Ten questions that separate a channel from a middleman

A wholesale supplier evaluation should answer four questions: is the counterparty who it claims to be, can it supply the exact goods, can it execute the transaction, and can the buyer detect and recover from failure? A business registration or attractive sample answers only a fraction of that. The review should be proportionate to product, payment, geography, channel, and consequence.

NIST's SP 1326 due-diligence assessment is scoped to technology supply-chain risk, not every retail product. Its governance pattern is still useful: define the assessment, collect evidence, document risk, make a decision, and preserve rationale. Adapt questions to the merchandise rather than copying a universal checklist.

Set risk tier and approval before collecting files

Classify the proposed transaction by deposit, annual spend, branded or counterfeit exposure, safety or regulatory risk, customization, lead time, import complexity, data access, and replacement difficulty. State required evidence, approvers, pilot, credit limit, and review cadence for each tier. Urgency should not silently lower the tier.

Verify legal identity and payment consistency

• Confirm legal entity, formation jurisdiction, operating address, and authorized signatory through reliable sources.
• Verify business domain, phone, and contacts independently of the inbound sales message.
• Match contract party, invoice issuer, tax details, and bank beneficiary; investigate differences.
• Confirm facility existence and role through reliable records, live walkthrough, or qualified third party when risk warrants it.
• Preserve effective dates and reviewer rather than overwriting older evidence.

A legitimate company can still be incapable of a specific order. Identity verification is the start of capability review, not its conclusion.

Confirm product access and source model

Determine whether the party manufactures, distributes, brokers, imports, holds stock, or sources after order. Ask who owns current inventory, where it is, whether quantity is physically verified, and which upstream records will flow to the buyer. Use the source-model comparison to make responsibilities explicit.

CBP's counterfeit-awareness guide explains risks counterfeit goods pose in e-commerce. Price far below market, removed identifiers, inconsistent packaging, payment pressure, and refusal to explain source deserve escalation. A risk signal is not proof; document the investigation and decision.

Evaluate commercial and operational capability

Government market-research guidance again provides a useful model rather than a private rule: compare capabilities and customary practices before selecting a source. Ask candidates the same core questions so a polished presentation does not substitute for evidence.

Validate authenticity and traceability

Request identifiers, product and packaging photos, upstream commercial records appropriate to risk, shipment links, serial or lot handling, and authorization evidence when claimed. GS1's Global Traceability Standard offers a framework for linking what, when, where, why, and who. Continue with product authenticity and chain of custody.

Check references through an independent channel

Ask references about products, quantities, dates, fill, defects, credits, communication, and length of relationship. Verify the reference's identity independently. A generic recommendation from an address supplied and controlled by the candidate is weak evidence. Use references to corroborate the operating story, not replace documents and a pilot.

Run a controlled pilot

1. Use the same entity, account, product, documentation, and route planned for scale.
2. Limit payment and quantity exposure while preserving a meaningful test.
3. Define product, pack, timing, quality, evidence, and claim success criteria before order.
4. Inspect and record accepted, quarantined, and rejected units.
5. Reconcile actual landed cost and communication against the quote.
6. Approve, conditionally approve, or reject with named limits and evidence.

A pilot cannot prove unused capacity or long-term financial health. Pair results with limits, staged releases, and monitoring. Feed the approved profile into the B2B sourcing process.

Protect supplier records

Due-diligence files can contain bank details, tax identifiers, ownership, signatures, addresses, pricing, and shipment data. Restrict access, encrypt storage and transfer, log review, retain originals, and define deletion. Confirm document requests through trusted channels to reduce business-email-compromise risk.

Monitor change, not only calendar dates

Trigger review after entity, ownership, bank, domain, facility, factory, product source, quality process, route, insurance, or key-contact changes. Track fill, lead variance, defects, evidence quality, claims, and payment behavior. Suspend or narrow approval when risk exceeds the documented limit rather than waiting for an annual review.

Sources and further reading

• NIST SP 1326 — Supply Chain Due Diligence Assessment
• GS1 Global Traceability Standard
• U.S. Customs and Border Protection — Awareness of Counterfeits in E-Commerce
• Federal Acquisition Regulation Part 10 — Market Research