that you notice which of these questions gets answered in capabilities rather than in steps. Who is the importer of record. Whether the device ships from local stock or crosses a border. What the stated delivery window is and what it becomes if customs asks a question. Who books the collection when the person leaves, what triggers it, and whether packaging is included. Where the machine goes afterwards and whether storage is charged separately. Who issues the wipe certificate and how long it takes.

Vendors who do this work well find the conversation easy. They're describing a process they run daily, with named parties at every step, and the detail arrives without you having to pull it out of them. You can hear it. Vendors who don't will start speaking in capabilities rather than steps, and you'll notice the grammar change. That shift from "we do X" to "we can support X" is the most reliable tell in the category, and it costs you nothing to listen for it.

Then do the same thing for the week it goes wrong. The laptop is damaged in transit. The employee's address was wrong. The leaver has moved country since onboarding. Ask who you call, what the stated response time is, and whether that response time appears anywhere in the contract or only in the conversation. A service level that exists only in a sales call is a courtesy, not a commitment.

The Questionnaire That Actually Gets Answered

Long questionnaires get bad answers. A vendor facing ninety questions will delegate them to somebody whose job is answering questionnaires, and that person writes in the register of marketing rather than operations. Twelve questions, sent as a document and answered in writing, will tell you more than ninety will, because twelve questions get read by somebody who knows the answers.

Here is the set I'd actually send, grouped by what each group is testing. The grouping matters, because a vendor who is strong on one group and weak on another is telling you where to put the contract's teeth.

Send it cold, before the demos, and give a date. Two things happen. The vendors who answer in writing by the date have told you something real about how they'll behave in month nine, and the ones who reply asking for a call instead have told you something too. That isn't necessarily disqualifying, because some genuinely good vendors run a consultative motion and would rather talk, but it does mean your comparison will be built from notes rather than documents, so take the notes carefully and read them back.

The right-hand column is the part worth internalising. In my experience the single most common weak answer in this category is the country total offered in place of a per-market answer, and it's the one that causes the most expensive surprises later, because a total of eighty markets can be true at the same time as your particular three being awkward.

Judging Whether the Vendor Will Still Be Doing This in Three Years

The needs list above includes a question that most diligence templates ask and almost none answers usefully: will this vendor still be here. You cannot know. But you can read the signals, and three of them are available without a single financial statement.

The first is whether equipment is the main business or a module. This matters far more than size. A large employment platform with an IT module and a small vendor whose entire company is equipment logistics carry opposite risks. The large one is very unlikely to disappear and quite likely to deprioritise, which shows up as a feature request that sits for two years. The small one is more fragile and will answer your phone call on a Saturday. Neither risk is worse. They just want different contract lengths, and I'd take a shorter term with the module and a longer one with the specialist.

The second is the shape of the pricing. A vendor that publishes a figure has committed to a cost structure it believes it can hold, and it has chosen to be compared. A vendor that quotes everything has kept the flexibility to price each deal on its merits, which is commercially sensible and tells you that your renewal will also be a negotiation. Among the vendors in this category, published pricing is the exception rather than the rule, so do not read its absence as a warning sign on its own.

The third is how they talk about the awkward markets. A vendor describing partnered coverage as partnered coverage is being straightforward with you at a moment when being vague would be easier, and that is the single best proxy I know for how a vendor behaves when something goes wrong. The reverse holds too. A vendor who presents a partner's capability as its own has made a decision about awkward facts, and that decision will show up again in an incident report.

What about accounts and funding? Useful if you can get them, and often you cannot, because most of these companies are private and under no obligation to show you anything. If a vendor will share funding history or customer count, take it and sanity-check it. If not, do not let the gap stall the decision. The exit clause is the real protection against continuity risk, and a clean exit clause is worth more than a reassuring funding slide. Negotiate the clause and spend your remaining energy on capability.

The Reference Call Worth Making

Vendor-supplied references are not useless, they are just a specific instrument: they tell you what the vendor's best-case customer looks like and what that customer values. Ask them about the implementation week, because a happy customer will describe the rough parts honestly and you will learn where the work actually falls.

The reference you find yourself is the more valuable one, and it is easier to get than people assume. Ask in a peer community, or ask the vendor for a customer in a specific market rather than any customer, which is a reasonable request that occasionally produces a telling silence. Then ask four questions.

What has gone wrong, and what happened next? Every real customer has an answer, and the shape of the answer is the point. A customer who describes a problem and a resolution with named people is describing a functioning supplier. A customer who cannot think of anything that went wrong has either been lucky or is not using the service much.

How long does a collection actually take in your hardest market? Compare that against the window the vendor told you. The gap between those two numbers is the most useful figure you will acquire in the whole process, and it never appears in any document.

Who owns this internally, and how much of their week does it take? This is the real operating cost. It is the part no quote includes, and a vendor that saves somebody a day a week is worth a premium that will never show up anywhere in a per-device comparison table.

And what would you do differently? People answer this one generously, and the answers cluster in a way that is genuinely predictive of where your own project will struggle. If three customers independently say they wish they had cleaned their register before migrating, that is not three opinions. That is the project plan telling you something.

What Diligence Looks Like a Year Later

Diligence is usually treated as a gate and then forgotten, which wastes most of its value. The questionnaire you sent and the answers you got are an asset, and they have two uses after signature that nobody plans for.

The first is the renewal conversation. A year in, you know things you didn't know at the start: which markets actually caused trouble, how many collections slipped past thirty days, whether the delivery window held. Put that next to what the vendor told you in writing and the renewal stops being a price negotiation and becomes a performance conversation. That's a better conversation to be in, and you can only have it if somebody kept the original answers.

The second is the customer questionnaire. When a prospect's security team asks about your supply chain, the honest answer is assembled from exactly the documents you requested at the start: the contract, the data processing agreement, the subprocessor list and an example wipe certificate. Teams who did the diligence answer that in an afternoon. Teams who didn't spend two weeks chasing a supplier for documents while a deal waits, which is how a sales cycle slips a month for a reason nobody can explain to the board.

So the maintenance task is small. Once a quarter, somebody confirms the renewal date, notes any market where the service failed, and files any new certificate. Twenty minutes. The rule I'd set is that this belongs to whoever owns the supplier relationship rather than to whoever ran the purchase, because those are often different people and the handover is where ownership usually evaporates.

The Three Things Diligence Will Not Catch

Being honest about the limits is part of taking the exercise seriously, and there are three failures this process reliably misses.

A capable vendor in a bad quarter. Diligence tests the steady state. It cannot tell you that a vendor's warehouse partner in one country is about to lose a lease, or that the account manager who knows your fleet is about to resign. The mitigation is not more diligence. It's a contract with a short enough notice period that a bad quarter is survivable, which is why the exit clause matters more than the questionnaire.

Your own data quality. Every vendor evaluation assumes you can hand over an accurate starting register, and most teams cannot. If your current record is wrong about a hundred devices, the new vendor will inherit those hundred errors and you'll blame the platform for them by about month four. Fix the register before you migrate, or at least sample it honestly and tell the vendor the error rate, because a known error rate is a project plan and an unknown one is an argument waiting to happen.

The thing you didn't buy. This is the quiet one. Equipment logistics vendors, as a class, do not do network discovery and do not manage software licences. Not one of the logistics vendors named above does either. So if your real problem is that you don't know what hardware exists, or that your seat spend has drifted, this entire category is the wrong purchase and the best diligence process in the world will hand you a well-chosen vendor for a problem you don't have. Buy to the failure you named, and if you couldn't name one, that's the finding.

Who Signs, and Why That Decides More Than the Questionnaire

One structural thing decides whether any of this survives contact with reality, and it has nothing to do with vendors. It is who inside your company actually owns the decision.

Equipment purchases fall into a gap. They are not quite an IT buy, because the driver is usually a hiring or onboarding problem. They are not quite an HR buy, because the subject is hardware and custody. And they are rarely large enough to trigger a formal procurement process, so they end up with whoever felt the pain most acutely, which is often a people operations manager with no mandate to sign a three-year commitment. That person runs a sensible evaluation and then discovers at the end that finance wants a supplier review, security wants a questionnaire and legal wants the data processing agreement redlined.

The fix is cheap and almost nobody does it. Before you contact a single vendor, send four lines to the people who will need to agree: here is the problem, here is roughly what it will cost, here is who I plan to talk to, here is what I will need from each of you and when. That email takes ten minutes and it converts three sequential approval rounds into one parallel one. It also means that when the security questionnaire arrives from a customer eight months later, the security team already knows which supplier you chose and why.

A second point on signatures, learned the hard way by more than one team. The person who signs should not be the only person who holds the terms. Store the contract, the renewal date and the written answers somewhere that survives that person leaving, and put the renewal date in a shared calendar rather than in somebody's head. A supplier relationship that only one employee understands is a single point of failure that no amount of vendor diligence addresses. And it is the most common version of this problem that I see.

The Cost of Choosing the Wrong Vendor

The money is rarely the problem. A vendor that costs twenty per cent more than it should is an annoyance you can fix at renewal. What costs is the switching, and the switching cost is almost entirely in the record rather than the hardware. You import a fleet, operate for eighteen months, then leave, and you discover that what you can export is a list of current assignments rather than a history of custody. The device that changed hands twice in 2025 now has no provable trail, which matters precisely when somebody asks.

The second cost is the hiring one, and it's the one that gets attention internally. If equipment delivery is unreliable in a market, hiring managers learn to work around it, and the workaround is usually to let the new starter buy their own machine and claim it. That solves the week and creates a device you don't control, don't have a serial number for and cannot wipe. Three of those and your register is fiction. People will always route around a broken process, so a vendor failure in one market becomes a data problem everywhere.

The third cost is credibility, and it compounds. The first time you cannot answer a customer's supply-chain question, you promise to follow up. The second time, the customer's security team adds a condition to the contract. I've seen that condition become a quarterly evidence requirement that occupied one person for a day every three months, all of it downstream of a diligence conversation nobody had at the start.

So the diagnostic worth sitting with: are you assessing capability, assessing risk, or assembling evidence? Those are three different exercises, and most failed diligence processes are an attempt to do all three with one questionnaire.

When You're Ready to Move Beyond an Informal Supplier Relationship

The signals are specific. A customer has asked you about your supply chain in writing. Your equipment spend has passed the threshold where finance wants it in a supplier register. You have people in three or more countries where you have no entity. Somebody has left and their laptop has not come back, and the conversation about whose job that was had no clear answer. Any two of those and the informal arrangement has stopped being appropriate.

RemoAsset sits in that bracket deliberately: a published annual figure for the Subscription tier, procurement and retrieval stated across 80+ countries, and a 60% reduction in retrieval charges on that tier, which is the line most often missing from a comparison. It does no network discovery, so it will not find devices you've lost track of. It does no software licence management. And only the Subscription tier publishes a figure, since the pay-as-you-go side is quoted, which means the published number is a floor rather than a full answer.

If that's roughly your situation, the useful next step isn't a demo. It's sending the same five document requests to three vendors and seeing who answers in writing.

Frequently Asked Questions

Know what your supplier will do in your worst market, and have it in writing before you need it.