Tools and providers
Part of Media buying tools and suppliers for 2027, compared in the right order
Vendor due diligence on a media agency, from contracting entity to departure
Vendor due diligence checks an agency's legal identity, authority, money path, data access, security evidence, subcontractors and exit duties.
Due diligence should confirm who the advertiser will contract with, what that entity controls, how money and data move, and what evidence supports its answers. Run the checks before preferred-supplier status creates pressure to excuse a gap.
What to take away
- Due diligence must confirm the contracting entity, money and data flows, and the evidence behind each answer.
- A Companies House entry confirms recorded information but is not a credit or capability assessment.
- Trace each payment route and separate agency pay, media, technology, data, research and verification.
- Identify conflicts and record mitigation rather than accepting a blanket assurance.
- The exit schedule should cover active orders, account transfer, data exports, credential removal and disputes.
Verify the contracting entity
Record the full legal name, company number, registered address and people authorised to sign. The official Companies House search guidance explains how to inspect the UK register and filing history. A register entry confirms recorded company information; it is not a credit or capability assessment.
Verify the contracting entity
- Full legal name recorded
- Company number recorded
- Registered address recorded
- People authorised to sign
- Match entity to proposal and insurance
- Match entity to bank instructions
- Confirm who employs the team
Match the entity to the proposal, insurance, bank instructions and contract. Ask how any trading name, overseas affiliate or group company participates. Confirm which organisation employs the proposed team and which one will receive advertiser funds.
Trace media money
- Draw each payment route through the agency, platform, reseller and media owner.
- Separate agency pay, media, technology, data, research and verification.
- Ask about rebates, credits, inventory commitments and other benefits.
- State who bears bad debt, currency movement and cancellation charges.
- Require an escalation process for altered bank details.
Send the agency a written request such as: 'List every payment route from our invoice to the media owner, and confirm whether any rebate, credit or inventory commitment returns value to us.'
ISBA's agency contract compliance audit guidelines discuss records, remuneration and audit rights for UK advertisers. Use them to form questions, while asking qualified advisers to settle the agreement itself.
Inspect buying authority and conflicts
Request a diagram of the proposed supply chain. Identify when the firm acts for the advertiser and when it or an affiliate may sell a proprietary product. Ask who may substitute inventory or suppliers, and what consent is required. ISBA's proprietary media guidance announcement points advertisers towards governance, transparency and data questions.
Ask in writing: 'Confirm whether you or an affiliate sell any inventory you recommend, and how you are paid on that inventory.'
Check conflicts relevant to the account, including competing clients and commercial commitments that may affect recommendations. Record the mitigation rather than accepting a blanket assurance.
Examine data and systems
List every account, tag, audience, feed and reporting store the vendor would access. Establish owner, administrator, purpose, retention and exit treatment. The NCSC's guidance for using SaaS securely covers authentication, logging, integrations and incident preparation.
Ask for current security evidence proportionate to the access requested. Check subcontractors and support locations. Give privacy specialists the actual data flow and intended advertising use; a generic policy cannot decide the position.
Test resilience and departure
Ask who covers planned absence, staff turnover and platform suspension. Require contact routes for delivery, security, finance and legal incidents. Review professional indemnity and other requested cover with appropriate advisers, including exclusions and policy dates.
The exit schedule should cover active orders, account transfer, data exports, credential removal, records retention and unfinished disputes. Name the assistance included in ordinary fees and the work that may be charged separately.
Scope of this checklist
The pages linked here were reviewed on 5 September 2026. No company, finances, insurance or controls were investigated for this article, and no supplier sponsored it. Ownership sits with procurement for entity, money and contract checks, legal for conflicts and contract terms, and privacy for data flows; each owner collects and verifies the evidence for the actual bidder.
Give each log item a deadline. Entity checks can close once documents arrive. Data and security evidence takes longer because it depends on the access requested.
A worked log entry, using typical deadlines:
| Item | Status | Owner | Deadline | Evidence |
|---|---|---|---|---|
| Altered bank instruction | Red | Procurement | 3 working days | Written confirmation from the agency finance team |
| Overseas affiliate in supply chain | Amber | Legal | 10 working days | Structure chart and contract clause |
| Data retention schedule supplied | Resolved | Privacy | Closed | Retention schedule dated and versioned |
Keep a red, amber and resolved log with owners and deadlines. Appointment should stop where legal identity, payment authority, essential access or a material risk remains unclear. Recheck filings, insurance and key documents immediately before signature.
Log one operational problem, such as an invoice dispute or account transfer, and ask the agency to walk through it.
Before you act
- Draw each payment route through the agency, platform, reseller and media owner.
- Request a diagram of the proposed supply chain.
- List every account, tag, audience, feed and reporting store the vendor would access.
- Keep a red, amber and resolved log with owners and deadlines.
Common questions
What should due diligence confirm about the contracting entity?
The entity section above defines what to record and match. Procurement owns the evidence.
How should media money be traced?
Use the payment-route and split questions above, and put them to the agency in writing.
What should the exit schedule cover?
The departure section above sets out the schedule, the assistance included in ordinary fees and the work that may be charged separately.
