Below the Prime: A Due Diligence Routine for UK Service Supply Chains

A UK service contract may carry one company's name, but delivery frequently depends on a wider group of suppliers. The client sees the prime contractor. It may not see the specialist engineer, the temporary site team, the software host or the logistics partner behind the service. That arrangement can be entirely sound. It can also place the prime contractor's reputation at risk if a subcontractor fails to meet the standard the client has been promised.

The commercial lesson is not that subcontracting should be avoided. It is that the supply chain should be visible, evidenced and governed before work begins. In 2026, buyers are more attentive to how suppliers manage their own delivery networks. A clear audit routine helps a prime contractor answer reasonable questions and, more importantly, catch problems while they are still manageable.

Begin with a map, not a list

A common weakness is to hold a list of subcontractors without understanding how they fit together. A due diligence file should start with a supply chain map. For each subcontractor, record the legal entity, the scope it performs, the sites or services it supports, the contract value, the key personnel involved and the dependence it creates.

The map should also identify lower tiers where these are material. A small subcontractor that relies on a single specialist supplier may be a single point of failure twice removed. The exercise is not about bureaucracy. It is about seeing where the main contract is exposed.

Ownership matters. One person should maintain the map, with delivery leads confirming changes. The map should be version-controlled and reviewed when a new subcontractor is proposed, when scope changes, or when a contract enters a new phase. A document created at bid stage and never updated is of limited value once mobilisation begins.

Verify legal and financial standing

Basic checks are often skipped because the relationship feels familiar. They should still be done. Confirm the exact legal name and company number through Companies House, review filing history and accounts, and look for signs of distress such as late filings, insolvency events or charges that suggest constrained finances. For smaller suppliers, consider whether the level of financial information available is sufficient for the value and risk of the work.

Where relevant, check VAT registration and sector-specific registrations. A supplier handling personal data should be able to explain its data protection arrangements and, where required, its registration with the Information Commissioner's Office. A supplier working in regulated activity should hold the appropriate licence, and the prime contractor should know what that licence permits.

Financial standing is not only about survival. It is also about capacity to absorb delay, fund mobilisation and pay staff before the prime contractor's payment cycle reaches them. A financially fragile subcontractor can become a delivery risk long before it becomes an insolvency statistic.

Evidence compliance as a live position

Certificates and policies are useful only if they are current and relevant. A supply chain audit should maintain a compliance register showing the evidence held, the expiry date and the person responsible for renewal. Public liability, employers' liability and, where appropriate, professional indemnity insurance should be checked for cover limits, exclusions and the activities actually insured. A certificate that names a different legal entity or excludes the work being performed is not adequate evidence.

Health and safety arrangements deserve particular attention. For higher-risk work, the prime contractor should see method statements, risk assessments, training records and accident reporting procedures. Where certification schemes are used, the prime contractor should understand what has been certified and what sits outside the scope. The same discipline applies to environmental permits, waste carrier registrations and safeguarding checks where the service involves vulnerable people.

A useful rule is to check evidence at source where possible and to record the date and method of verification. An email attachment can be altered or out of date. A short verification note creates a stronger record.

Test capacity before the first job

Compliance evidence does not prove that a subcontractor can deliver. Capacity should be tested against the actual requirement. Ask for comparable contracts, client references and evidence of current workload. Visit the premises or hold a structured video walkthrough. Speak to the named supervisor who will run the work, not only the sales contact who won the opportunity.

For key-person dependencies, ask what happens if the supervisor leaves or is unavailable. A credible subcontractor should be able to describe its bench strength, escalation route and arrangements for covering absence. Where the work depends on equipment or software, confirm availability, maintenance and support arrangements.

Flow down the obligations that matter

The main contract will contain obligations that must reach the subcontractor. These commonly include confidentiality, data protection, anti-bribery, health and safety, quality standards, reporting, audit rights, insurance and termination. The subcontract should reflect them in clear terms. A purchase order alone is rarely sufficient for a material service.

Change control should be agreed in advance. If the client changes the specification, the prime contractor needs a route to pass the change down without losing control of price, time or risk. Notice provisions should work in practice: if the subcontractor must alert the prime contractor to a problem within a set period, the subcontract should say so plainly and the operational team should know how to act on it.

Set a reporting rhythm and plan for continuity

The prime contractor should receive the same quality of information it must give its client. Agree the performance measures, incident reporting route and review cycle at the start. Keep a shared log of issues, actions and decisions. Periodic checks, including occasional site visits or file reviews, are more useful than a single audit at appointment.

Continuity planning should be proportionate but real. Identify alternative suppliers for critical tasks, document handover requirements and confirm how data and equipment will be returned. If the subcontractor fails, the prime contractor needs a plan that does not begin with a blank page.

Keep the audit alive

A supply chain audit is not a one-off onboarding exercise. It should be refreshed annually and on trigger events such as a change of ownership, a new site, a serious incident or a significant scope change. Findings should be recorded, assigned to an owner and reviewed at management level. The client may never ask to see the file, but the prime contractor should be able to produce it if asked.

The visible contract is the one the client signs. The invisible one is the network that makes delivery possible. Treating that network with the same discipline as the main agreement is a practical way for UK suppliers to protect client relationships and avoid surprises when the service is under scrutiny.