Employer branding vendor due diligence: references and exit

What to take away

References, delivery staff and exit terms test what a supplier will do after the pitch. A registration number cannot show that.
Put the same question to both references, then compare the answers side by side.
A supplier who names the account lead, the notice period and the replacement terms has answered the delivery question.
Read the draft contract for renewal notice, asset ownership, data return and any exit fee before signing.
Allow two to four weeks, start before the pitch and keep every answer in one file.

Why delivery claims need their own checks

Delivery claims are the part of a pitch that a registration number cannot prove. Five checks cover employer branding vendor due diligence: legal entity, data protection, references, subcontractors and exit terms. The last three test what happens once the contract is running.

Five step vendor due diligence

Confirm legal entity and trading history
Request data protection pack
Speak to two client references
List every subcontractor and country
Read exit terms and asset ownership

Work through them before the pitch meeting, not after the shortlist is agreed. Each check relies on documents the supplier already holds, so the speed of the reply is itself a signal. The tools and suppliers guide sets out what each provider type should cost, which helps you judge the figures you are given.

How to run a reference call

Ask both reference contacts the same fixed question, so the two answers can be compared. Request two named clients from the past 18 months, with contact names, contract dates and the scope of work, and make the calls yourself rather than accepting a written testimonial.

"Who did the day to day work on this account, and how long had they been on it?"

A promise-based reply is the warning sign. "Our senior team is always involved" tells you nothing about your own programme. A strong answer names the account lead, the start date and the handover plan if that person leaves. Note the answer, the date and the contact's name in the file.

Then ask whether the pitch matched delivery. Supplier claims are marketing communications under the CAP Code, so they must be legal, decent, honest and truthful, and the same advertising rules in England apply to the pitch deck as to any campaign.

Who will actually do the work?

Name the people before you sign. Request the subcontractor list, the name of the day to day account lead, that person's notice period and the replacement terms. A pitch team that vanishes after signing is a delivery risk, and these four items show whether it can.

Compare the list with what the references told you. Do the freelancers named match the roles the reference described? Ask which confidentiality terms bind them, because candidate data may pass through their hands. The notice period tells you how much warning you get if the lead leaves.

Vague replies and the evidence that settles them

The table sets a vague reply against the evidence that settles each point. A vague answer is not a refusal, but it is not evidence either, so ask once more in writing and file whatever comes back.

Point	Vague reply	Evidence that settles it
References	"We can arrange something"	Two contacts who agreed to be called
Account lead	"Our senior team is always involved"	A named lead, a start date and a handover plan
Subcontractors	"A small trusted team"	Named freelancers with roles and confidentiality terms
Exit terms	"We will sort it out at the end"	Notice period, deletion date and handover list in the draft

What exit and renewal terms should you check?

Exit terms decide what the project costs you at the end, not at the start. Read the draft for the auto-renewal notice, asset ownership, data return and deletion on exit, and any exit fee, and ask for each answer in writing before signature.

Check whether creative assets sit inside a supplier account, and what happens to tracking links and advertising accounts. Ask for the deletion date for candidate data and the asset handover list. If the supplier charges for exit assistance, get the figure written into the draft rather than agreed later.

On data, UK GDPR Article 28(3)(g) says the contract must require the processor, at the end of the contract and at the controller's choice, to delete or return all the personal data it has been processing.

The employer is normally the controller, and the supplier is the processor, which acts on behalf of the relevant controller and under its authority. The candidate data guide covers the wider retention wording, and a contract clause review tests the draft before you sign.

The order of work

Weak suppliers filter themselves out at the first written request, so send the document list early. A supplier who will not confirm something in writing has answered the question. Use the same four steps for every shortlisted supplier, so the files can be compared when you brief the suppliers.

Send one written request for the references, the subcontractor list, the account lead's details and the draft contract.
Call both references with the same question and note the answers.
Compare the references' account of who did the work with the subcontractor list.
Read the draft for renewal, asset, data and exit terms, and have each answer written into it.

Common questions

Which checks does this cover?

References, subcontractors and exit terms, the three that test delivery. Legal entity and data protection are the other two of the five.

How many references should you call?

Two named clients, asked the same fixed question so the answers can be compared.

What if a supplier will not name the account lead?

Treat that as the answer. A supplier who will not confirm something in writing has answered the question.

Who should own the process?

Someone with budget authority, working with whoever owns candidate data on your side. Splitting the two leaves gaps nobody closes.