How to run copywriting services vendor due diligence

Match each assurance to evidence and to the way the work will be bought, handled and handed back. The pairs below show how to replace weak purchasing habits with specific checks. Keep unresolved questions visible before signing or sharing sensitive material, and use the selection checklist to connect this review to the wider buying decision.

The name that will carry the work

Identify the legal party that will sign and invoice before relying on a proposal name or trading identity. A clear counterparty gives procurement a record of who is responsible for the work if questions arise later.

Weak version: Treat the name on a presentation as the contracting party without checking whether it belongs to the business that will sign the agreement or receive payment. A trading name or logo alone does not establish which legal entity is responsible for the work.

Better version: Request the registered company number and address, review filing history, accounts and charges, and record the trading name as well as the legal entity if they differ. Put that legal entity in the agreement. The agency status check offers a related perspective on identity and word ownership.

Assurances that can be checked

Verify claims about insurance and past performance against documents and conversations. Match the evidence requested to the value and risk of the engagement, rather than relying on a confident pitch or references chosen only to praise the supplier.

Weak version: Accept a statement about insurance or successful past work without requesting evidence. Speak only to references expected to offer praise, and treat that conversation as proof that delivery will be reliable under different circumstances.

Better version: Request professional indemnity and public liability certificates, then compare their limits with the contract value. Ask two clients with a similar sector and budget what went wrong as well as what worked. Use supplier risk scenarios to consider where the proposed work could expose your organisation.

Routes taken by sensitive material

Find out how information moves from the brief through staff, subcontractors, shared drives and tools. Include personal data and unpublished material, and understand retention and use before sharing anything sensitive.

Weak version: Accept a general security assurance without asking which tools receive information, how long it is retained, whether AI inputs train models, or how the supplier will notify you of a breach. Assume that subcontractors, data locations and information-sharing arrangements need no further examination.

Better version: Ask which AI tools receive information, whether inputs train models, how long they retain it, what security evidence and breach notification process applies, and which subcontractors handle it. If the supplier processes personal data, check Article 28 terms, its ICO fee and register position where relevant, plus any international safeguard such as the IDTA or UK Addendum to the EU SCCs.

Use the data protection requirements when assessing processing arrangements, then verify rather than collect labels: if the supplier cites ISO 27001 or Cyber Essentials, ask which services and controls the evidence covers. Record how information is shared, retained and protected, rather than treating a general assurance as proof.

Rights attached to each file

Agree the rights required before work begins. Receiving a draft or finished file does not necessarily transfer every right, particularly where the supplier brings existing templates or research into the engagement.

Weak version: Assume that delivery means your organisation owns every element, including material the supplier already had. Treat confidentiality and ownership as interchangeable, or leave the handling of earlier material until after the work has been completed.

Better version: Set contract terms that state whether copyright in delivered copy transfers after final payment and whether moral rights are waived where permitted. Identify pre-existing material that should be licensed rather than assigned, and address confidentiality and any intellectual property indemnity separately.

Body copy and slogans or brand names can raise different rights questions. Specify which rights are assigned and which are licensed, and check the Trade Marks Act 1994 where relevant. A moral rights waiver should be addressed in the agreement where permitted. Possession of files is not the same as a transfer of every right.

A workable departure from the start

Agree the handover while both parties can still define what delivery means. Name the materials and access needed, set a deadline, and avoid relying on the supplier's project tools as the only place where the work can be managed.

Weak version: Leave working files and access credentials until the relationship ends, then discover that essential materials sit in a supplier-controlled system. Assume that the completed copy alone is enough to continue the work without disruption.

Better version: List the handover materials, including style guides, keyword research, unpublished drafts and access credentials. Set a handover deadline and agree notice periods for both parties. A content calendar held in the supplier's project tool may take separate work to move.

Include continuity and capacity when judging options, and use a supplier comparison before setting final scoring weights. Agreeing handover expectations alongside service terms helps identify gaps before work starts, rather than leaving the next team to find out which files or access arrangements are missing.

Review effort matched to exposure

Scale the review to the engagement without dropping core questions about identity, rights, information handling and exit arrangements. Proportionate scrutiny means requesting useful evidence early and resolving gaps before commitment, not gathering paperwork without a clear purpose.

Weak version: Exempt a freelancer from basic checks, postpone evidence requests until late, or approve a complex engagement without legal input. Treat subcontractor visibility as optional even where those parties handle personal data or regulated claims.

Better version: Ask a sole trader the same core questions. For a mid-sized engagement, allow two to three weeks and request insurance certificates and references early. Escalate regulated sectors, large budgets or long exclusivity periods to legal. Ask which subcontractors are involved and what they handle; refusal to identify relevant parties is a warning sign.

Place these checks in the wider buying sequence with the tools and suppliers guide. Keep evidence behind the decision, record unanswered questions and confirm that the agreement reflects the risks identified. This makes the review part of the purchase rather than a separate exercise disconnected from delivery.