Use cases by capability
Is controlling third-party documentation mandatory?
The short answer is "it depends", and what it depends on can be explained.
The question nearly always arrives with a scare behind it: an inspection, a claim, or something someone read. The honest answer is that it depends on three things, and all three can be checked in five minutes.
What it depends on
| Factor | What to check |
|---|---|
| Your activity | In some sectors checking third parties is an express duty: construction, food, transport, among others |
| The relationship | Someone working on your premises changes things compared with someone who only sells to you |
| Your contracts | Many duties do not come from law: they come from what you signed with a large customer |
Important
This article is not legal advice and cannot tell you whether your case is covered. What it can tell you is where to look and what to ask: take these three questions to your adviser and you will come out of one meeting with an answer.
What tends to happen even where it is not mandatory
Even if no rule expressly obliges you, the problem arrives through another door: if a supplier of yours causes harm, the question of whether you checked anything comes up anyway. And answering "we did not check" is different from answering "we checked and this is what we held".
Watch out
The expensive part is usually not lacking the document: it is being unable to show you asked for it. A case shows the request with its date even if no answer ever came, and that changes the position entirely.
Worth knowing
If your customer requires you to check your suppliers, that is already an obligation of yours by contract, whether or not it has a legal basis. It is usually how it arrives.
›What if a supplier refuses to provide documents?
That is a commercial decision of yours. The case at least records that it was requested.
›Is asking once enough?
Rarely: what evidences something usually expires, and what matters is the status on the date of the work.
›Does this apply to small suppliers?
The duty rarely distinguishes by size; what can be adjusted is what you ask for.
A real case
The situation
A company receives a claim over damage caused by a subcontractor.
What you do
- Retrieves the case: documents were requested and some arrived
- The record shows what that firm held on the date of the work
What you get
The position moves from "we did not check" to "this is what we held and this is what we asked for", which is a different conversation.
The situation
Third-party documentation is controlled because a client demands it and nobody knows what the rules require.
What you do
- Checks with the adviser what applies to your activity
- Separates what the client demands from what the rules require
What you get
Effort is sized knowing where each requirement comes from.
The situation
Everything is requested just in case.
What you do
- Requests what answers a specific requirement
What you get
The supplier delivers sooner and the archive is usable.
The situation
Large suppliers are controlled and small ones are not.
What you do
- Matches the criteria to risk rather than size
What you get
The control covers where the exposure actually is.
The situation
A client asks how it is controlled and there is no written answer.
What you do
- Documents the criteria
What you get
The answer exists before the question.
The situation
Controls happen and nothing records that they did.
What you do
- Records the checks performed
What you get
The control moves from assertion to evidence.
This article answers
- is it mandatory to request supplier documentation
- must i check my subcontractors documentation
- what happens if i do not check a supplier
- liability for an undocumented supplier
- obligation to verify subcontractors