Marketplace seller software vendor due diligence: conflicting replies

A supplier's sales reply, documentation and contract can give different answers to the same question. Marketplace seller software vendor due diligence needs a way to resolve those differences without treating the newest document, strongest wording or most impressive certificate as decisive. Check each answer against its evidence and the evidence's stated scope.

For an already-chosen vendor, separate disputed statements, classify their evidence, record their limits and obtain a reviewable resolution before relying on an answer. Keep a traceable explanation of what is established, what remains disputed and who must resolve it, rather than blending several different replies into a single general assurance.

Define the disagreement before asking for another answer

Start with one proposition that can be checked. Broad questions about whether a vendor is secure, reliable or suitable invite broad assurances. A defined question gives the reviewer a specific point to assess and resolve against the evidence available, so the answer can be judged against the issue that matters.

A question about whether a particular assurance record covers the service edition you intend to use is narrower and answerable. Record the conflicting statements separately, identifying the service, edition, territory, account or configuration each describes, where that information is available. Apparent contradictions can be differences in scope, rather than conflicting answers to the same proposition.

A public support page might describe the supplier's overall offer while the agreement describes only your purchased plan. The issue is then establishing which promise applies to your purchase, not choosing one wording without checking what each record covers. Use these distinctions when framing the disputed question:

Do not let a vendor reply answer a neighbouring question instead. Evidence that a support channel exists, for example, does not resolve a disagreement about when a contracted response is due. Keep the disputed proposition specific so the response can be assessed against the question that matters.

Classify the evidence without creating a league table

Classify the original statement and the evidence supporting it separately. A certification badge on a vendor page remains a first-party claim until the underlying assurance record is available and its scope can be examined. The badge alone does not establish what the record covers.

These classes describe what a record establishes, not which supplier is better, and they are not a ladder on which every answer must reach the same top rung. The class states an answer's limits rather than substituting a label for examining the evidence.

A signed support commitment and a service observation answer different questions. Keep both if you need to understand obligation and delivery, rather than replacing one with the other. A quality checklist can help keep the evidence and its limits visible without treating different classes as interchangeable.

Identify your own test record as buyer test evidence. It can support a conclusion about the observed configuration without being labelled independent third-party assurance or stretched into a claim about all future operation. Keep the result tied to what the test actually observed.

Make a contradiction record, not a blended answer

Give the disagreement its own record and preserve each contributing answer. This stops a later clarification from silently erasing what the buyer originally saw or understood. Keep the original statements available alongside any resolution so a reviewer can follow why the question arose and how it was addressed.

Record the source, date, owner, limitation and expiry for each answer. Add the disputed proposition and the reason the two records cannot yet be relied on together. A planning template can support a structured record of the decision and its owner.

Distinguish a document's issue date from the date you downloaded it. Obtaining an old record today does not make its contents current. Keep both dates where known, so the record shows when the evidence was issued and when it entered the buyer's file. The owner should also state what decision depends on the answer.

That might be accepting a support obligation or relying on a certification claim; it should not become a general statement that the whole vendor is approved. Keep the decision within the disputed proposition, so the conclusion does not imply approval beyond the answer the evidence supports.

Resolve the conflict through a repeatable sequence

Resolve a conflict by sending the vendor the precise discrepancy, not a fresh questionnaire covering the whole service. Ask for an explanation that identifies the applicable record and supplies the evidence needed to check it. Keep the request tied to the conflicting statements already recorded.

Follow this sequence:

A clarification email can explain documentation, but do not assume it changes an agreement. Where the reply proposes a different contractual obligation, have the reviewer establish whether an agreed change is required. Keep the contract review distinct from assessing the supporting evidence.

Do not resolve the issue by counting how many documents repeat an answer. Several pages may repeat the same unsupported claim, while none supplies the missing evidence. A review methodology can help keep failed checks and their reruns visible without changing what the records establish.

Worked example: support wording and the signed agreement

Consider an illustrative disagreement in which public documentation describes round-the-clock support availability, while the signed agreement limits the purchased service's response commitment to business hours. Neither statement should be rewritten into a single promise of immediate help at any time. Keep the wording and the agreement separate.

First separate availability from response obligation. A channel that accepts messages outside business hours is not necessarily a commitment to respond outside those hours. The question is what the public wording describes and what response commitment applies to the purchased service, rather than whether a channel is available.

Record the public description as claimed and the applicable agreement as contracted. Ask the supplier whether the public wording describes message submission, staffed assistance or a different plan, and request the relevant service definition. Preserve the reply with the original records so the contradiction record retains the documents and question for its reviewer.

Worked example: a certification claim with unclear coverage

Consider a second illustrative case: the vendor presents an ISO/IEC 27001 certification claim, but the available certificate does not make the connection to your intended service clear. The existence of a certificate and the coverage of your service are separate propositions, so establish each from the evidence available.

ISO/IEC 27001 certification concerns an information security management system within a stated scope. Record the certificate's organisation, scope and date, then ask for evidence connecting that scope to the service you intend to use rather than assuming a shared brand is enough.

Keep the vendor's broad statement as claimed while the coverage question remains unresolved. The certificate can still be independently evidenced for what it actually covers; it need not be discarded merely because it does not establish the broader proposition. Keep the stated scope attached to any conclusion.

The same distinction applies when examining a SOC 2 report or Cyber Essentials certification. Record what was examined and when, and avoid converting that scoped finding into approval of the entire service. A claim should remain limited to what its record supports, rather than being treated as a general assurance.

A useful resolution narrows the statement to the supported scope or supplies the missing connection. If neither happens, retain the coverage question as unknown rather than allowing the certification badge to settle it. The scope and any unresolved point should remain clear to the next reviewer.

Resolve entity mismatches before attributing an answer

Resolve an entity mismatch by establishing which organisation made the statement and which one would owe the obligation. A reply can be accurate yet belong to a different organisation from the one you will contract with. Do not attribute the answer to the contracting party without establishing the connection.

When a brand, registered company and contracting entity differ, identify which entity made the statement and which entity would owe the obligation. Record the legal and trading names, company number, contracting party and relevant authority evidence together so reviewers can see where the mismatch arises and what remains to be reconciled.

The GOV.UK VAT number check shows whether a UK VAT registration number is valid and the name and address of the business it is registered to. Use that result to reconcile registration details, not to infer that the software works or that a representative has authority to change contractual terms.

Companies House records likewise concern the entity, not the behaviour of its software. If the disagreement concerns who is supplying the service, keep it open until the vendor explains the relationship and the contracting record supports the intended arrangement.

Handle changed and expired answers without rewriting history

A later document date does not by itself amend a signed contract. Check what changed, which service version it affects and whether the change has been agreed where agreement is needed.

Keep the date and affected scope with the answer under review, distinguishing a correction, a change and an unresolved conflict.

Distinguish three situations in the record:

Keep the earlier evidence in each case, marked with its disposition. Deleting it would remove the explanation of why the buyer asked for clarification or changed its conclusion. Set recheck points against the evidence, not an invented universal validity period, so the record retains the reason for review.

A certification expiry, revised service edition, changed supplier entity or amended agreement may require review of the affected answer. Recheck the evidence relevant to the change rather than assuming every record has the same review date. An expired evidence record makes its continued use uncertain; it does not automatically mean that a contractual obligation has ended.

Recheck the evidence supporting the conclusion and ask the appropriate reviewer to interpret the agreement separately. For repeated checks, keep the original record and the reason for the recheck together. For a changed privacy answer, use the data protection checklist to identify the precise question that needs specialist review.

GOV.UK data protection guidance can inform the privacy review without replacing the buyer's specific evidence assessment. Keep the old and new answers beside that question rather than presenting the newest vendor reply as a complete privacy conclusion, and record what remains unresolved.

Close the disagreement with a bounded conclusion

A resolved record should say exactly what was established and what was not. It should identify the applicable source, scope, reviewer, resolution date and next recheck point. Keep the conclusion within the evidence and the particular question the buyer asked, rather than extending it to other vendor claims.

For example, the support case can close once the applicable commitment and the meaning of the public wording have been established. That conclusion does not establish whether support performs well in practice, and it should not be described as doing so. The record should preserve that distinction for anyone relying on it.

Where the answer remains unknown, record the missing evidence, the responsible owner and the decision that cannot yet rely on it. A strong answer on an unrelated subject cannot resolve the disputed proposition. Keep the decision on hold where it depends on evidence that has not been supplied.

The finished record is an explanation another reviewer can follow, not a confidence score. It supports a specific decision about an answer; it does not establish legal compliance or overall vendor fitness. The conclusion should make its limits visible to anyone relying on it.