Compliance & Vendor Review Checklist
Document ID: CHK-COMP-001
Owner: Audit, Risk & Compliance Lead
Entities: Alas 9 Inc. & Operating Subsidiaries
Cadence: Semi-Annual or Prior to Onboarding Critical Vendors
Interactive Printable & Downloadable Instrument
The standardized operational instrument is embedded below. You can complete entries or check off items directly in the viewer, print to paper or PDF via the print trigger, or download the self-contained HTML asset for field distribution.
1. Third-Party Vendor Due Diligence
Prior to onboarding or renewing vendors that handle sensitive data, physical access, or critical operational workflows:
- Corporate Existence & Identity:
- Vendor legal corporate name and state of registration confirmed via Secretary of State search.
- Vendor W-9 or W-8BEN collected with verified Taxpayer Identification Number (TIN).
- Insurance Coverage & Certificates:
- Certificate of Insurance (COI) received naming Alas 9 Inc. and/or ALAS ARTISTRY LLC as Additional Insured.
- Commercial General Liability (CGL): Minimum $1,000,000 per occurrence / $2,000,000 aggregate.
- Workers' Compensation: Statutory state limits verified.
- Cyber Liability / Errors & Omissions (for IT, software, or data services): Minimum $1,000,000 limit.
- Security & Data Privacy Controls:
- Vendor access to company credentials or data conforms to principle of least privilege.
- Data Processing Addendum (DPA) or Business Associate Agreement (BAA) signed where applicable.
- Incident notification obligation within 48 hours of security compromise established by contract.
- Vendor Performance & Financial Stability:
- Commercial references or historical track record verified.
- Pricing model, billing cadence, and termination for convenience terms reviewed.
2. Internal Operations & Policy Compliance Audit
Review core internal compliance controls across shared services:
A. Human Resources & Workforce Integrity
- Form I-9 (Employment Eligibility Verification) completed and on file for 100% of W-2 personnel within 3 days of hire.
- Independent contractor classification verified against IRS common-law rules and DOL economic realities tests.
- Non-Disclosure Agreements and Proprietary Information Assignment Agreements signed by all workers.
- Required federal and state workplace posters displayed physically in facilities or accessible on employee intranet.
B. Financial & Accounting Controls
- Dual-authorization controls enforced on wire transfers, payroll runs, and disbursements exceeding $2,500.
- Monthly bank reconciliations completed and reviewed by independent management within 15 days of month-end.
- Corporate credit card receipts and expense reports substantiated with itemized vouchers.
- Segregation of duties maintained between invoice approval and payment execution.
C. Physical Facility & Safety Standards
- OSHA workplace safety inspections conducted and hazard communication standard active.
- Fire extinguishers inspected, tagged, and unobstructed.
- First-aid kits stocked and emergency exit paths clearly marked.
- Environmental storage (chemicals, paints, oils, batteries) compliant with EPA/IDEM guidelines (ALAS ARTISTRY facility).
3. IT Systems & Cyber Hygiene Audit
Verify key technology and data protection standards:
- Multi-Factor Authentication (MFA) enforced on all corporate email, cloud drives, GitHub, and accounting systems.
- Access deprovisioning checklist executed within 24 hours of employee/contractor termination.
- Data backups for critical databases, repos, and financial ledgers automated and verified with periodic restore tests.
- Company-issued laptops encrypted with full-disk encryption (BitLocker / FileVault).
4. Audit Findings & Corrective Action Summary
| Section | Finding / Non-Conformance | Severity (Low / Med / High) | Corrective Action Required | Assigned Owner | Target Completion |
|---|---|---|---|---|---|
5. Audit Attestation
I attest that this compliance review was conducted thoroughly in accordance with approved Alas 9 Inc. standards, and all identified non-conformances have been logged for corrective action.
Lead Auditor Name & Title: __________________________________________________
Signature: _______________________________________ Date: ________________