Verifying the people you never put on payroll

The gap, and why it exists

Most organisations have a verification standard for employees and no equivalent standard for anybody else. The reason is structural rather than careless: employee checks are owned by HR, and vendor onboarding is owned by procurement, and the two processes were built at different times by people solving different problems.

So the housekeeping staff with a key to every floor were checked by whatever the facilities agency does, which nobody has asked about. The vendor engineer with production access was checked by their employer, or was not. The consultant with the commercial model in their inbox was checked by nobody at all, because consultants are contracted rather than hired.

The test to apply is the one from scoping a package by role, and it does not mention employment: what can this person reach? If the answer is the same as for an employee, the check should be the same as for an employee, and who pays their salary is not part of the question.

Three different problems

"Vendor due diligence" gets used for three quite different pieces of work, and running one when you needed another is how gaps appear.

The entity

Is this company real, active and what it claims to be? This is a register question, answered at the MCA and against public filings. It is fast, it is inexpensive, and it is the one most often skipped for a supplier somebody already knows.

The people behind the entity

Who owns and directs it, and does any of that connect back to your own organisation? This is where a supplier owned by a relative of the person approving its invoices becomes visible, and it is a different search from checking the company.

The people who will be on your site

The individuals the vendor actually sends. These are the ones with the badge, the login and the keys, and they are the ones most likely to have been checked by nobody. Individual checks, on individual consent, exactly as for an employee.

What an entity check covers

Public company information in India is genuinely good, and an entity check is one of the better returns on money in this whole field.

• Existence and status. Whether the company is registered, active, dormant or struck off.
• Directors, current and past. Who is behind it, and who was behind it when.
• Disqualification. Whether any director carries a disqualification on record.
• Registered office. Which is worth comparing against the address on the invoice, since a mismatch is common and occasionally meaningful.
• Filing history. A company that has not filed for years is telling you something about how it is run.
• Connections. Whether the directors or their addresses link to other entities you already deal with, or to your own people.

The detail on the register itself is in DIN and the MCA register, and the service page is vendor due diligence.

Contractor and agency staff

This is the largest population and the weakest link in most organisations. Housekeeping, security, catering, facilities, logistics, temporary staffing, on-site technical contractors.

The failure mode is always the same sentence: the agency checks them. Sometimes true, frequently partly true, occasionally not true at all, and almost never written down. Four questions turn that assumption into a fact.

1. What exactly do you run? Not "we do background checks", but which checks, on whom, and how far back.
2. Who runs them? A named provider, or an internal process that consists of collecting photocopies.
3. Can we see the evidence for a named individual? Not a certificate that checks were done, but the finding and what sits behind it.
4. What happens when somebody is replaced? Agency staff turn over constantly, and a check on the person who started in January says nothing about the person who arrived in June.

Whatever the answers, the standard belongs in the contract, along with the right to see evidence and the obligation to re-check on replacement. An assumption is not a control. Staffing firms that already run verification to a client standard will have no difficulty with any of this; the ones that object are answering the question.

Incoming directors

A director can bind the company. It is the highest-exposure appointment most organisations make, and it is routinely made on the basis of a personal recommendation and a CV.

The directorship history is the one that most often produces something. Undisclosed directorships, a trail of struck-off companies, or a resignation timed just before a company's problems became public are all visible on a public register and none of them appear on a CV. See leadership verification.

Doing it once is doing it wrong

Employee verification happens at a point in time because hiring happens at a point in time. Vendor relationships continue, and a check at onboarding says nothing about a company three years later.

What works is a cycle for anything with continuing access, plus a set of triggering events that force a re-check regardless of where the cycle sits: a change of directors, a change of registered office, a contract renewal, a significant expansion in what the vendor can reach, or any adverse news. Each of those is a moment when what you verified stopped being what is true.

The same applies to the people. A vendor's staff list at onboarding is a snapshot. Without an obligation to check replacements, the population on your site drifts away from the population you approved, one substitution at a time.