Tools and providers
Part of Official funding tools and supplier checks for a women founder funding service
Due diligence on vendors to a women founder funding service, identity to exit
A vendor due-diligence checklist for women founder funding services, covering identity, permissions, equality, security, claims, terms and exit.
Use this checklist before a supplier receives founder information, represents the service or influences a funding decision. Scale the depth to the risk, but do not skip identity, role or data checks because the vendor shares the organisation's mission.
What to take away
- Scale due diligence depth to risk but never skip identity, role or data checks.
- Approve access in stagesconfiguration and dummy data, then a bounded pilot, then wider use.
- Do not let a contract label hide regulated activity such as credit broking or investment promotion.
- Use statutory sources like the EHRC services Code of Practice for Equality Act duties.
Identity and capacity
- Confirm legal name, company number, address and trading names.
- Review filed status and officers at Companies House.
- Identify subcontractors and the people assigned to delivery.
- Obtain references for comparable work and verify them independently.
- Check financial resilience, insurance and business-continuity arrangements proportionately.
Permission and role
- Describe exactly what the vendor will say and do.
- Identify advice, arranging, credit broking, investment promotion or other regulated activity.
- Search the FCA Register where relevant and match permissions and trading names.
- Record reliance on a principal, approver or exemption.
- Define who decides eligibility, funding and complaints.
Do not allow a contract label to hide the real activity. For example, introducing founders to lenders for a commission can fall within the FCA regulated activity credit broking.
Regulated activity or not?
Does the vendor give advice, arrange deals, broker credit or promote investments?
Search FCA Register and match permissions
Record exemption or principal reliance
Equality and accessibility
- Review the basis for women-focused eligibility or outreach.
- Check treatment of mixed teams and voluntary demographic disclosure.
- Require accessible forms, meetings, documents and support.
- Test reasonable-adjustment handling and escalation.
- Examine selection and outcome gaps, with suitable privacy controls.
The EHRC's services Code of Practice is a current statutory source for Equality Act duties and limited exceptions in England, Scotland and Wales.
Data protection and security
- Map controller, joint-controller and processor roles for every dataset.
- Review purpose, lawful basis, special-category conditions and transparency.
- List hosting, international transfers and subprocessors.
- Test authentication, least privilege, audit, encryption and incident handling.
- Set retention, return, deletion and backup treatment.
Use the NCSC cloud security principles as a structured evidence request. Ask for proof and configuration detail, not a badge alone.
Claims and commercial model
- Trace success rates and case studies to defined records.
- Verify testimonials and incentives.
- Disclose commissions, referrals, sponsorship and equity interests.
- Compare total fees, renewal, expenses and long-tail charges.
- Ban guarantees of funding and unsupported founder stereotypes.
Contract and exit
- Define deliverables, acceptance, service levels, responsibilities and change control.
- Add confidentiality, intellectual property, publicity, audit and complaint provisions.
- Set breach notice, remediation, liability and insurance.
- Preserve usable data export and transition help.
- Require return or deletion evidence after termination.
Decision and monitoring
Record pass, conditional pass or reject for each gate, with evidence owner and expiry. Resolve high-risk conditions before access. Monitor incidents, complaints, delivery quality, demographic reach and subprocessor changes.
Re-run due diligence after a material service, ownership, regulatory or data-flow change. This checklist requires legal, security, accessibility and procurement review.
Write a decision memo. Summarise the service need, vendor, legal entity, assessed roles, data, founder population, critical dependencies and price. Attach evidence for each hard gate. List open issues, compensating controls, risk owner and expiry rather than hiding conditions inside meeting notes.
State why the organisation cannot meet the need with an existing approved supplier or manual process. This keeps mission-led enthusiasm from creating duplicate systems and uncontrolled copies of founder documents.
Approve access in stages. Begin with configuration and dummy data, then a bounded pilot, then wider use after defects close. A conditional approval should expire automatically if the vendor does not supply evidence by the agreed date.
Set monitoring frequency according to risk. Identity and permissions may need event-driven checks; access, incidents, performance and deletions need routine evidence.
Archive expired approvals so staff cannot reuse them for a changed service.
Before you act
Use this as the final sign-off gate, not a repeat of the detailed checks.
- Each hard gate has a named evidence owner and an expiry date.
- No high-risk condition remains unresolved before access.
- The decision memo states why no existing approved supplier or manual process meets the need.
- Access stages and monitoring frequency are set.
- The data return or deletion route is confirmed.
Common questions
What should I check about a vendor's identity and capacity?
See the identity and capacity checklist above for company records, references and resilience checks.
How do I handle data protection and security with vendors?
See the data protection and security checklist and use the NCSC cloud security principles as an evidence request.
What should a decision memo include for vendor approval?
See the decision and monitoring section for the memo fields, gates and open issues.
