In most business relationships, there is some balance of power. But when it comes to third-parties, your company holds all the cards. Most third-parties will go through all the hoops required to get the contract. Compliance’s response to that is often to create gold-plated third-party risk management programs that go so far over the edge that they actually add risk to the company. How?
Let’s say there’s a company with a tiny compliance department that is tasked with managing the third-party program. The scope is “all third-parties,” and it is impossible to review everything that comes in.
Imagine You’re a Prosecutor…
Now imagine for a moment that you’re a prosecutor who just initiated a bribery-related investigation at that company. You pull up the due diligence report on the guilty third-party and bingo – in several adverse media reports, there are references to prior misconduct. The company had the information, but no one reviewed it because they had far too many records to review. How would you, as a prosecutor, feel about that failure?
If you ask for too much information and documentation, you won’t be able to focus on the key pieces that really drive risk. 20+ page due diligence questionnaires, requests for references, licenses, business intake forms, and multiple background checks may make it impossible to do the job properly. This is especially true if you haven’t taken a risk-based approach, so you ask for in-depth information from all third-parties instead of the ones that really present risk.
What are you Going to Do with It?
When evaluating requests for information, ask yourself this question: what am I going to do with it? For example, many third-party due diligence questionnaires ask for banking references and business references. Answer truthfully -…
Read More