Skip to Content

Login   Subscribe   Site Index   Contact Us   Google Translate™

NYS Comptroller

THOMAS P. DiNAPOLI

How to Conduct a Vendor Responsibility Review


Before soliciting a procurement, you must decide whether you will conduct a vendor responsibility review for:

  • all vendors as part of their bid or proposal submission; or
  • only the vendor selected for the contract.

Be sure to take into account the time needed to conduct such a review. In the solicitation document, you should state that:

  • only responsive and responsible vendors will be awarded the contract;
  • prospective vendors must provide responsibility information (if the contract is valued at $100,000 or more); and
  • prospective vendors must certify the accuracy of the information they provide.

Documenting the Vendor Profile

After you complete your review, you must:

  • document the basis of your determination, and include any supporting information; and
  • note whether the questionnaire was filed online, and, if not, attach the paper questionnaire.

If you find the vendor to be:

  • responsible, you must include the Agency Responsibility Determination, which states that you’ve conducted an affirmative review and have reasonable assurance that the vendor is responsible.
  • non-responsible, you must provide the vendor with due process, including:
    • written notice detailing exact reasons for the preliminary determination; and
    • an opportunity to be heard before the determination is final.

Signing a Responsibility Determination

Only an authorized designee may sign the Agency Responsibility Determination. To authorize a designee, complete and file form AC1782-S Authorized Signature Form. If you want to limit the authorization so the designee may only certify vendor responsibility, indicate such in the third column (far-right).

Reviewing associated companies of the vendor

If the vendor has any parent or subsidiary companies, you should consider them as part of the review process and solicit information about them as needed.

However, if the prospective vendor will rely heavily on a parent or subsidiary company to perform the contract, then you should conduct a separate review for that company.

Reviewing subcontractors of the vendor

If the vendor will have a subcontractor perform part of the work, you must conduct a separate responsibility review if:

  • the subcontractor is known at the time of the contract award; and
  • the subcontract is valued at $100,000 or more.

If the above applies, the subcontractor must submit a separate questionnaire using its own Vendor ID (not the contractor’s). If the subcontractor doesn’t have one, you should request a Vendor ID on its behalf.

Note: A subcontractor includes any entity that receives State funds from the vendor to perform work on the awarded contract. For example, a vendor is awarded a contract worth $250,000 for an IT project. The vendor pays another firm $125,000 to write the software that will be used for the IT project. The firm is considered a subcontractor and must complete a questionnaire since their compensation is over $100,000.

Releasing information to the public

If the vendor completes the questionnaire online, only the Office of the State Comptroller and other State contracting entities will have access to the information. You may not share this information with third parties, especially other prospective vendors.

However, if you receive a Freedom of Information Law (FOIL) request or legal action (such as a subpoena or court order), you may provide all of the information in response, except for private information, such as social security number, personal address, or personal telephone number. This applies whether the questionnaire was filed online or by paper.

When completing the questionnaire, the vendor may designate information it believes is, or should be, exempt from FOIL disclosure. You should consider these designations before responding to a FOIL request, but it does not automatically exempt them.

More Information

The Vendor Responsibility Review Process

Documentation Requirements

How to Make a Responsibility Determination