Skip to main content
Oversight Institute
Category: Assessment and Due Diligence

Financial Viability Review

Also known as: Financial Viability Assessment, Financial Viability Review (FVR)
Simply put

A Financial Viability Review is an evaluation of whether a company or supplier can generate enough cash flow and income to cover its ongoing operating costs and debt obligations. In a third-party risk context, it helps an organization judge whether a prospective or current supplier is financially stable enough to continue delivering goods or services. It focuses on the entity's ability to keep operating and meet its commitments, rather than on other risk areas such as information security or ESG performance.

Formal definition

A Financial Viability Review is a due diligence activity that assesses a third party's financial capacity to continue achieving its operating objectives, meet operating payments and debt commitments, and sustain delivery over the term of a relationship. It typically examines cash flow sufficiency relative to ongoing operational costs and debt repayments, and, depending on the program and risk tier, may consider the entity's broader ability to remain a going concern. Its scope is generally limited to financial soundness and does not by itself address operational, information security, geopolitical, or ESG risk. Because reviews are often point-in-time and may rely on reported or historical financial information, findings can become stale and typically require ongoing monitoring rather than a single onboarding assessment. Requirements and mandatory reporting content vary by sector and jurisdiction; some regimes and professional standards (for example, in planning and regulated housing contexts) prescribe specific viability review requirements that differ from general commercial supplier assessments.

Why it matters

A supplier that cannot generate enough cash flow to cover its operating costs and debt obligations poses a continuity risk to every organization that depends on it. A Financial Viability Review helps a buyer judge whether a prospective or current supplier is financially stable enough to keep delivering goods or services over the term of a relationship. Without this lens, an organization may onboard or continue relying on a partner whose deteriorating finances threaten delivery, regardless of how strong that partner's technical or operational capabilities appear.

Because financial distress can develop gradually and then surface abruptly, financial viability findings are most useful when treated as an input to ongoing monitoring rather than a one-time gate. A review is typically point-in-time and often relies on reported or historical financial information, so a supplier judged sound at onboarding may weaken later. Programs that revisit viability on a cadence aligned to risk tier are better positioned to detect emerging problems before they disrupt supply.

It is important not to overstate what this control covers. A Financial Viability Review addresses financial soundness, the ability to remain a going concern and meet commitments, but does not by itself evaluate information security, operational resilience, geopolitical exposure, or ESG performance. Treating a favorable viability finding as a broad assurance of supplier health can leave material risks in those other domains unassessed.

Who it's relevant to

Procurement and vendor management teams
These teams use Financial Viability Reviews during onboarding and, where warranted by risk tier, on an ongoing basis to judge whether a supplier is financially stable enough to keep delivering. They should treat a favorable review as an indicator of financial soundness only, and pair it with assessments covering other risk domains.
Third-party risk and due diligence functions
Risk practitioners incorporate viability findings into a broader due diligence picture. Because reviews are often point-in-time and may draw on historical data, these functions typically schedule periodic reassessment rather than relying on a single onboarding check, calibrating frequency to the criticality of the supplier.
Business continuity and resilience owners
Where a supplier is critical to delivery, viability concerns can signal continuity risk. Resilience owners use these findings to inform contingency planning, though they should note that financial viability does not by itself address operational disruption, single-source dependency, or other resilience factors.
Practitioners in regulated planning and housing contexts
In some jurisdictions and sectors, financial viability reviews are subject to prescribed requirements, for example, professional standards governing viability in planning, and regulated housing frameworks assessing an entity's ability to meet operating and debt commitments. Practitioners in these settings must apply the applicable mandatory requirements, which differ from general commercial supplier assessments.

Inside Financial Viability Review

Financial Statement Analysis
Review of a supplier's balance sheet, income statement, and cash flow statement to assess liquidity, solvency, profitability, and leverage. Depending on the supplier's structure and jurisdiction, statements may be audited, reviewed, or unaudited/management-prepared, which affects the reliability of the underlying figures.
Creditworthiness and Third-Party Ratings
Use of external credit scores, ratings, or risk indicators (for example from commercial business-information providers) as a screening input. These are typically point-in-time indicators and may lag actual changes in a supplier's condition, so they supplement rather than replace direct analysis.
Liquidity and Solvency Indicators
Assessment of the supplier's ability to meet short-term obligations (liquidity) and long-term obligations (solvency), often examined together with working capital and debt-servicing capacity. These indicators speak to going-concern viability but do not by themselves address operational, security, or ESG risk.
Concentration and Dependency Considerations
Evaluation of how dependent the supplier is on a small number of customers, financiers, or revenue streams, which can affect its financial resilience. This is distinct from the buying organization's own concentration risk or single-source dependency on that supplier.
Ongoing Monitoring Triggers
Definition of events or thresholds (such as covenant breaches, rating downgrades, or missed reporting) that prompt re-review. Because a viability review is typically point-in-time, monitoring is what keeps the assessment from becoming stale between onboarding and periodic reassessment.

Common questions

Answers to the questions practitioners most commonly ask about Financial Viability Review.

Is a financial viability review the same as a credit check?
No. A credit check typically produces a score or rating reflecting creditworthiness and payment behavior, whereas a financial viability review is a broader assessment of a supplier's ability to remain a going concern and continue delivering under the contract. A credit score can be one input, but it does not by itself capture liquidity trends, dependency on a small number of customers, or other structural weaknesses that a viability review examines. Relying on a credit check alone leaves gaps that many programs address with additional financial analysis.
Does passing a financial viability review mean a supplier is financially stable and won't fail?
No. A financial viability review is typically point-in-time and reflects the information available at the time of assessment. A supplier's financial position can deteriorate after the review through market shifts, loss of major customers, or other events. The review reduces uncertainty but does not eliminate the risk of supplier failure, and it does not constitute a guarantee of continued solvency. Many programs pair the initial review with ongoing monitoring to detect changes between assessments.
What information is typically needed to conduct a financial viability review?
Reviews often draw on financial statements, credit reports or ratings, and indicators of liquidity, leverage, and profitability, supplemented where available by public filings or third-party financial data. For private suppliers where audited statements may be limited, programs may rely more heavily on third-party data providers or supplier attestations, which should be treated as self-reported unless independently verified. The depth of information gathered typically scales with the risk tier of the relationship.
How often should a financial viability review be refreshed?
Because the review is point-in-time, its value degrades as conditions change. In many programs the refresh cadence depends on the risk tier, with higher-criticality or single-source suppliers reviewed more frequently. Some programs supplement periodic reviews with event-driven triggers, such as adverse news, missed deliveries, or ratings changes, rather than relying on a fixed schedule alone.
How does a financial viability review fit alongside other due diligence activities?
A financial viability review typically addresses financial and going-concern risk but does not by itself cover information security, operational resilience, geopolitical, or ESG risk, which are usually assessed through separate controls. It is one component of a broader due diligence process and is often correlated with concentration risk and single-source dependency analysis, since the failure of a financially weak supplier that is also a single point of failure can have amplified impact.
What are the practical limitations to account for when using a financial viability review?
Key limitations include the point-in-time nature of the assessment, reliance on self-reported or delayed financial data, and reduced visibility into private suppliers or entities in jurisdictions with less stringent disclosure requirements. Visibility also typically extends only to the direct supplier, not to fourth-party or Nth-party dependencies whose financial distress could still disrupt delivery. Programs generally treat the review as one input to be combined with ongoing monitoring rather than as a standalone assurance.

Common misconceptions

A financial viability review is a one-time onboarding check that confirms the supplier is financially sound.
A viability review is typically point-in-time and reflects the supplier's condition as of the data reviewed. A supplier's financial position can deteriorate after onboarding, so many programs pair the initial review with ongoing monitoring and defined re-review triggers rather than treating the onboarding result as durable.
A strong financial viability review means the supplier is low-risk overall.
Financial viability addresses going-concern and solvency-related risk. It does not by itself cover information security, operational, geopolitical, or ESG risk, and it does not assess whether the supplier is a single point of failure in the buying organization's operations. It is one dimension of a broader risk picture.
A favorable credit rating or supplier attestation of financial health is equivalent to independent verification.
Third-party ratings are point-in-time indicators that may lag real conditions, and a supplier's self-reported or unaudited figures are attestations rather than independently verified results. Reliability generally increases when statements are audited or corroborated by external sources, but no single input eliminates the risk.

Best practices

Treat the review as point-in-time and pair it with ongoing monitoring, defining explicit triggers (such as rating downgrades, covenant breaches, or late reporting) that prompt reassessment.
Weight the reliability of inputs by their source, distinguishing audited statements from reviewed or management-prepared figures and treating supplier self-attestations as unverified until corroborated.
Use external credit ratings and business-information scores as supplements to direct financial statement analysis rather than as substitutes, recognizing they may lag actual changes in condition.
Scope the review explicitly, stating that it addresses financial viability and does not cover information security, operational, geopolitical, or ESG risk, so stakeholders do not over-read a favorable result.
Consider the supplier's own concentration and dependency exposures separately from the buying organization's dependency on that supplier, and avoid conflating the two.
Calibrate depth and re-review frequency to the supplier's risk tier and criticality, applying more rigorous analysis and more frequent monitoring to suppliers whose failure would materially disrupt operations.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.