A regulated business’s compliance obligations do not always stop at its own front door. A supplier with a lapsed license, a distributor who cannot produce a required tracking record, or a product missing required testing documentation can create compliance exposure for the business that bought it, depending on the requirement and the facts. A business may have its own obligations to verify suppliers and products, even when a supplier caused the underlying issue.
Vendor vetting also covers more than product. Most licensed businesses rely on two different kinds of outside party, and each needs its own checks. Below is how to tell them apart, what to confirm for each before the relationship starts, and how to keep that confirmation current afterward.
Product suppliers and service vendors are different risks
A product supplier sells you something you resell, process, or use in a regulated activity: inventory, ingredients, packaging, or regulated goods moving through a distribution chain. The questions are about the product and where it came from. Is the supplier authorized to sell it to you? Is the product itself permitted for sale where you operate? Can its path to your shelf be documented, where the rules require that?
A service vendor does work for you: security monitoring, alarm and fire system servicing, waste disposal, pest control, point-of-sale and IT support, transport, or cleaning. The questions are about the work. Does the vendor hold any license or certification the work requires? Is it insured appropriately? Will it hand over the records you need to show the work was done?
Running both groups through a single checklist tends to over-check one and under-check the other. A security vendor has no certificate of analysis to give you, and a product supplier’s insurance certificate says nothing about whether its product is permitted for sale.
Where a supplier’s issue can become the buyer’s issue
How far responsibility reaches depends on the industry, the jurisdiction, and the specific requirement. Two official examples show the pattern. California’s cannabis law requires commercial cannabis activity to be conducted between licensees, except as otherwise provided in that division, so a buyer there has its own reason to confirm a supplier’s license. At the federal level, the FDA states that the sale of unlawfully marketed tobacco products is subject to enforcement action, and that it issues warning letters to retailers that fail to comply. A retailer’s product selection is therefore its own compliance question, not only the manufacturer’s.
Other exposure is practical. Missing lab testing or certificate of analysis documentation, where the category requires it, can leave a buyer unable to show that a product meets its standard. A gap in a required tracking record makes it harder to show where a product came from. Product bought through an informal channel carries a higher risk of being counterfeit, diverted, or outside the regulated supply chain. Whether any of these leads to a finding, and against whom, depends on the applicable rules, and your counsel is the right person to assess that where it matters.
None of this requires a dishonest vendor. An otherwise reputable supplier can let a license lapse, fall behind on testing paperwork, or change its own sourcing without telling its customers.
What to check for a product supplier
- Current license or registration status, where the product or activity requires one, confirmed with the issuing authority or its public lookup rather than taken from a copy the supplier sent
- Product eligibility: whether the product is permitted for sale in your jurisdiction, checked against the regulator’s current rules or published product lists where they exist
- Testing or certificate of analysis documentation, on file and matched to the batch or lot, wherever the product category requires it
- Chain-of-custody or track-and-trace records, where the rules require them, showing how the product reached the supplier and moved to you
- Insurance and indemnification: insurance reviewed with your broker, and indemnification provisions reviewed by counsel
What to check for a service vendor
- Any license, certification, or registration the service requires, such as for alarm, fire protection, waste, or transport work, confirmed with the issuing body
- Certificates of insurance naming the right parties, with the policy expiry date tracked separately from the date the certificate was issued
- The records the vendor will hand over after each visit, such as service tags, inspection reports, disposal manifests, or access logs, and where they will be filed
- Access to your premises, systems, or data, including who approves that access and who removes it when the relationship ends
- Contract terms on scope, subcontracting, and notice of changes, reviewed by counsel where the terms matter
Some checks will not apply to a given vendor. Mark those N/A with a short reason, so a reviewer can tell a check that did not apply from one that was skipped.
A supplier’s lapsed license does not always stay the supplier’s problem. Depending on the requirement and the facts, it can create compliance exposure for the buyer too.
Why this gets skipped
Vendor relationships tend to move fast, driven by price, product availability, or an introduction that made the first order feel low-risk. Vetting, when it happens at all, is often a one-time step done by whoever placed that first order, checked once, and never revisited. As a business grows and adds locations, new vendors can be brought on independently at each site, faster than any central process was designed to review them.
That reflects the ordinary pace of running a business more than carelessness. The difficulty is that a vendor list that grew informally may have gaps nobody has looked for yet.
Keeping the vendor file current
Centralize approval so that a new supplier or service vendor is added only after the standard check runs, whichever site or manager found it. Keep a vendor file for each active vendor, holding the license, testing, insurance, and contract documents that apply to it, with expiry dates tracked rather than assumed. The Vendor and Supplier Vetting Checklist covers the initial review, and the Vendor File Tracker keeps the recurring dates, the internal relationship owner, and the evidence in one place.
Then add vendor re-verification to the same compliance calendar you use for your own licenses and permits, with a named person responsible and a backup. A license or test result confirmed at onboarding says nothing about whether it is still current a year later. Re-check on a set schedule, and also when a supplier changes ownership, sourcing, or product lines.
Sources
- California Business and Professions Code, Section 26053 (accessed September 26, 2026)
- U.S. Food and Drug Administration, Advisory and Enforcement Actions Against Industry for Unauthorized Tobacco Products (accessed September 26, 2026)
Talk through your vendor file
SPL Management maintains vendor files, re-verification dates, and contract renewals as part of Business Operations Management for licensed businesses in the United States and Canada. Contract and liability questions stay with your counsel. If a second look at your vendor list would help, a 30-minute consultation is a practical place to start.
General information only, current as of the last review on September 26, 2026. Rules vary by jurisdiction and change often. This is not legal, tax, or real estate advice; confirm current requirements with the regulator or a qualified professional before acting. How we write and review articles.
Keep reading
Operations
How to Set an Internal Compliance Review Schedule
· 5 min read
Operations
Point of Sale Compliance: Age Verification and Transaction Records in Regulated Retail
· 6 min read
Operations
One Playbook, Every Location: Standardizing Operations Across Multiple Sites
· 5 min read
