Due Diligence vs Risk Assessment: What’s The Difference?

Organisations need reliable information to make good risk decisions.

Due diligence provides that evidence by investigating a supplier, third party, investment, or commercial opportunity. Risk assessment then helps the organisation interpret the findings, determine how significant the risks are, and decide what action to take.

Used together, the two processes provide a stronger foundation for supplier selection, onboarding, monitoring, and wider business decision-making.

 

What Is Due Diligence? 

Due diligence is the process of gathering, reviewing, and verifying information before or during an important business relationship.

In supplier management, it may involve reviewing:

• Company ownership

• Financial stability

• Legal and regulatory compliance

• Operational capability

• Cybersecurity controls

• Business continuity arrangements

• ESG and ethical practices

• Insurance and certifications

• Reputation and sanctions

The objective is to establish the facts, identify potential concerns, and give decision-makers enough reliable information to proceed with confidence.

 

What Is A Risk Assessment? 

A risk assessment evaluates the potential risks associated with an activity, decision, supplier, or third-party relationship.

It typically considers:

• What could go wrong?

• How likely is it to happen?

• What would the impact be?

• Which controls are already in place?

• What level of risk remains?

• Is that risk acceptable?

• What further action is required?

Risks may be rated using categories such as low, medium, and high, or through a more detailed scoring framework.

The purpose is to prioritise risks and determine how they should be treated, monitored, accepted, transferred, or avoided.

 

The Difference Between Due Diligence And Risk Assessment  

The simplest distinction is:

Due diligence establishes the facts. Risk assessment interprets what those facts mean for the organisation.

Due diligence	Risk assessment
Gathers and verifies information	Evaluates identified risks
Focuses on evidence and factual accuracy	Focuses on likelihood and impact
Identifies gaps, concerns, and dependencies	Determines the significance of those findings
Often begins before appointment or approval	Takes place before and throughout the relationship
Supports supplier and third-party investigation	Supports prioritisation and risk treatment
Produces an evidence base	Produces a risk rating and recommended actions

Neither process is complete on its own.

Due diligence without risk assessment can result in large amounts of information being collected without a clear decision. Risk assessment without due diligence may rely on assumptions, incomplete evidence, or outdated information.

 

How Do Due Diligence And Risk Assessment Work Together? 

The two processes should form part of one connected approach.

1. Understand The Relationship

First, establish what the supplier or third party will do, what it can access, and how the organisation could be affected if it failed.

This initial context helps identify which information and risk areas need to be assessed.

2. Gather And Verify Information

Due diligence collects the relevant evidence and checks whether it is complete, accurate, and current.

This may involve questionnaires, supporting documents, independent checks, screening, and clarification with the supplier.

3. Identify Potential Risks

The findings may reveal financial concerns, weak cyber controls, operational dependencies, expired documentation, or compliance gaps.

These concerns then become inputs to the risk assessment.

4. Evaluate The Risks

The risk assessment considers the likelihood and potential impact of each concern, alongside the controls already in place.

This helps determine whether the remaining risk is acceptable.

5. Decide How To Respond

The organisation may:

• Approve the relationship

• Request further evidence

• Agree remediation

• Add contractual protections

• Increase monitoring

• Escalate the decision

• Accept the risk through an authorised process

• Select an alternative supplier

The decision and its rationale should be clearly documented.

6. Continue Monitoring

Due diligence information and risk assessments should be refreshed as circumstances change.

New evidence, incidents, ownership changes, financial deterioration, or regulatory developments may alter the supplier’s risk profile.

 

Inherent Risk And Residual Risk 

Risk assessments often distinguish between inherent and residual risk.

Inherent risk is the level of risk present before controls are considered.

Residual risk is the level that remains after existing or planned controls are taken into account.

For example, a supplier processing sensitive data may create high inherent risk because of the nature of the service. Strong cybersecurity controls, restricted access, contractual protections, and ongoing monitoring may reduce the residual risk.

Due diligence provides evidence about those controls. The risk assessment evaluates whether they reduce the risk sufficiently.

 

When Should Each Process Take Place? 

Both processes should be used throughout the supplier lifecycle.

Before Appointment

Due diligence verifies the supplier’s information, while risk assessment determines whether the relationship can proceed and what controls are required.

During Onboarding

Any outstanding evidence, remediation, approvals, and contractual protections can be completed before access or service delivery begins.

Throughout The Relationship

Updated due diligence and monitoring help identify changes. Risk assessments can then be revised to reflect new information.

At Contract Renewal

Both processes should confirm whether the supplier still meets requirements and whether the remaining risk continues to be acceptable.

Following A Significant Change

A review may be triggered by:

• A change in ownership

• A new product or service

• Increased access to data or systems

• A cyber incident

• Financial deterioration

• Regulatory action

• New subcontractors

• A change in location

• Repeated performance problems

 

Common Mistakes To Avoid 

Treating The Terms As Interchangeable

Due diligence and risk assessment are connected, but they do not produce the same outcome. One establishes evidence; the other evaluates risk.

Collecting Information Without Using It

A completed questionnaire is not the end of due diligence. Information must be verified, interpreted, and used to support a decision.

Assessing Risk Without Reliable Evidence

Risk ratings based on incomplete or outdated information can create false confidence and lead to poor decisions.

Using A One-Off Assessment

Both due diligence findings and risk ratings can become outdated. Reviews should continue throughout the relationship.

Applying The Same Process To Every Supplier

The depth of due diligence and risk assessment should reflect the supplier’s criticality and the potential impact of failure.

Failing To Record The Rationale

A risk score alone does not explain why a supplier was approved. Organisations should record the evidence, findings, controls, exceptions, and reasoning behind the decision.

 

How Shared Assurance Supports Both Processes 

Supplier information is often requested separately by different organisations and internal teams, creating duplicated effort and inconsistent evidence.

Shared assurance provides a common foundation by collecting, validating, and maintaining supplier information once.

This supports:

• Due diligence by providing consistent, trusted supplier evidence

• Risk assessment by giving each organisation reliable information to apply against its own risk appetite and thresholds

Shared assurance does not make the risk decision for the organisation. It improves the quality and accessibility of the evidence used to make that decision.

 

Key Takeaway: Evidence First, Risk Decision Second 

Due diligence and risk assessment are different stages of a connected process.

Due diligence gathers and verifies information about a supplier or third party. Risk assessment uses that evidence to evaluate likelihood, impact, controls, and the remaining level of risk.

Together, they help organisations identify concerns earlier, prioritise resources, and make more confident, defensible decisions throughout the relationship.