What documentation does a procuring organisation need from a digital supplier?

When procuring digital services, the client organisation needs to form a view of the supplier's capacity to carry out the assignment. Relevant documentation depends on the scope, requirements, and contractual form of the procurement. This article provides an overview of common information categories – not an exhaustive list applicable to every procurement.

Company information

Basic information about the supplier's company structure is generally relevant:

• Legal name and registration number.
• Legal form and country of registration.
• Contact details for registered office and invoice address.
• Ownership structure if relevant to assessing supplier stability.

Named contacts

A named contact for procurement questions and a named contact for delivery are generally the minimum. For larger assignments it may be relevant to know which key individuals are planned for the engagement.

Delivery capability

Documentation of the supplier's ability to carry out the specific assignment may include:

• Description of the supplier's working methods and delivery model.
• Relevant experience and capability areas.
• Team structure and key roles for the assignment.
• Geographic availability and presence.
• Subcontractor structure if sub-contractors are planned.

Financial information

Depending on the scale and duration of the assignment, financial information may be relevant to assess supplier stability:

• Revenue and results for recent years where available through annual report.
• Payment defaults and liabilities via credit check.
• Tax compliance information where applicable.

Quality and process routines

Documentation of the supplier's quality management may include:

• Description of how quality is maintained in the delivery.
• Documentation practices and delivery documentation.
• Deviation and change management process.
• Follow-up and reporting model.
• Certifications where relevant and verifiable.

Information security

Where the assignment involves sensitive data or public systems, information security documentation may be relevant:

• How is sensitive and personal data handled and protected?
• Access control routines for systems and data.
• Backup and recovery procedures.
• Incident management process.
• Use of sub-processors with access to sensitive data.

Insurance

Depending on the nature of the contract it may be relevant to request information about liability insurance. Required coverage should be specified in the contract terms.

Continuity

Information about how the supplier handles continuity and delivery stability through change may include:

• Plan for competence transfer during personnel changes.
• Maintenance model for the delivery after project completion.
• How documentation and knowledge is preserved and handed over.

References

If the procurement requires references it should be clearly stated: what type of assignments are relevant, how many are required, and how they will be verified. Suppliers should never list references without the consent of the referenced clients.

Sustainability

Depending on the organisation's own sustainability requirements, information about the supplier's sustainability practices may be requested, including policy, responsible sourcing, and environmental aspects of hosting and infrastructure.