Skip to main content
Oversight Institute
Category: Assessment and Due Diligence

Financial Condition Review

Also known as: Financial Review, Financial Health Assessment
Simply put

A financial condition review is a structured evaluation of a company's financial statements, records, and reporting practices to understand its financial health. In third-party risk management, it typically helps an organization judge whether a supplier or vendor is financially stable enough to keep delivering goods or services. It is a point-in-time evaluation and does not by itself guarantee that a party will remain solvent in the future.

Formal definition

A financial condition review is the systematic evaluation of a counterparty's financial statements, accounting records, operational metrics, and reporting practices to assess financial stability and viability. In a third-party risk context it is typically applied during onboarding and periodic reassessment to inform financial-risk scoring and risk-tier decisions; it generally does not, on its own, address information security, operational, geopolitical, or ESG risk. The term should not be conflated with the accounting profession's formal 'financial statement review' engagement, which is conducted by an independent accountant using analytical procedures and inquiry and is narrower in scope and less rigorous than an audit. A financial statement review provides limited assurance rather than an audit opinion, and neither a review engagement nor a general financial condition review constitutes independent verification of solvency; findings are point-in-time and can become stale as a counterparty's circumstances change. Where reviews rely on self-reported or unaudited data, results carry the corresponding limitations, and coverage typically extends only to the direct third party rather than to fourth-party or lower-tier dependencies.

Why it matters

A supplier or vendor that is financially deteriorating can disrupt delivery of goods or services, default on contractual commitments, or fail outright, and these outcomes often surface with little warning to the buying organization. A financial condition review gives risk and procurement teams a structured basis for judging whether a counterparty is financially stable enough to continue performing, and for calibrating financial-risk scoring and risk-tier decisions during onboarding and periodic reassessment. Without such a review, financial-stability judgments tend to rely on informal impressions or reputation rather than on the counterparty's statements, records, and reporting practices.

The value of the review is bounded by its nature as a point-in-time evaluation. Findings can become stale as a counterparty's circumstances change, so a favorable review does not by itself guarantee that a party will remain solvent in the future. Where the review draws on self-reported or unaudited data, the results carry the corresponding limitations, and coverage typically extends only to the direct third party rather than to fourth-party or lower-tier dependencies whose distress could still interrupt supply.

A further reason it matters is that the term is easily conflated with the accounting profession's formal 'financial statement review' engagement. That engagement, performed by an independent accountant using analytical procedures and inquiry, is narrower in scope and less rigorous than an audit and provides limited assurance rather than an audit opinion. Neither a review engagement nor a general financial condition review constitutes independent verification of solvency, and treating either as such can create false confidence in a counterparty's viability.

Who it's relevant to

Third-party risk and procurement teams
These teams use financial condition reviews to judge whether a supplier is financially stable enough to keep delivering, and to inform financial-risk scoring and risk-tier decisions at onboarding and periodic reassessment. They should treat results as point-in-time and note that coverage typically extends only to the direct third party, not to fourth-party or lower-tier dependencies.
Vendor and supplier managers
Those responsible for ongoing relationships rely on periodic reviews to detect signs of financial deterioration that could threaten continued performance. Because findings can become stale as circumstances change, these managers benefit from scheduling refreshes rather than treating a single favorable review as durable.
Compliance and assurance functions
These functions need to distinguish a general financial condition review from an accountant's formal financial statement review engagement, which provides limited assurance rather than an audit opinion. Neither constitutes independent verification of solvency, a distinction that matters when documenting the basis for financial-stability conclusions.

Inside Financial Condition Review

Financial Statement Analysis
Review of a third party's balance sheet, income statement, and cash flow statement to assess liquidity, leverage, profitability, and solvency. In many programs this relies on audited statements where available, though smaller or privately held vendors may only provide unaudited or self-reported figures, which carry lower assurance.
Credit and Financial Risk Scoring
Use of third-party credit ratings or commercial financial-health scores to benchmark a vendor's likelihood of financial distress. These scores are typically point-in-time indicators derived from external data and do not, on their own, confirm operational viability or guarantee continued solvency.
Going Concern and Viability Indicators
Assessment of signals that a supplier may struggle to continue operating, such as declining revenue, negative working capital, or auditor going-concern qualifications. This component addresses financial durability but does not by itself cover operational, security, or geopolitical risk.
Risk-Tier Alignment
Calibration of the depth and frequency of financial review to the criticality of the relationship. Higher-tier or single-source dependencies typically warrant more frequent and detailed review than low-criticality vendors, depending on the program's risk-tiering methodology.
Ongoing Monitoring Component
Mechanisms to track financial condition over time rather than solely at onboarding, since a single review reflects only a moment in time and can become stale as a vendor's circumstances change.

Common questions

Answers to the questions practitioners most commonly ask about Financial Condition Review.

Is a financial condition review the same as a credit check or credit score?
No. A credit check or third-party credit score is typically one input into a financial condition review, not the review itself. A financial condition review is a broader assessment that may consider liquidity, profitability, leverage, cash flow, and other indicators of a supplier's ability to continue performing, whereas a credit score is a single, often model-derived summary metric. Depending on the risk tier, a review may draw on financial statements, public filings, and third-party ratings together rather than relying on any single figure.
Does a healthy financial condition review mean the supplier will not fail or default?
No. A financial condition review is typically a point-in-time assessment based on available and often historical information, and it does not guarantee future solvency or continuity. Financial conditions can deteriorate rapidly between review cycles, and self-reported or dated financials may not reflect current reality. The review reduces uncertainty about financial viability but does not eliminate the risk of failure, and it generally does not address operational, security, geopolitical, or ESG risks unless those are assessed separately.
How often should a financial condition review be refreshed?
Refresh frequency typically depends on the supplier's risk tier and criticality. Higher-tier or critical suppliers are often reviewed more frequently, while lower-tier relationships may be reviewed less often. Because a review is point-in-time and can become stale, many programs supplement periodic reviews with ongoing monitoring or trigger-based reassessment when material events occur. There is no single universal cadence that applies across all programs or jurisdictions.
What information sources are commonly used in a financial condition review?
Common inputs may include audited or unaudited financial statements, public regulatory filings where available, third-party credit ratings or scores, and structured questionnaires. Availability varies significantly: publicly listed suppliers may offer more disclosure than privately held ones, and some suppliers may provide only self-reported figures. Reviewers should note where data is self-reported and not independently verified, and where visibility is limited to the direct supplier rather than lower tiers.
How does a financial condition review fit alongside other due diligence activities?
A financial condition review typically addresses financial viability and is one component of a broader due diligence process that may separately cover information security, operational resilience, compliance, and other risk domains. It generally does not substitute for those assessments. In many programs it informs onboarding decisions and ongoing monitoring but is scoped to financial risk, so gaps in other domains require dedicated controls.
What are the practical limitations to account for when relying on a financial condition review?
Key limitations include the point-in-time nature of the assessment, potential reliance on dated or self-reported financials that lack independent verification, and limited visibility beyond the direct supplier into fourth-party or lower-tier dependencies. Data availability also varies with supplier structure and jurisdiction. Programs often address these limitations through ongoing monitoring, trigger-based reassessment, and by treating the review as one input rather than a definitive measure of continued viability.

Common misconceptions

A financial condition review confirms a vendor is financially stable and will not fail.
A financial condition review is a point-in-time assessment based on available, often self-reported or historical data. It estimates financial risk but cannot guarantee future solvency or eliminate the possibility of vendor failure.
Financial condition review is interchangeable with overall risk assessment.
Financial condition review addresses only the financial and viability dimension of third-party risk. It does not by itself cover information security, operational resilience, geopolitical, or ESG risk, which require separate assessment components.
A strong credit score or good financial statements mean there is no concentration or continuity risk.
Financial health is distinct from concentration risk, single-source dependency, and single point of failure. A financially sound vendor can still represent a critical dependency whose disruption would materially affect the organization.

Best practices

Calibrate the depth and frequency of financial review to the vendor's risk tier and criticality, applying more rigorous and recurring review to high-tier and single-source dependencies.
Prefer audited financial statements where available, and explicitly note the reduced assurance when relying on unaudited or self-reported figures.
Treat financial reviews as ongoing rather than one-time onboarding checks, and establish monitoring so findings do not become stale as a vendor's condition changes.
Combine external credit or financial-health scores with direct analysis of statements rather than relying on a single score as a standalone conclusion.
Keep the financial review distinct from, but coordinated with, other risk domains such as security, operational resilience, and geopolitical risk, so gaps are not overlooked.
Document what the review does and does not cover, including data limitations, so downstream decision-makers understand the scope and confidence of the assessment.
Promotional banner graphic asking if you are ready for PCI DSS 4.0 with a call-to-action to get the guide