Question 512 - CGEIT discussion

A due diligence process is the best way to enable a clear understanding of the vendor's capabilities that will be critical to the enterprise's strategy. A due diligence process is a systematic and comprehensive investigation and evaluation of the vendor's background, reputation, performance, quality, reliability, security, compliance, and suitability for the enterprise's needs and expectations. A due diligence process can help the enterprise:

Verify the vendor's claims and credentials, and validate the vendor's references and testimonials

Assess the vendor's financial stability, legal status, and ethical standards

Identify the vendor's strengths, weaknesses, opportunities, and threats

Compare the vendor's offerings, capabilities, and prices with other vendors and market benchmarks

Determine the risks and benefits of engaging with the vendor, and the mitigation and contingency plans

Negotiate the terms and conditions of the contract, service level agreement (SLA), and key performance indicators (KPIs)

According to the CGEIT Review Manual 2022, 'Due diligence is a comprehensive appraisal of a business undertaken by a prospective buyer or partner to establish its assets and liabilities and evaluate its commercial potential.'1

According to the ISACA article on Third-Party Vendor Selection: If Done Right, It's a Win-Win2, ''Once you have identified which processes can be outsourced as well as their inherent risks, you can begin performing due diligence on potential vendors. The level of due diligence should be tailored to the significance of the relationship as well as the potential risks it poses.''

According to the Gartner article on How to Evaluate Technology Vendors in 4 Rigorous Steps1, ''Evaluating vendors requires detailed objectives, criteria, prioritization and monitoring. Here's help. When it comes to choosing a vendor, enterprise tech buyer teams can easily become bogged down in the details and documentation provided by sales teams.''