A supplier that can produce an attractive sample may still struggle with a forty-country shipment, a sudden demand spike, recipient data, a late product substitution, or a batch that fails inspection. Onboarding should therefore answer a narrower question than “is this a good vendor?”: is this supplier ready for this product, audience, market, volume, and launch date, under evidence that a named owner can review? This guide provides a reusable decision method, a blank workbook, and worked hypothetical cases for procurement, supply chain, brand, security, and legal teams. It does not claim a universal industry score or replace an organization's approval policy.
Define the approval unit before scoring
Start with the program, not the supplier's entire company. Write down the item or service, quantity range, decoration method, markets, recipient population, planned handoff date, data fields shared, and who imports or delivers each parcel. A supplier might be ready to assemble two thousand kits in one domestic warehouse but have no tested path for an overseas destination. Another might manage address collection well yet lack the tooling for a color-critical branded textile. A blanket “approved supplier” flag hides those distinctions.
The approving organization should name an accountable buyer, an operational reviewer, a quality reviewer, a data/security reviewer if recipient information is handled, and a legal or privacy decision owner where contracts or local obligations require one. The supplier should identify the production site, its subcontractors, an escalation contact, and a backup operator. Ask who can authorize a substitution, accept a partial delivery, stop a faulty batch, and close a data deletion request. A name and a decision deadline are more useful than a generic promise to “communicate quickly.”
Set the decision that this review can actually make. The workbook yields a review state: ready for approval review, conditional pilot review, or do not onboard. It never signs a contract or marks a supplier as approved. Separate the decision owner and date from the calculated result. A conditional pilot should state the maximum quantity, allowed destination lanes, evidence still due, the expiration date of the condition, and the trigger that stops release. An approval for a different market or product requires its own scope review.
Before requesting documents, decide what the recipient will experience. If the program involves a personalized gift choice, the supplier may need item-level availability and an accessible fallback. If it is a prepacked event kit, batch traceability and a cutoff for changes matter more. If it is a sensitive employee-recognition program, the minimum necessary recipient data and deletion path deserve attention. These examples change which evidence is material; they do not authorize skipping a mandatory legal or security requirement imposed by your own organization.
Download the workbook and understand its limits
The version 2.0 workbook, dated October 27, 2026, is an original editable model. It contains eight sheets: Instructions, Evidence, Capacity & Quality, Data & Security, Scorecard, Conditions, QA, and Methodology. The companion CSV is a portable blank evidence register. Both files are in English. They contain no real supplier scores, certificates, or customer results. Enter your own program and supplier records; retain the original blank version as a reference.
Download the English supplier due diligence workbook (.xlsx) and download the English evidence register (.csv). The workbook is a calculation tool; the CSV is a working register that can be imported into another system. Do not replace a file with a screenshot of its table: the formulas, editable ratings, evidence statuses, and version are part of the asset.
The initial ten criteria carry a total weight of 100 points. Six capacity-and-quality criteria contribute 60; four data-and-security criteria contribute 40. A verified criterion receives a rating from zero to five. Its points equal weight multiplied by rating and divided by five. An unverified or unrated criterion returns a blank rather than a reassuring zero. The score appears only when all ten criteria have usable ratings and the weights still total 100. Four separate mandatory evidence gates must also be verified. The suggested review state uses an editable 80-point approval-review threshold and a 65-point conditional-review threshold. Those weights and thresholds are illustrative buyer settings, not an external benchmark or a claim that 79 is unsafe while 80 is safe.
The scorecard intentionally gives evidence and human authority different jobs. A 100-point total cannot clear a missing mandatory record. A zero is a real, scored absence of capability, while a blank means the reviewer has not established a value. The QA sheet independently displays weight total, scored criteria, mandatory gates, and threshold validity. It does not drive the decision formula. If a reviewer changes a weight from 12 to 13 without offsetting another, the total becomes 101 and the state asks for a weight correction. A reviewer who marks everything five should still see “ready for approval review,” not “approved.”
| Decision input | Workbook treatment | What the human reviewer must establish |
|---|---|---|
| Evidence | Missing, submitted, verified, or returned for correction | Document owner, date, expiry, market scope, authenticity, and relevance |
| Criterion rating | Whole number from zero to five, scored only after evidence verification | Why the observed record supports the rating for this program |
| Mandatory gate | Four independent records; any missing gate holds the review | Whether the policy applies and which authorized owner accepts it |
| Suggested state | Review, conditional review, hold, or do not onboard | Final decision, conditions, scope, and review date |
Build an evidence register that can survive handoffs
The Evidence sheet is the center of the workflow. Give each request an ID, a precise requirement, the supplier-side owner, a link to the actual record, document date and expiry, geographic scope, status, reviewer, and notes. Distinguish “submitted” from “verified.” A certificate image without an issuing body, covered legal entity, current period, or relevant site may support a follow-up question but should not silently close the record. A sample photograph cannot prove repeatable output across a full batch. A sales statement about worldwide delivery does not establish a customs, carrier, and returns lane for the specific destinations in the program.
The four default mandatory records ask for legal entity and service scope, an approved physical sample for the program, signed data terms if recipient information will be processed, and insurance or an approved contingency owner. These are original operating gates in this template. They are not a legal checklist that applies identically in every jurisdiction. If a data term truly does not apply, the buyer's legal/privacy owner should document the alternative decision and adjust the organization's controlled copy rather than marking a missing contract “verified.” The same discipline applies when insurance is replaced by a formally accepted contingency structure.
Use a single evidence link per version of a record, with access controlled for reviewers and a record of who changed its status. Note the exact site or subcontractor it covers. If a certificate expires before the launch, require a renewal plan and a due date; an old PDF in a folder is not continuing assurance. If the supplier changes a manufacturing plant, the sample approval and relevant quality records may need to be repeated. If recipient data moves to a new subprocessor, data review may need to reopen. Designate who can invalidate a prior review and who must be notified.
The U.S. National Institute of Standards and Technology's supplier due diligence quick-start guide describes a risk-based approach to cybersecurity supply-chain assessments. Its purpose here is to inform questions about supplier identity, scope, and information risk; it does not certify a gift supplier. The International Organization for Standardization's ISO 9001 quality-management standard helps frame questions about documented quality processes, while ISO/IEC 27001 information-security requirements help frame questions when a supplier handles sensitive data. Verify the current edition and actual certificate scope before claiming a supplier conforms. A management-system certificate also does not prove that a particular mug, kit, or delivery lane will meet a buyer's specification.
Test capacity and quality against a real program
Ask for the production calendar, named site, weekly feasible capacity, booked load, material constraints, and changeover time for the intended decoration method. Capacity is not a single maximum number. A plant that can imprint ten thousand units over six weeks may fail a request for two thousand within five days after final artwork approval. Separate raw production from inspection, kitting, customs preparation, and outbound handoff. Ask the supplier to show a critical path with the last point at which quantity, artwork, recipient address, or item choice can change without moving the delivery date.
Sample inspection should specify the approved reference, dimensions, color tolerance if relevant, placement, packaging, permitted variation, reviewer, and acceptance record. Agree on how many units will be checked at the beginning and during the batch; document what happens if a defect is found. The supplier should preserve a batch or lot identifier that links the approved sample, material, production run, inspection result, and shipment. If twenty recipients report a broken component, the buyer needs to identify the affected lots and pause only the appropriate stock instead of either ignoring complaints or recalling every item without evidence.
Substitution is a decision, not a warehouse convenience. Record acceptable equivalents, price differences, branding implications, recipient accessibility, approval owner, and notice window. A last-minute change from a reusable bottle to an apparel item changes sizing, safety, packaging, and possibly customs paperwork. If no equivalent is authorized, pause that recipient segment and present choices to the buyer. Require the supplier to show how it will handle damaged deliveries, undeliverable addresses, returns, and replacement stock by market. A lane sheet should include origin, destination, handoff point, expected transit range, customs-document owner, duties owner, tracking, exception response time, and a fallback route.
Financial and insurance review should be proportionate to the program's exposure. A small deposit for a verified pilot is not the same risk as prepaid tooling and a holiday volume commitment. Confirm who owns materials at each stage, what is refundable, what a failed batch costs, and whether a substitute facility or reserve stock exists. Procurement and finance should review these terms; the worksheet does not infer solvency from a sales deck. If a supplier refuses to identify its production site or cannot show a credible recovery owner, record that gap even if its sample looks excellent.
Review data and security as an operating lane
Map each recipient field from collection to deletion. A physical delivery may need a name, delivery address, contact channel, item choice, and an exception code. It may not need a birth date, an employee performance note, or a full HR record. Decide who collects consent or another applicable basis, who can edit an address, how a wrong-recipient parcel is handled, when data is removed, and which supplier personnel or subcontractors can see it. The buyer's privacy and legal owners determine the legal basis and contract terms in the relevant market; this workbook only makes the operating questions visible.
Ask how access is granted, reviewed, revoked, and logged. Separate a supplier's general security brochure from evidence for the actual system that will process the file. A useful test is to request a data-flow diagram for this program, the list of processing locations and subcontractors, retention schedule, deletion confirmation method, and incident contact. If the supplier sends an address file to a printer or regional carrier, determine whether that party is within the reviewed service and data terms. If the workflow uses a shared spreadsheet, inspect access controls and the handoff procedure rather than assuming a secure system exists because the vendor has a certificate elsewhere.
For an incident, set an escalation path before data is exchanged. Who notices a misaddressed file? Who can stop a print run? Which buyer contact receives the first factual report? What evidence is preserved, and who decides notice obligations? Require a tabletop walkthrough with a realistic wrong-address or exposed-file scenario before a high-volume program. Record unresolved issues in Conditions with owner, due date, evidence to close, and the reviewer who will validate closure. A high score does not erase an unowned incident response gap.
Hypothetical case A: a regional apparel launch
Imagine a brand planning 24,000 embroidered jackets for employees in three markets, with two sizes of packaging and a six-week launch window. These numbers are illustrative planning inputs, not customer results. Supplier A shows a beautiful approved sample and quotes a low unit price, but its confirmed embroidery capacity is 3,000 units a week after current bookings. Six weeks at that rate yields 18,000 before inspection, rework, and outbound staging. The buyer should not enter “5” for capacity because the sample is attractive. It should ask for a production allocation calendar, a second validated line, or a phased launch that does not promise all 24,000 by the original date.
Suppose Supplier B quotes more and offers 5,500 units a week across two sites. The buyer needs to verify whether both sites use the same embroidery file, thread, quality tolerance, packaging specification, and lot traceability. Run a pilot at each site, compare against the same reference sample, and reserve a buffer for defect rework. If one site substitutes a similar jacket, the buyer must approve the material, sizing, appearance, labeling, and delivery implications before shipment. The choice is not automatically B; the decision depends on verified capacity, accepted cost, and whether the launch can be split without disappointing recipients.
The decision owner might authorize a 1,000-unit pilot in one market, with a stop condition if the defect rate exceeds the agreed sampling rule or if a batch loses traceability. Record the owner, gate date, receiving inspection evidence, and the release trigger for the remaining markets. A score of 82 with a missing physical sample remains on hold under the workbook's separate mandatory gate. An 82 with all records verified is still a request for human approval, with a decision date and conditions. If a supplier misses the pilot, the recovery path might be to extend the delivery window, allocate the verified backup site, or reduce the program scope. Do not silently mark the failed units as delivered.
Hypothetical case B: a cross-border recognition program
Imagine a 4,000-recipient recognition program spanning four destination countries. Recipients choose among three gift categories; addresses are collected only after they select. These figures are hypothetical. A supplier promises worldwide delivery but submits one domestic shipping example and no importer, duties, returns, or data-retention plan for the four lanes. The buyer should request a lane-by-lane feasibility table. For each country, verify the permitted item, parcel dimensions and value, recipient contact path, customs description, responsible importer, duties/taxes owner, tracking, undeliverable process, and replacement option. A single worldwide slide is not evidence for each lane.
Now suppose the proposed supplier can serve three markets, while the fourth requires a specialized regional provider. The organization may approve a limited three-market pilot and hold the fourth. That operating model requires explicit ownership of the recipient experience: who redirects a failed choice, who reconciles inventory and charges across providers, and who receives complaints? Avoid transferring the entire recipient file to both providers merely for convenience. A controlled split, a minimal field set, and a documented deletion deadline may lower data exposure while retaining a practical recovery route.
In the workbook, leave a data-security criterion unscored until the processor path and contract are verified. Mark the applicable mandatory data gate missing if the required terms are absent. Even if the other nine ratings could total 90 points, the calculated state remains a hold. After evidence arrives, test a small address file with consented internal recipients, verify the carrier events and return path, and record actual completion and exception counts. A successful pilot is evidence for the reviewed lanes and period, not a perpetual worldwide authorization. A new destination or subcontractor should trigger a scoped review.
Run the pilot, close exceptions, and keep the decision current
Translate the review into an execution sequence. First, procurement defines program scope and terms; operations maps capacity and lanes; quality accepts a reference sample; the data owner signs off the information flow. Next, the supplier produces a bounded pilot with labeled lots and a date for inspection. The buyer compares the physical output to the reference, checks tracking and exception records, confirms the agreed data deletion or retention action, and documents any defects. Only then does the authorized owner release the next tranche. Each step should have an input, an accountable person, a deadline, and an acceptance artifact.
Use the Conditions sheet for unresolved work, not a generic “follow up later” label. For a conditional decision, write exactly which item is missing, the interim control, the owner on each side, due date, evidence link, closure reviewer, and whether shipments must remain paused. If the condition concerns a material security or quality gate, the pilot scope should be small enough that a failed condition can be stopped and recovered. A supplier's promise to improve is not a completed corrective action; require a revised process, a test, and a reviewer acceptance record.
Set review triggers in advance: certificate expiry, site or subcontractor change, new gift category, volume above the demonstrated capacity band, material defect trend, incident, new data field, or destination not covered by the original lane. Record the source and date of each change. The annual refresh is useful for stable programs, but a material change should reopen the relevant part immediately. Preserve prior decisions and their evidence rather than overwriting the record; a future reviewer should see what was known, by whom, and when.
Before closing the program, reconcile purchase order quantity, produced units, inspected units, shipped units, delivered units, returns, replacements, write-offs, and remaining stock. Finance should reconcile invoices to the approved scope and exceptions. Security or privacy owners should verify the agreed access removal and deletion evidence. Procurement should note whether the supplier remained within its conditions and what will be tested next time. These records make a later approval faster and more honest because the next review begins with observed performance instead of a polished sales presentation.
Make the approval useful after the first shipment
The workbook is most useful when it prevents the wrong conclusion from a convenient number. A score is a structured summary of verified evidence for a stated program. It cannot replace a missing mandatory record, a qualified reviewer, a pilot, or an owner's decision. Keep the blank version and the completed version together, record changes to weights and thresholds, and revisit the scope when a product, market, production site, data flow, or volume changes. That discipline lets procurement move quickly on a repeat order while still seeing the exception that could change the answer.
For teams coordinating gift selection, recipient choice, and delivery across markets, Giftpack can support the execution layer of a supplier-approved program. Your procurement, quality, security, privacy, legal, finance, and employer owners retain their decisions about approval, contracts, data, tax treatment, and release.