How to run marketing agencies vendor due diligence before you sign

What to take away

Start with legal identity and ownership

Ask the marketing agency for its registered company number and confirm the entity on the Companies House register. The trading name on the pitch deck is not enough: check that the company which will sign is the one you have verified.

Review the filing history and the persons with significant control (PSC) record for late accounts or a recent change of control. A change of ownership in the past 12 months is not disqualifying, but it changes who you are really buying from.

Record the date you checked. Diligence is a snapshot, and anyone reviewing your file later will want to know when it was taken.

Send every candidate the same request list

Send the list on day one and keep every reply with the date it arrived.

Test financial health against contract value

Request the last two sets of filed accounts, plus a current management account if the agency will hold significant spend. Read them for the trend, not just the headline turnover.

Check the credit score and any county court judgments from that report, then look at cash, debtor days and concentration. If one client is more than a quarter of revenue, name that dependency risk in your notes.

Check regulatory and accreditation standing

In England, advertising claims are governed by the Consumer Protection from Unfair Trading Regulations 2008 as well as self-regulation. Ask the marketing agency which codes it works to and who signs off creative before a campaign goes live.

If the agency runs media, ask how it tracks rule changes. Non-broadcast and direct marketing work falls under the CAP Code and broadcast work under the BCAP Code, both administered by the ASA, whose CAP webinars are one practical way for agency teams to stay current.

Where programmatic buying is in scope, ask about supply-chain standards. The IAB UK back to basics guide to programmatic is a reasonable benchmark for the questions to put to them.

For media buying, the ISBA media knowledge pages set out how the media agency sector is structured. That helps you judge whether the agency's model fits your brief.

Put the commercial model under the microscope

Ask for a worked example of a typical month: fees, media commission, technology charges and any rebates. Vague answers become invoice disputes later.

If you are comparing several firms on one brief, send each the same request list and score the replies the same way, so you are not comparing unlike things.

Confirm who owns the data, creative files and ad accounts at the end of the contract. Under the UK GDPR the agency acts as a controller or processor of your customer data and answers to the ICO, so the contract should say which role it holds and what happens on exit. Ownership is cheap to settle now and expensive to argue about at exit.

Pin down four terms before the lawyers see the paperwork: notice and termination, assignment of IP in the work and the data, audit rights over media and technology spend, and disclosure of any rebates or volume discounts. Agree them while the commercial model is still open, not after the first invoice.

Before and after: what changes once diligence is done

Set walk-away triggers in advance

Agree with finance or legal what would stop the process. Typical triggers include accounts flagged as overdue at Companies House, refusal to name the signing entity, or unwillingness to document data ownership.

Write them down before you request documents. That removes the temptation to rationalise a weak answer because you like the pitch.

Keep a single diligence file

Store every document, the date received and the date checked in one place. Note who reviewed each item and what they concluded.

A one-page summary at the front, with the four areas and a pass or flag against each, is usually enough for sign-off. Keep the detail behind it.

Common questions

How long should vendor due diligence take?

For a mid-sized retainer, two to three weeks is workable if documents are requested on day one. Longer delays usually mean the agency is slow to produce records, which is itself useful.

Do I need to check every subcontractor?

No. Check the ones touching your data, media spend or brand-facing output. Ask for the list, confirm which named suppliers will do the work, and check that each one sits under a written processor agreement, as the UK GDPR requires.

What if the agency refuses to share accounts?

Filed accounts are public at Companies House, so refusal to discuss them is a warning sign. Verify the basics yourself before deciding whether to continue.

Should legal review happen before or after commercial terms?

Commercial terms first, then legal. Lawyers need the agreed scope and cost model before they can judge the clauses around them.