The Consequences of Inadequate Due Diligence

Adequate Due Diligence

Running worldwide businesses requires effectively recognizing, analyzing and managing risks and ensuring compliance. We have identified that many organizations with third-party relationships conduct inadequate due diligence that might pose significant risks. In this article, we look at the possible risks and the best practices for conducting adequate due diligence and third-party risk management effectively, such as:

1. Planning
2. Documentation
3. Culture

Continuous Risk Management

Today’s global business requires efficiently managing a network of third-party partners that supply product components, run operations in foreign markets, operate call centers, or act as outside consultants or agents.

A well-maintained third-party network’s vast array of capabilities and specialized skill sets make operations easier for the organization and its customers. But many organizations, from small businesses to multi-national corporations, can rarely afford the time and effort required in-house to manage these often-complex third-party relationships.

Because of this, the risk of unethical business practices, bribery and other business corruption potentially increases if inadequate due diligence is conducted on third-party partners. The ramifications of a scandal related to a third-party partner can easily take down an organization, resulting in such risks as a damaged reputation and brand devaluation, regulatory violations, legal proceedings and possible fines and jail terms for directors. Therefore, a solid and viable third-party risk management program is the only way to protect the corporation’s assets fully.

Building a third-party risk management program is not a passive process. It continually requires time and effort as the risks associated with third-party partnerships evolve.

Explore Third-Party Risk Management Solutions

Consider the recent events during which the legislators of three separate nations signed new compliance regulations and standards into law. Suppose your organization’s third-party risk management program cannot quickly adjust to these new regulations (or is not designed to anticipate future legislative movements). In that case, your organization is genuinely at risk.

Cutting Corners Not Worth the Risk: Adequate Due Diligence

Indeed, building a solid risk management program requires a significant investment of time and resources (internally and from the outside). Still, the consequences of not doing it right could be dramatically severe. Still, far too many organizations are willing to tempt fate by cutting corners on developing and implementing their third-party risk management program.

Organizations attempt to cut corners by relying on outdated or stagnant tools to monitor, detect, and prevent risks. Hiring outside industry professionals with proven track records of successful due diligence experience is necessary.

Relying too heavily on “desktop” due diligence is another dangerous shortcut. Desktop due diligence is an essential initial step of the investigative process, involving background checks, lien searches, regulatory filing investigations and environmental reports. And while it is a vital component of any effective due diligence program, it’s not nearly enough to evaluate the third party thoroughly.

Truly understanding a potential partner’s business requires a considerable amount of time spent face-to-face with the outside organization’s leadership, operations management and even current customers. This “boots on the ground” process will detect potential risks, often hidden from a distance and undetectable via web-based discovery tools.

The “boots on the ground” approach also help to establish a relational dynamic required for ongoing negotiations and provides a clear insight into two of the fastest-growing issues in third-party risk management: Bribery and Labor Management.

Bribery As a Compliance Issue

Anti-bribery and anti-corruption compliance is a fast-moving target. New anti-bribery laws and regulations are being decreed worldwide at a relentless pace. Complicating matters further, many countries may have laws in place but cannot enforce them adequately. The responsibility falls to your organization’s adequate due diligence program to ensure detection and protection when this happens.

High profile investigations in recent years have contributed to the rapid emergence of bribery and corruption as a societal issue. Never before has such a contrast been drawn so dramatically on a global stage between those who engage in corruption and those who suffer. Any organization that finds itself mixed up in a scandal involving bribery has more than a legal mess. It has a long battle to win back the trust of its shareholders, employees, customers and the public.

Conducting adequate due diligence surrounded such varying factors is work that must be completed in person. Gaining insight into a potential partner’s company culture requires immersion with the organization’s leadership, management and staff. When evaluating bribery risk, some warning signs can only be discovered on-site.

This e-book explores some critical questions posed to business leaders today: Has your organization implemented reasonable and proportionate measures to prevent bribery? How will you know if your anti-bribery and anti-corruption controls are effective? Are you aware of the latest best practices in avoiding bribery? Download our eBook to find out! READ NOW

Labor Matters and Compliance

From overtime issues and under-age workers to unsafe working conditions and improperly documented accidents, labor compliance represents a significant component of any solid third-party risk management program.

Once again, inadequate attention to risks related to labor compliance can bring on considerable penalties. Understanding which industries, geographic regions, and management structures elevate the organization’s risk is vital to efficiently operate an adequate due diligence program. This understanding is nearly impossible to guarantee via ‘desktop’ due diligence. Spending the necessary time in person is the only way to ensure a potential supplier properly compensates and manages employees while providing a safe workplace environment.

Even if your agreement with a third-party partner places the responsibility of payroll issues firmly upon the vendor, your organization — as a joint employer — can still be held accountable in many countries. After all, the labor conducted at your partner’s facility benefits your organization’s bottom line.

What are the Best Practices?

The demands of identifying and measuring third-party risk, monitoring those potential risks on an ongoing basis, and making recommendations based on empirical research are best met by a dedicated team of outside professionals. And while no two organizations are alike in terms of risk profiles, several factors have become consistent in building a strong, effective and adequate due diligence program:

1. Planning: Without a well thought out plan outlining ongoing monitoring efforts with assigned roles and responsibilities, measures to mitigate risk will be haphazard at best and dormant at worst. With a thoroughly established, management-advocated program that identifies specific risk factors for each affiliation, a process for addressing red flags, and an established mechanism for continual revision, the organization will remain vigilant in its efforts to protect itself from liability.

2. Documentation: Due diligence efforts are only as good as the information and data gathered and secured. Meticulous documentation and reporting enable the organization to recognize trends, communicate analyses, and sustain efforts during any future personnel changes. Effective risk management programs feature established guidelines for capturing data, contracts and research with uniformity.

3. Culture: An organization where leadership, management and workforce do not take the third-party risk seriously will never be adequately protected from risk. Successful organizations in this respect dedicate themselves to building a culture in which every employee feels personally invested in the operation’s risk management. Employees must feel empowered and encouraged to report red flags. Passive engagement is simply not enough.

Done correctly, third-party risk management can effectively save the organization from risk, liability, and other perils often associated with outside entities wanting to engage and transact with your business.

A TPRM Customized Solution that Best Suits Your Needs

CRI Group™’s own exclusive, expert-developed 3PRM™ services help you proactively mitigate risks from third-party affiliations, protecting your organization from liability, brand damage and harm to the business. Whether your organization has a large, well-established third-party program, is in the early stages of development, or is anywhere in between, the 3PRM™ solution can improve the health of your program and future-proof your entire business in many forms.

Our 3PRM™ solution streamlines the third-party risk management process through scalability, and efficiencies – from third-party risk identification to assessment what sets us apart is that our 3PRM™ solution includes:

• العناية الواجبة 360°
• Screening & Background Checks
• Regulatory Compliance
• Business Intelligence: Information Management
• Investigations: i.e. IP, Fraud, Conflict of Interest, etc.
• Anti-bribery & Anti-Corruption (ABAC) Compliance
• Employee auditing training & education
• Monitoring & reporting

Where Should TPRM Sit within an Organization?

TPRM can sit within various business units depending on your organization’s structure. Many organizations involve multiple departments such as procurement, information security, operational risk and compliance to provide input to manage the risks related to engaging third parties. Depending on your business’ internal structure, you may choose to apply a centralized, mixed or decentralized model when focus on TPRM. At CRI Group™ we observed a trend with many of our clients implementing a centralized model when managing their third-party relationships, given the required input from their multiple business lines. A centralized model allows you as an organization to track common risks across departments and identify emerging trends that may require a response from more than one department.

Risk Management Goes Beyond TPRM

CRI Group™ provides the knowledge required to navigate unfamiliar markets and mitigate third party risk by assessing the backgrounds, integrity and character of those with whom you do business. Our 3PRM-Certified™ program is therefore key for managing an organization’s third party risk levels. However, this is only one of the several vital steps towards a robust risk management strategy implementation.

Risk management is the identification, evaluation, and prioritization of risks (defined in ISO 31000 as the effect of uncertainty on objectives) followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events or to maximize the realization of opportunities. Risks can come from various sources including your employees.

Getting Started with ISO 31000 Risk Management? Learn more with our “ISO 31000 Playbook”

At CRI Group™, we understand that managing compliance and risk activities might be a daunting task. That’s why we present you with the insights library where you can dive deep into these topics to make your job easier. If you can’t find what you are looking for, just get in touch – we would love to have a chat!

CONTACT INFORMATION

Zafar Anjum | CRI Group™ Chief Executive Officer
t: +44 207 8681415 | m: +44 7588 454959