The hottest three letters in the corporate world are “ESG.”

Environmental.

Social.

Governance.

As compliance vendors fall all over themselves setting up workshops and webinars to explain what each letter means, there is very little information about who should take on this new blended responsibility in companies.

Since few companies are hiring new people to run ESG, the question becomes which person or department should oversee it?

The answer is compliance. But, why? Well because…

It’s nearly midnight. The lawyers, accountants and top management have been working away in secret for months.

The deal is about to be announced – a huge strategic acquisition that will bring the company great benefits and rock the market.

You get a call at 11:59p.m.

The CEO quickly asks, “do we need to do some kind of compliance due diligence before we announce the deal in six hours?”

Or worse, you don’t get the call at all. You find out along with all of the other employees at the all-hands meeting.

Why is compliance so often the last to know about a potential merger or acquisition?

Considering the specter of successor liability for bribery and other compliance-related misconduct, compliance should be the first department called once a merger or acquisition begins to be seriously discussed. But even if we have the luxury of being called, we don’t always know what to do to perform proper due diligence on the target company. Here’s where to start…

The auditor enters the building, clipboard in hand. They run through the checklist: quality, pace, speed, and financial records. They give a score, make notes on remediation and opportunities for improvement, then leave. They never see that the workers are on their seventh straight 14-hour shift without adequate breaks. They don’t ask to see the living quarters. Why? They weren’t told to look.

Modern Slavery has become an increasingly focused-on area of compliance, and for good reason. It generates $150 billion a year in illegal profits making it the third-largest criminal industry behind drugs and arms trafficking. The International Labor Organization estimates that there are 40.3 million victims of human trafficking globally. One in four victims are children, and more than 16 million people are exploited in the private sector throughout a wide range of industries.

While governments around the world are beginning to address this issue with increased urgency, commercial enterprises can play a significant role in combating this evil. How do you ensure your company’s business activities are not indirectly supporting, encouraging, or financing Modern Slavery? One of the most effective and easily implemented measures your company should adopt is…

In most business relationships, there is some balance of power. But when it comes to third-parties, your company holds all the cards. Most third-parties will go through all the hoops required to get the contract. Compliance’s response to that is often to create gold-plated third-party risk management programs that go so far over the edge that they actually add risk to the company. How?

Let’s say there’s a company with a tiny compliance department that is tasked with managing the third-party program. The scope is “all third-parties,” and it is impossible to review everything that comes in.

Imagine You’re a Prosecutor…

Now imagine for a moment that you’re a prosecutor who just initiated a bribery-related investigation at that company. You pull up the due diligence report on the guilty third-party and bingo – in several adverse media reports, there are references to prior misconduct. The company had the information, but no one reviewed it because they had far too many records to review. How would you, as a prosecutor, feel about that failure?

If you ask for too much information and documentation, you won’t be able to focus on the key pieces that really drive risk. 20+ page due diligence questionnaires, requests for references, licenses, business intake forms, and multiple background checks may make it impossible to do the job properly. This is especially true if you haven’t taken a risk-based approach, so you ask for in-depth information from all third-parties instead of the ones that really present risk.

What are you Going to Do with It?

When evaluating requests for information, ask yourself this question: what am I going to do with it? For example, many third-party due diligence questionnaires ask for banking references and business references. Answer truthfully -…