Could anything stop you bidding for a public contract?

Director disqualification (under the Company Directors Disqualification Act 1986, or an equivalent order) engages a mandatory exclusion ground under Schedule 6 of the Procurement Act 2023, which attaches to a supplier and to 'connected persons' — directors, shadow directors and persons with significant control — not only to the corporate entity. Companies House publishes the disqualified-officers register and it is searchable by name, so a contracting authority can and does check it. Note the register is searchable by NAME ONLY: it cannot be queried by company, so both we and the buyer are matching names, and same-name confusion cuts both ways.

Appointments and terminations must be filed (forms AP01/TM01 and their equivalents) and the confirmation statement keeps the PSC register current. A stale officer list creates two distinct procurement problems: an ex-officer's disqualification or conduct can be attributed to your supplier record, and any mismatch between your declared connected persons and the public register looks, at best, careless — at worst like a misrepresentation in a bid, which is itself an exclusion ground.

Schedule 6 lists specific offences (including fraud, bribery and corruption, tax evasion and facilitation, cartel offences under the Competition Act 1998, theft and money-laundering offences, terrorism, and offences under the Modern Slavery Act 2015) which, where unspent and attaching to the supplier or a connected person, engage a mandatory exclusion. The practical control is a documented declaration process for directors and PSCs, refreshed periodically and before significant bids, so the answer in your supplier questionnaire is evidenced rather than assumed. Convictions are not publicly checkable — this stays self-declared by design.

Poor performance is a discretionary ground under Schedule 7: broadly, a breach of a public contract that led to termination, damages or a settlement, or performance that fell so far short it warranted such a step. Contracting authorities can share supplier performance information, and poor-performance notices can be published, so this is checkable by the buyer in a way most Schedule 7 grounds are not. Keep the contemporaneous record — the dispute, the resolution, and what changed after.

Labour-market and health-and-safety infringements sit among the discretionary grounds in Schedule 7, alongside environmental misconduct. Relevant evidence includes HSE enforcement notices and prosecutions, employment-tribunal awards, labour-market enforcement undertakings and orders, and national-minimum-wage naming. Some of these are published, so a buyer may find them whether or not you volunteer them.

Modern-slavery offences are a mandatory ground; supply-chain due diligence is the practical control buyers probe for. Businesses over the Modern Slavery Act 2015 s.54 turnover threshold must publish an annual statement, but smaller suppliers are asked for the substance regardless: supplier screening, a policy, a route for workers to raise concerns, and evidence it is applied rather than filed.

This is 'self-cleaning'. Where a ground applies, an authority must consider whether the circumstances are continuing or likely to occur again, taking account of the steps the supplier has taken: the people responsible no longer involved, the failure investigated and its causes addressed, controls and training changed, and cooperation with any investigating body. Contemporaneous documentation is what makes the argument; a retrospective account written during a bid rarely persuades.

Insolvency sits in Schedule 7 of the Procurement Act 2023 ("Insolvency, bankruptcy, etc") as a DISCRETIONARY ground: it applies where the supplier or a connected person has become bankrupt, become subject to insolvency or winding-up proceedings, or had assets placed in administration or receivership. Because it is discretionary, an authority may still contract with a supplier in proceedings — commonly where an administrator is trading the business on and can evidence capacity to perform. Companies House publishes the live status (`company_status`) plus a `has_insolvency_history` flag covering past events; we read both. Note the ground reaches CONNECTED PERSONS' personal bankruptcy too, which is held on the Insolvency Service's Individual Insolvency Register — a separate source we do not check.

Cyber Essentials is mandated for central-government contracts involving the handling of certain personal or sensitive information, and is widely imposed below that as a condition of participation or a contract term. Certification is annual and non-retrospective, so lapse dates matter: set a renewal reminder at 10–11 months, because re-certifying takes longer than most suppliers expect and a bid deadline will not wait for it.

CE Plus adds an independent assessor's technical verification (authenticated vulnerability scanning of a sampled device set, malware-protection and patch-level testing) on top of the self-assessed baseline, and must be achieved within three months of the corresponding CE certification. Higher-assurance requirements sit above it again. The audit surfaces exactly the gaps a self-assessment lets you talk past, which is why lead time, not paperwork, is the binding constraint.

The five controls (firewalls, secure configuration, security update management, user access control, malware protection) are assessed against the current question set, and several are hard-fail items — unsupported software still in use, missing MFA on cloud services, unapplied high/critical updates beyond 14 days. Our passive scan observes secure-configuration and encryption-in-transit signals on the public site only; it cannot see endpoints, so a clean scan evidences part of one control, not the certificate.