Due Diligence and Ongoing Monitoring

When Vendors Go Silent: Document Everything (Yes, Even the Radio Silence)

Here's a reality check from the trenches: You've sent the request. You've followed up. And now… crickets. We've ALL been there.

Why it matters: When a vendor stops responding to your due diligence requests, it's more than frustrating-it's a red flag that puts your organization at risk. But here's the tip that can save you during your next exam or audit: Document the silence itself.

Your action item: Before you escalate, accept the risk, or walk away from the vendor relationship, create a paper trail of EVERYTHING:

• Every outreach attempt and follow up
• Dates, times, and methods of communication
• The specific documents requested
• Internal discussions and decisions made
• Management or board approvals for next steps

Why this protects you: Regulators and examiners expect documented vendor oversight. When you can demonstrate a consistent, well-documented process, even when vendors don't cooperate, you're showing that YOUR program is sound, regardless of vendor behavior.

💡 Pro tip: Non-responsiveness IS data. A vendor's refusal or inability to provide basic due diligence documents tells you something important about their operational maturity, transparency, and whether they're truly the right fit for your organization.

Now we want to hear from YOU:

What's your process when a vendor goes radio silent on due diligence requests?

• Do you have a specific escalation timeline?
• How many follow-ups before you involve senior management?
• Have you ever accepted alternative documentation and did it work out?
• What's the most creative solution you've used to get unresponsive vendors to engage?

Drop your strategies, war stories, and hard-won lessons in the comments below. Your experience could be exactly what a fellow risk professional needs to hear today!

What's your process when a vendor goes radio silent on due diligence requests?

First- I make sure the requirements are outlined in the agreement and the frequency for right to audit (not less than annually for critical vendors). My team will make the initial request at least 60 days in advance if not longer for notoriously late third parties. They are to get an acknowledgement or confirmation within a week, giving the vendor 30 days to provide documentation/response. If no acknowledgement is obtained we begin aggressive outreach to make sure we have the right contact. We can engage the business who typically has other direct contacts.  If all else fails and we cannot get a response we send a legal demand letter stating we will declare breach of contract if we do not get a response and commitment to provide the contractually agreed upon information by a certain date.               

I once put a hold on an expansion of services with a vendor because we could not get them to provide their due diligence timely. Then in the expanded agreements I added a provision that if they failed to meet the terms of the contract for right to audit delivery we could withhold 3 months of payment until the documentation was provided and satisfactory.  Of course that isn't going to work on every vendor, but it put an end to the torture that one vendor was to deal with for periodic reviews.