Confirm who you are doing business with
Verify the legal name, contact details, relevant credentials, and the person authorized to agree to the engagement. Request a clear scope, pricing schedule, deliverables, and support process. Check references in a way that fits the importance of the work. Treat pressure to pay immediately or to use unusual methods as a reason to pause and verify through independently obtained contact information.
Review the operational and security exposure
Identify what the vendor can access: customer information, financial accounts, administrator permissions, or business-critical systems. Ask how access is controlled, how incidents are reported, and what happens to data at the end of the relationship. Use separate named accounts and the minimum permissions needed. For material risks, obtain qualified review of the contract, security evidence, and responsibility allocation rather than relying only on marketing claims.
Plan monitoring and the exit
Set a relationship owner, renewal reminder, performance measure, and process for approving changes. Preserve a copy of the signed agreement and verify banking changes through a known contact. Describe how the business can retrieve its data and continue operating if the vendor stops serving it. A low monthly price may be poor value when data cannot be exported or support is unavailable during a critical outage.
- Verify identity and payment instructions independently.
- Write the scope, fees, service expectations, and renewal terms.
- Limit access and request appropriate security evidence.
- Document data return, termination, and continuity arrangements.
Questions to consider
Do small suppliers need the same review as major systems?
Scale the review to the consequences of failure. A vendor holding sensitive customer records deserves more scrutiny than a supplier with no system access and a small replaceable order.
Is an emailed bank change enough?
Treat it as a request requiring independent verification. Contact the vendor through a previously trusted channel and follow the business’s payment approval procedure.
Official sources and further reading
Use this guide to prepare questions and organize records. It does not determine eligibility, establish a professional engagement or guarantee a tax or business outcome.