Third Party Due Diligence

All companies get work done with the help of third parties (e.g., suppliers, vendors, agents, distributors, consultants, logistics and travel providers, customers) and the compliance team is responsible for managing the risk associated with all of those relationships. The main way risk is managed is through a TPRM program where the compliance team does periodic due diligence on each third party partner. Most compliance teams will take a risk-based approach and grade each third party high, medium, or low risk and then match their level of scrutiny to the risk level. High-risk third parties might need to sign stricter contracts, be assessed more frequently, or be subject to audits by the company. A third party could be assessed as high risk for many factors, for example, the type of company data they have access to, the geography they sit in being known as corrupt, or their overall importance to the company's supply chain functioning.

What does third party due diligence actually cover?

Diligence runs in three passes, and mature programs keep all three running rather than treating onboarding as the finish line.

1. Before you engage. Confirm the company exists and find out who owns it. Screen the entity and its principals against sanctions and debarment lists. Understand what you're paying for and whether the fee makes sense for the work. Ask who introduced the relationship and why.
2. In the contract. Anti-corruption representations, audit rights, books and records obligations, a right to terminate for a compliance breach, and a commitment to follow your code of conduct or an equivalent standard.
3. After you engage. Re-screen on a cycle. Refresh diligence when the relationship, the geography, or the ownership changes. Watch invoices and payment patterns. Train the third parties who act for you, and keep the training records.

The people who own the relationship, usually procurement or a business lead, are the ones most likely to see a problem first, which is why diligence built entirely inside compliance tends to miss things.

How do you risk-rank a third party?

Rank by the risk the relationship creates, not by how much you spend with it. Small contracts create some of the largest exposure, particularly where an agent interacts with government officials on your behalf.

Your compliance risk assessment should set these criteria. If the tiering rules live only in one person's head, you can't show a regulator why a given vendor landed where it did.

What is third party risk management (TPRM), and is it the same thing?

Close, and not identical, and the difference is worth being honest about because the two communities use the same words.

In compliance and anti-corruption vocabulary, TPRM is the program: the standing process that identifies third parties, tiers them, diligences them, and monitors them. Due diligence is the core activity inside it. That's the sense the approved definition above uses.

In information security and vendor-risk vocabulary, TPRM usually means something adjacent: assessing vendors for cybersecurity, resilience, data protection, and business continuity, typically through security questionnaires, SOC 2 reports, and continuous monitoring ratings. The owner is a security or vendor-risk team, the outputs feed contract security terms, and bribery risk barely features.

Both are real. A supplier can be low security risk and high corruption risk at the same time, and a program that runs only one assessment will keep missing one of them. If your company uses "TPRM" to mean the security review, give the anti-corruption diligence its own name so the two don't quietly merge into one questionnaire.

Third party due diligence vs. customer due diligence

These get confused constantly, and the boundary is clean once you name it.

• Customer due diligence is anti-money-laundering work directed at customers. You're identifying and verifying who you're taking money from, understanding the nature of the relationship, and monitoring for suspicious activity.
• Third party due diligence is compliance program work directed at the parties who act for you or supply you: vendors, agents, distributors, consultants, resellers. You're asking whether this relationship could create corruption, sanctions, data, or supply chain exposure.

Different direction of travel, different risk, different owner in most companies. One entity can be both, and when that happens it needs both reviews rather than whichever one got there first.

What does the DOJ look for?

The Justice Department's Evaluation of Corporate Compliance Programs, updated September 2024, gives third party management its own section at Part I.E, under the question of whether a compliance program is well designed. It runs four sets of questions, and they map cleanly onto the three passes above.

• Risk-Based and Integrated Processes. The ECCP asks "how has the company's third-party management process corresponded to the nature and level of the enterprise risk identified by the company?" and "how has this process been integrated into the relevant procurement and vendor management processes?"
• Appropriate Controls. It asks "how does the company ensure there is an appropriate business rationale for the use of third parties?" and what mechanisms exist to ensure "that the contract terms specifically describe the services to be performed, that the payment terms are appropriate, that the described contractual work is performed, and that compensation is commensurate with the services rendered."
• Management of Relationships. It asks "how does the company monitor its third parties?" and whether the company has audit rights over third parties' books and accounts and "has the company exercised those rights in the past?"
• Real Actions and Consequences. It asks whether the company tracks red flags identified in diligence and how they're addressed, and whether it keeps track of third parties that fail diligence or get terminated and takes steps to make sure they aren't hired or re-hired later.

The DOJ and SEC's FCPA Resource Guide sets out the red flags that make a third party relationship worth a second look. The Resource Guide lists, among others: "excessive commissions to third-party agents or consultants"; "unreasonably large discounts to third-party distributors"; third-party "consulting agreements" that include only vaguely described services; a third-party consultant "in a different line of business than that for which it has been engaged"; a third party "related to or closely associated with the foreign official"; a third party that "became part of the transaction at the express request or insistence of the foreign official"; and a third party that "is merely a shell company." Any one of those is a question rather than a verdict. Several together are a reason to stop.

FAQ

Is third party due diligence legally required?

It's what prosecutors expect to see in an effective compliance program. The DOJ's ECCP dedicates Part I.E to third party management under the question of whether a program is well designed, and asks whether diligence is risk-based, integrated into procurement, and maintained over the life of the relationship.

How often should you refresh diligence?

Tie it to the risk tier and to events rather than to a fixed calendar alone. High-risk third parties typically get an annual refresh, and any change of ownership, geography, scope, or government touchpoint should trigger a fresh look regardless of the cycle.

Is TPRM the same as third party due diligence?

In compliance usage, TPRM is the program and due diligence is the activity inside it. In security usage, TPRM usually means vendor cybersecurity and resilience assessment, which is adjacent work with a different owner. Check which sense your company means before you assume one review covers both.