Templates and records · ISO 37301 · Clause 8.1 y 8.2
Third-party due diligence template for compliance
Checking, before and during the relationship, that an agent, distributor or supplier does not bring into the company a noncompliance risk it cannot accept.
In one sentence
Third-party due diligence assesses the compliance risk of business associates, agents and suppliers —beneficial ownership, reputation, sanctions, sector and country—, applies checks proportionate to that risk and records the decision and the clauses required; ISO 37301 does not name it as a mandatory record, but it is how outsourced processes and third-party risks are controlled (8.1 and 8.2).
- Where the standard requires it
- ISO 37301 · Clause 8.1 y 8.2 Clauses follow ISO 37301:2021, the current edition, which replaced the ISO 19600 guidance standard.
- Type of information
- Good practice Good practice that gives substance to the controls in clauses 8.1 and 8.2
- Who fills it in
- Contracting area, with compliance Compliance validates high-risk cases and can veto the relationship
- When
- Before contracting And periodically according to risk, or when red flags appear
- How long it is kept
- Set by the organisation ISO 37301 sets no periods. In Spain it is wise to take into account the limitation periods of the offences the system aims to prevent, because the record is your evidence of due diligence.
What the standard requires
What ISO 37301 demands and what it leaves to your judgement
ISO 37301 asks for outsourced processes to be controlled and for controls to manage compliance obligations and risks. When the risk comes from a third party —an agent selling on the company’s behalf, a distributor in another country—, due diligence is the natural control.
The standard does not define its content. ISO 37001, for bribery, does: assess the nature and extent of the risk posed by each business associate and apply proportionate checks. It is the most widely used reference even when that certification is not sought.
It is not the ISO 9001 supplier evaluation nor the ISO 27001 security assessment: the question here is who the third party really is and whether its conduct could make the company liable.
Structure
Fields the template should include
- Third party, type of relationship and service
- Risk level: country, sector, interaction with public officials, payment method
- Beneficial ownership and directors
- Checks: sanctions lists, media, references, certificates
- Red flags found and how they were resolved
- Clauses required: compliance, audit, termination
- Decision, who takes it and conditions
- Next review
Example
Example: onboarding a sales agent abroad
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| Third party | Sales agent (fictitious) for sales to public hospitals in another country · 8 % commission |
| Risk | High: deals with public buyers and is paid on success |
| Beneficial ownership | Identified individual; no ties to the public buyer according to a signed declaration |
| Checks | No matches on sanctions lists · no adverse media · two references verified |
| Red flag | Asked to be paid into an account in a third country · refused: payment only to an account in their name in the country where the service is provided |
| Clauses | Anti-corruption compliance, right to audit and immediate termination |
| Decision | Approved with conditions by the compliance officer, 12 May 2026 |
| Review | Annual |
At the audit
Mistakes auditors commonly flag
- The same check for every third party, with no grading by risk.
- Red flags noted with no decision taken on them.
- Due diligence done only at onboarding and never reviewed.
- Agency contracts with no compliance or termination clause.
In Kimobox
How this record is kept in Kimobox
- 1Due diligence on each relevant third party is recorded from the supplier portal.
- 2Third-party documents are kept with their expiry dates monitored.
- 3The delegation of authority matrix sets who can approve each high-risk relationship.
Frequently asked questions
What people ask us before getting started
Does every supplier need due diligence?
Not with the same intensity. The sensible approach is an initial risk classification: low-risk suppliers get a basic check and high-risk ones the full review, repeated periodically.
How does it relate to UNE 19602 tax due diligence?
It is the same control through a different lens: UNE 19602 focuses on the tax risks of dealings with third parties. Organisations running both systems can use a single form with both sections.
Keep your ISO 37301 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 27001 supplier security assessment template
How to assess and monitor supplier security under ISO 27001 controls 5.19 to 5.22: access to data, contract…
UNE 19602 tax due diligence template
How to document UNE 19602 tax due diligence on partners, suppliers and exposed staff: red flags, the checks…
Operation
Operation turns policy into real controls: due diligence on partners and suppliers, and procedures that…
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO 37301:2021 — Compliance management systems. Requirements with guidance for use ISO · April 2021
- ISO 37001:2016 — Anti-bribery management systems ISO · 2016 edition