Evidence on Demand: A Client-Ready Due Diligence Pack

In UK service businesses, deals are rarely delayed by the quality of the work itself. They are delayed by the paperwork that sits between a verbal yes and a signed contract. A buyer sends a procurement questionnaire, asks for insurance certificates, data protection documentation, a health and safety policy and details of subcontractors. The service team knows the answers, but the evidence is scattered across shared drives, inboxes and the files of a former office manager.

A client-ready due diligence pack solves a practical problem: it lets you respond promptly and consistently without pretending to be a legal department. It is a reusable folder of current evidence, maintained by an owner, with clear boundaries about what is standard and what must be tailored.

What UK buyers usually ask for

The exact list varies by sector and client, but most requests fall into a small number of categories.

Insurance certificates

Buyers typically want evidence of employers liability, public liability and, where relevant, professional indemnity cover. They may ask for the certificate itself, the schedule, the policy limits and the expiry date. Check that the legal entity named on the certificate matches the entity contracting. Keep the current certificate and schedule together, and make sure someone knows the renewal date before it passes.

Data protection documentation

Under UK GDPR, buyers often ask for a privacy notice, a data processing agreement, a retention schedule, a list of subprocessors and a summary of security measures. Some will want a data map showing what personal data you handle and where it flows. Others may ask about breach procedures or international transfers. Provide what is relevant to the services you actually deliver; do not send a generic policy that contradicts your contract.

Health and safety policy

A written health and safety policy is expected where there are five or more employees, and buyers may ask for it regardless of size. They may also request risk assessments, accident reporting arrangements and evidence of a competent person. In construction-related work, CDM 2015 documentation may be relevant. The pack should contain current versions, not a policy signed several years ago and never reviewed.

Anti-bribery position

The Bribery Act 2010 gives buyers a reason to ask how you manage bribery risk. A short position statement, a gifts and hospitality register, a third-party due diligence process and evidence of training are usually more useful than a lengthy policy no one follows. Keep the evidence proportionate to the size and risk of your business.

Subcontractor details

Buyers want to know who will actually deliver the service. Prepare a subcontractor schedule covering the legal name, scope, insurance, confidentiality terms, data processing arrangements and any relevant certifications. If subcontractors change, the pack should change with them. A list that is six months out of date can undermine an otherwise strong bid.

Build the folder once

A simple structure beats a sophisticated one that no one maintains. Use a master folder with numbered sections: an index and cover note, company details, insurance, data protection, health and safety, anti-bribery, subcontractors, and standard policies. Keep client-specific material in a separate subfolder so the master pack is never sent by mistake.

Adopt a file-naming convention that includes the document type, version and date. Store PDFs rather than editable files, and keep the source documents in a controlled location. The index should state what each document covers, who owns it and when it was last reviewed. That single page is what makes the pack usable under pressure.

The ten-minute send routine

When a request arrives, open the index and identify which sections the buyer actually needs. Duplicate the relevant files into a client-specific folder. Check expiry dates on insurance and certificates. Redact anything that is not required, such as pricing or unrelated client names. If a data processing agreement needs to be signed, attach the current template rather than an old scanned copy. Send via a secure link, record what was sent and to whom, and note any follow-up questions.

Ten minutes is realistic only if the pack has been maintained. If the insurance certificate expired last month or the subcontractor list is incomplete, the routine becomes a project.

Maintain it on a calendar

Give the pack a named owner and a quarterly check. Verify insurance expiry dates, policy review dates and subcontractor details. Once a year, review the full contents against the services you now offer. Update the pack when something changes: a new subcontractor, a new software platform, an office move, a breach, or a new client sector with different requirements.

Keep a simple distribution log so you know which client received which version. That record is useful if a buyer later claims they were given outdated information.

Keep the boundaries clear

A due diligence pack is evidence of how you operate, not a substitute for legal or professional advice. Do not invent certifications, present expired documents as current, or send policies that do not match your actual practice. Where a buyer asks for a contractual commitment, route it to the appropriate adviser. The aim is to look organised, consistent and honest, which is usually exactly what a UK buyer is trying to establish.