How to Conduct a Site Visit for Third-Party Due Diligence

A site visit is not a universal prerequisite for third-party due diligence. It is a risk-based way to test whether a provider’s operations, controls, and capacity match its representations. To understand how to conduct a site visit for due diligence, first decide whether being on-site can resolve material questions that documents and interviews leave unanswered.

That distinction matters: a visit may offer limited insight into a virtual service, yet be consequential when a provider handles sensitive data, supports critical operations, or has performance issues. For banks, OCC Bulletin 2013-29 says on-site visits may help assess a third party’s operations and capacity, making regulatory guidance an important part of the decision rather than a blanket requirement.

This article explains when an on-site visit is warranted, how vendor criticality and practical constraints shape its scope, and what you can learn about facilities, processes, management, and workplace conditions. It also covers how to assess observations alongside records and apply regulatory guidance when evaluating third-party risk.

Due Diligence 101: Are On-Site Visits Required?

No universal rule requires a site visit for every transaction. Its value depends on whether direct observation can test material claims, such as a facility’s condition, operating capacity, or security procedures.

Reviewing Records Before the Visit

Before the visit, compare documented claims with the conditions you plan to observe. A focused checklist might include financial records, tax documents, contracts, permits, continuity plans, service-level agreements, and cybersecurity insurance. Mark unresolved discrepancies and use them to guide questions for the seller, property manager, or tenants. For example, ask how a recorded service interruption affected actual operations.

Checking Legal and Access Issues

Compare documented property use and permissions with the apparent condition. Examine zoning and permit records, lease terms, property claims, and accessibility features against the proposed use. During the visit, note barriers at entrances, routes, and shared facilities, then compare them with applicable accessibility requirements. These observations can flag issues for further review, but do not establish legal compliance on their own.

For a commercial property, inspect occupied and vacant areas, shared spaces, access points, and visible maintenance conditions. Ask the seller, property manager, or tenants about recurring repairs, service interruptions, access restrictions, and differences between current use and permitted use.

Inspecting the Property and Building Systems

A property inspection records visible conditions and the operation of essential building systems. Walk through the exterior, interior, roof areas accessible for inspection, and utility spaces. Note water intrusion, cracking, unusual odors, and apparent deferred maintenance. Where access permits, observe heating, electrical, plumbing, and other utilities in operation. Compare what you see with maintenance records and reported operating needs. A brief walkthrough is not a technical inspection.

Photograph each observation, record its location and date, and note the relevant document or follow-up request. Building engineers or inspectors can assess technical questions beyond the scope of a general site visit.

Assessing Security and Environmental Risks

A security assessment tests whether observed controls align with written policies. Follow the site’s access process, observe how visitors are handled, and note how sensitive areas and records are protected. For a financial or technology provider, compare these observations with its stated control procedures and any identified exceptions. A mismatch between the data room and site conditions calls for documented follow-up, not an unsupported conclusion.

A Phase I environmental site assessment aims to identify potential contamination or liabilities affecting property value; its site walk may be optional. A Phase II assessment generally includes walking the property and collecting soil and groundwater samples for laboratory analysis to investigate concerns identified earlier. Environmental review may also consider permits, violations, and relevant environmental, social, and governance standards.

Use qualified environmental consultants when contamination questions require assessment or sampling; engineers can evaluate building systems. Record findings, photographs, follow-up owners, and unresolved evidence gaps. Warning signs include inconsistent records, inaccessible areas, visible damage, or security practices that differ from documented policies.

Vendor criticality and risk-based visit decisions

Set the scope of a site visit according to the vendor’s potential impact, not a fixed contract-value threshold. A provider supporting essential operations may warrant closer review than a larger but less consequential supplier. Assess how disruption would affect service delivery, customers, financial reporting, and recovery options. Then decide whether an on-site review can answer questions that remote evidence cannot. This keeps the visit proportionate to exposure and supports an informed decision.

Vendor risk tiering gives this assessment a practical structure. Classify providers by operational criticality, data access, substitutability, and the potential severity of failure. A cloud provider holding sensitive customer records, for example, presents a different exposure from a supplier delivering replaceable office materials. Access to sensitive data under GLBA is one relevant risk factor. A new provider entering a market also merits closer scrutiny when its controls, operating history, or capacity are difficult to assess.

Match the visit scope to the risk tier. For a critical technology provider, examine access governance, incident handling, continuity arrangements, and control testing. For a provider with limited operational reach, document why records and remote interviews adequately address the relevant risks. In either case, compare claims with observable evidence, such as assigned control ownership or documented escalation procedures. A missed performance target, unclear subcontracting arrangement, or mismatch between evidence and representations may be a red flag requiring further review.

Political and reputational screening adds context beyond a vendor’s internal controls. Examine the markets where the provider operates, its ownership relationships, and conditions that could disrupt service or damage the business relationship. Due diligence should investigate relevant political, economic, and financial conditions. For example, a vendor operating across several jurisdictions may face differing operating conditions and reputational sensitivities. Record which factors could affect continuity, compliance, or stakeholder confidence, and connect them to the vendor’s actual role.

Risk review continues after onboarding. Monitor higher-risk relationships throughout their term using performance, compliance, control, and viability indicators. According to the Federal Reserve, monitoring procedures should include escalation triggers when service providers fail to meet expectations in these areas. Its guidance also calls for more frequent and stringent monitoring and follow-up on identified issues. A missed service commitment, unresolved control finding, or deterioration in viability may prompt enhanced oversight, corrective action, or a new site assessment.

Keep the decision record concise and specific: assign the vendor’s tier, explain why the visit was conducted, note the evidence reviewed, and identify unresolved issues. Define what would change the assessment, such as expanded data access, a new critical service, or repeated performance failures. This record helps decision-makers compare vendors consistently and adjust monitoring as exposure changes, rather than treating a site visit as a one-time approval.

Hard and soft due diligence

Hard due diligence tests claims against documentary and financial evidence. Review financial statements, tax exposures, contracts, licensing agreements, litigation, and relevant regulatory records. Compare reported performance with underlying records and identify discrepancies that need clarification. For a business acquisition, scrutinize projections against historical results and operating assumptions. This analysis helps establish what the organization owns, owes, earns, and must deliver.

A site visit adds operational evidence to the documentary review. Observe whether facilities, staffing, and workflows support the seller’s stated capacity. For example, compare reported production capability with visible equipment, shift coverage, and maintenance practices. Note operational redundancies that may affect efficiency, but distinguish verified findings from assumptions. A walkthrough cannot replace financial analysis, but it can reveal whether the reported model appears workable in practice.

Operational due diligence examines how an organization performs its core activities. Map a key process, such as order intake through delivery, and identify handoffs, approval points, and recurring delays. Ask staff how they handle exceptions, then compare their accounts with written procedures and performance records. A bottleneck between production and dispatch, for instance, may explain late deliveries that financial summaries alone do not.

Soft due diligence assesses qualitative factors, including management competence, employee experience, customer loyalty, and workplace culture. During a visit, observe how managers communicate priorities and how employees describe their daily responsibilities. A polished presentation may differ from routine practice, so gather evidence through consistent questions and direct observation. These factors can shape integration, retention, and the buyer’s ability to preserve customer relationships after a transaction.

Interviews add context to observations. Ask management how it tracks performance, responds to customer complaints, and addresses control failures. Ask employees to describe a normal workflow and where work commonly stalls. In a retail business, observe customer interactions and product availability, then compare these details with sales records and purchasing behavior. Treat differences as questions for further examination, not conclusions on their own.

The strongest due diligence process connects both streams of evidence. A hard review may identify a contract obligation; a site visit can show how the organization fulfills it. Soft findings may explain why a projected growth plan depends on key personnel or customer relationships. Keep a findings register recording each claim, its evidence, the source, and any open question. This helps the deal team distinguish established facts from assumptions.

Before making an offer, combine financial soundness, operating capacity, and cultural fit into a coherent assessment. Review antitrust considerations, potential litigation, tax liabilities, and the target’s effect on the buyer’s existing business. Record which findings affect valuation, transaction terms, integration planning, or the decision to proceed. A disciplined comparison helps decision-makers gather relevant evidence without treating every observation as equally material.

Regulatory guidance on third-party vendor site visits

For a regulated institution, a vendor site visit is a risk assessment tool, not an automatic requirement for every relationship. The relevant question is whether direct observation can clarify the provider’s operations, capacity, or controls. In OCC Bulletin 2013-29, the Office of the Comptroller of the Currency says on-site visits may help banks understand a third party’s operations and capacity. That guidance connects the visit to the vendor’s role and potential effect on the institution.

The OCC’s Supplemental Examination Procedures call for determining whether on-site visits are performed for third parties involved in critical activities. This supports a risk-based approach: identify critical activities, map the vendors supporting them, then assess whether existing evidence adequately explains their control environment. If a provider manages a core process, handles sensitive information, or supports service continuity, direct observation may help resolve material questions about its actual operating practices.

Other guidance takes a different form. The FDIC Compliance Examination Manual says on-site quality assurance reviews may be used to check a third party’s adherence to specified policies and procedures. By contrast, the FDIC’s Guidance for Managing Third Party Risk and the NCUA’s Third Party Relationships Questionnaire do not specifically mention on-site visits. Read each document within its scope: silence about visits does not establish that a visit is prohibited or unnecessary.

OCC guidance also allows management to consider reference checks and inquiries with industry groups and peer institutions alongside site visits. These methods answer different questions. A reference can speak to service history, while an on-site review can show how the vendor carries out a control or manages a workflow. Compare each source with written policies, performance evidence, and identified exceptions. If accounts conflict, record the discrepancy and determine whether further investigation is appropriate.

Regulations relevant to a provider depend on its services, data, and operating context. A nonprofit reviewing a service provider, for example, may assess compliance with HIPAA or GDPR where applicable to the relationship. A site visit can show how processes operate, but it cannot establish compliance on its own. Connect observed practices to the specific obligation, internal control, or contract provision being assessed, and retain evidence for the conclusion.

The OCC says banks should broaden due diligence scope or assessment methods when they uncover information warranting additional scrutiny. Apply this principle when an interview, record, or site observation reveals an unexplained control gap. Define the issue, identify the evidence needed to resolve it, and assign follow-up responsibility. The central takeaway is measured: regulatory guidance informs the assessment, while vendor criticality and credible findings determine whether an on-site investigation adds value.

What documents and records should you review before a site visit?

Build a record set that lets you compare a vendor’s representations with evidence gathered on-site. Start with financial statements, tax documents, contracts, licensing agreements, and relevant legal records. These materials frame questions about performance, obligations, and operating authority. Note missing periods, inconsistent figures, and clauses that depend on particular processes. The aim is not to collect documents indiscriminately, but to identify which claims the visit should test.

For a critical service provider, review continuity plans, service-level agreements, and cybersecurity insurance. Compare stated recovery procedures with contractual commitments and the service’s role in your operations. A new critical vendor might not yet be able to provide SSAE 18. Treat that gap as a point for discussion and assess the other evidence available about controls, service delivery, and responsibility for disruptions.

Property records call for a distinct review. Examine current lease terms, conditions, and duration, alongside real estate tax obligations and possible short-term increases. Check for outstanding claims, including government liens. Compare documented use and maintenance responsibilities with the areas you expect to inspect. For example, a lease clause assigning repairs to the owner raises a practical question about maintenance history and unresolved work.

Regulatory records should show how the organization translates standards into daily conduct. Review conduct-standard training, processes for monitoring and investigating violations, and penalties for violations. Compare those records with incident logs, corrective actions, and relevant policies. If training records show completion but investigation files reveal repeated breaches, prepare specific questions about oversight and remediation. The visit can then test how documented procedures work in practice.

Organize the material by claim, evidence, and follow-up. A review table can connect each statement to its supporting record, the observation needed, and the person responsible for answering. For instance, link a continuity commitment to its plan, service-level terms, and the team responsible for recovery. This makes it easier to distinguish a documentary inconsistency from an operational concern that needs closer examination.

Before arrival, turn unresolved points into a focused agenda. Prioritize discrepancies that could affect service continuity, legal obligations, property costs, or control effectiveness. Keep relevant clauses and record references available during interviews. When an answer conflicts with a document, note the specific record and ask for an explanation or supporting evidence. A clear trail helps decision-makers connect findings to the underlying obligation.

Where records span operational, financial, and regulatory workstreams, organize a structured due diligence review to connect documentary findings with on-site observations.

Use legal documents to assess whether the business meets its legal obligations, not merely as background material. Tie each gap to a question for the relevant contact so the review stays focused on evidence and follow-up.

For operational risk due diligence, assess vendor continuity plans, service-level agreements, and cybersecurity insurance together. Property review can also include outstanding claims, such as government liens, alongside the other relevant records.

Swiss Alpha Matrix: Audit-Grade Instrument Validation

Swiss Alpha Matrix provides Audit-Grade Instrument Validation and On-Ground Verification Services when a transaction requires documentary scrutiny alongside direct observation. These services help stakeholders assess whether an instrument or operational representation aligns with available evidence, particularly in complex or cross-border programmes.

For broader operational questions, Operational Due Diligence examines how an organization functions, while Complex Project Management helps coordinate workstreams and findings. The right focus depends on the uncertainties surfaced by the site visit, such as inconsistencies between records and observed practices or operational dependencies that warrant closer examination.

Contact Swiss Alpha Matrix to discuss your due diligence requirements and the verification work involved.

Turn Site Findings Into a Confident Next Step

A site visit’s value lies not in the volume of observations, but in how clearly each finding informs the decision ahead. Before proceeding, determine which unresolved issues could affect transaction terms, operational oversight, or the decision to continue. A considered approach to how to conduct a site visit for due diligence keeps the next step grounded in evidence, materiality, and the transaction’s objectives.

Where instrument claims, on-site observations, and project workstreams require coordinated scrutiny, Swiss Alpha Matrix offers Audit-Grade Instrument Validation, On-Ground Verification Services, and Complex Project Management. These capabilities support stakeholders seeking a disciplined assessment of complex financial and investment programmes.

To discuss how these services may fit your due diligence priorities, contact Swiss Alpha Matrix. A well-grounded decision begins with clear questions and a careful record of the evidence that matters. Move forward with that standard in view.

Frequently Asked Questions

What are the steps in the due diligence process?

Start by defining the decision the investigation must inform, such as whether to acquire a business or appoint a provider. Identify the material questions, assign responsibility for financial, operational, and compliance review, then gather evidence from records and interviews. Reconcile conflicting accounts, document unresolved exposures, and assess their implications for the proposed transaction. Conclude with a findings report that distinguishes verified facts, assumptions, and matters requiring a decision.

What are the steps for conducting a due diligence site visit?

To understand how to conduct a site visit for due diligence, begin with a clear objective and an agenda tied to outstanding questions. Arrange access to relevant areas, identify the people who can explain key workflows, and observe a representative process from start to finish. Record factual observations separately from interpretations. Before leaving, summarize open issues with site representatives, then assign each follow-up item to an owner.