The red flags in vendor due diligence are findings in a third party’s file that question its ability to perform the activity safely. This could include exceptions on relied-on controls, a carved-out subservice organization, or an untested bridge-letter gap.
This article covers the factors in scope, where each warning sign shows up, its escalation, how to document an accepted flag and how a TPRM intelligence agent supports the review.
Which Vendor Files and Due Diligence Factors Apply
For banks, the Interagency Guidance on Third-Party Relationships lists 14 due diligence factors. The guidance sets the scope and degree of third party due diligence “commensurate with the level of risk and complexity” of the relationship.
A red flag therefore weighs more on a vendor supporting a higher-risk activity. Credit unions work from NCUA Supervisory Letter 07-01 (October 2007), which covers financial condition, independent audit reports, legal proceedings and related parties such as subcontractors.
A September 11, 2026 interagency proposal, joined by NCUA, would replace the 2023 guidance. However, as of publishing, this is not final and the 2023 guidance stays in effect until a final version is adopted.
Warning Signs in the SOC Report
Where System and Organization Controls (SOC) reports are relevant, the 2023 guidance suggests reviewing them and asks whether their scope and results fit the planned activity. Four signs in a SOC 1 report or SOC 2 report call for follow-up:
- Qualified or adverse opinion
A SOC 1 opinion is qualified when a control objective was not achieved, and adverse when most or all were not.
- Exceptions on relied-on controls
A testing exception does not automatically qualify the opinion, so an unmodified report can still carry exceptions that matter to the relationship.
- Carved-out subservice organizations
Under the carve-out method, the subservice organization’s controls are described but not tested.
- A bridge letter over a long gap
Service organization management writes the bridge letter, and the auditor tests nothing after the report period ends.
Red Flag Escalation Decision Table
Each due diligence red flag maps to a document, a 2023 guidance factor and an escalation path.
| Red flag | Where it shows up | Guidance factor | Escalation |
|---|---|---|---|
| Qualified or adverse opinion | SOC report opinion | Risk management | Remediation plan with dates; committee decision |
| Exceptions on relied-on controls | SOC testing results | Risk management | Map to CUECs and compensating controls |
| Carved-out subservice organization | SOC system description | Reliance on subcontractors | Obtain its SOC report; subcontractor notice terms |
| Bridge letter over a long gap | Management bridge letter | Risk management | Enhanced monitoring; interim evidence |
| Going-concern doubt | Audited financial statements | Financial condition | Credit review; exit plan before approval |
| Vendor or owner blocked by OFAC | Ownership chart; sanctions screening | Legal and regulatory compliance | Stop onboarding; route to the OFAC officer |
| Missing coverage for the activity | Certificate of insurance | Insurance coverage | Proof of coverage before go-live |
| No incident timelines; unresolved complaints | Incident policy; complaint history | Incident reporting; business experience | Contract notification terms; enhanced monitoring |
Documenting an Accepted Red Flag
When a banking organization cannot obtain the information it wants, the 2023 guidance says to identify and document the limitations and understand the risks they create. Alternatives include:
- Other information
- Added controls or ongoing monitoring
- A different third party
Information that warrants additional scrutiny is a reason to consider broadening the scope or assessment methods.
Management escalates significant issues to the board and monitors remediation, and the guidance’s documentation list includes “due diligence results and recommendations.” Examiners review remediation plans and discuss material risks with senior management and the board.
Vendor Due Diligence with the Ask Kaia Third-Party Risk Intelligence Agent
The Third-Party Risk Intelligence Agent screens sanctions, federal debarment, active enforcement and insolvency findings with links to supporting records. It shows source dates and unavailable information before a reviewer relies on a finding, and maps evidence to the institution’s controls to identify gaps.
Findings, analyst decisions and documented limitations are retained in a due-diligence record, with final decisions in human hands.
Frequently Asked Questions
What Should a Vendor Due Diligence Checklist Include?
A vendor due diligence checklist follows the 14 factors in the 2023 Interagency Guidance. They run from strategies and goals, legal compliance and financial condition through information security, operational resilience and incident reporting to subcontractors, insurance coverage and contracts with other parties.
Why Is Vendor Due Diligence Important for Banks and Credit Unions?
An institution keeps responsibility for any activity it outsources. The 2023 guidance states that a banking organization’s use of third parties “does not diminish its responsibility” to operate safely and comply with applicable laws, to the same standard as work performed in-house.
When Does a Red Flag Call for Enhanced Due Diligence?
A red flag calls for enhanced due diligence when it touches a higher-risk activity or raises a question the file cannot answer. The 2023 guidance says more comprehensive due diligence is “particularly important when a third party supports higher-risk activities,” including critical activities.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring