---
id: KB-CF-011
url: https://app.codecontract.io/help/use-cases-by-capability/is-controlling-third-party-documentation-mandatory
idioma: en
categoria: casos-por-funcionalidad
audiencia: usuario
nivel: basico
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-PS-008, KB-CF-009]
citadoPor: [KB-LE-004]
---

# Is controlling third-party documentation mandatory?

_The short answer is "it depends", and what it depends on can be explained._

**Responde a:** is it mandatory to request supplier documentation · must i check my subcontractors documentation · what happens if i do not check a supplier · liability for an undocumented supplier · obligation to verify subcontractors

The question nearly always arrives with a scare behind it: an inspection, a claim, or something someone read. The honest answer is that it depends on three things, and all three can be checked in five minutes.

## What it depends on

| Factor | What to check |
| --- | --- |
| Your activity | In some sectors checking third parties is an express duty: construction, food, transport, among others |
| The relationship | Someone working on your premises changes things compared with someone who only sells to you |
| Your contracts | Many duties do not come from law: they come from what you signed with a large customer |

> [!IMPORTANT]
> This article is not legal advice and cannot tell you whether your case is covered. What it can tell you is where to look and what to ask: take these three questions to your adviser and you will come out of one meeting with an answer.

## What tends to happen even where it is not mandatory

Even if no rule expressly obliges you, the problem arrives through another door: if a supplier of yours causes harm, the question of whether you checked anything comes up anyway. And answering "we did not check" is different from answering "we checked and this is what we held".

**En corto**

- Being able to show you asked, even if the other side never delivered.
- Being able to say what that company held on the date of the work, not today.
- That the check does not depend on somebody remembering.

> [!WARNING]
> The expensive part is usually not lacking the document: it is being unable to show you asked for it. A case shows the request with its date even if no answer ever came, and that changes the position entirely.

> [!NOTE]
> If your customer requires you to check your suppliers, that is already an obligation of yours by contract, whether or not it has a legal basis. It is usually how it arrives.

**What if a supplier refuses to provide documents?**

That is a commercial decision of yours. The case at least records that it was requested.

**Is asking once enough?**

Rarely: what evidences something usually expires, and what matters is the status on the date of the work.

**Does this apply to small suppliers?**

The duty rarely distinguishes by size; what can be adjusted is what you ask for.

## Ejemplos

**A company receives a claim over damage caused by a subcontractor.**

- Retrieves the case: documents were requested and some arrived
- The record shows what that firm held on the date of the work

→ The position moves from "we did not check" to "this is what we held and this is what we asked for", which is a different conversation.

**Third-party documentation is controlled because a client demands it and nobody knows what the rules require.**

- Checks with the adviser what applies to your activity
- Separates what the client demands from what the rules require

→ Effort is sized knowing where each requirement comes from.

**Everything is requested just in case.**

- Requests what answers a specific requirement

→ The supplier delivers sooner and the archive is usable.

**Large suppliers are controlled and small ones are not.**

- Matches the criteria to risk rather than size

→ The control covers where the exposure actually is.

**A client asks how it is controlled and there is no written answer.**

- Documents the criteria

→ The answer exists before the question.

**Controls happen and nothing records that they did.**

- Records the checks performed

→ The control moves from assertion to evidence.