Around every company lie concentric circles of third-party risk.

Inside the innermost circle, colored green, sit the company's core of trusted employees and customers. Then around that is a wider circle of primary third parties used by the company—suppliers, agents, joint venture partners, and others—colored in yellow.

Then comes the third, final circle: the third parties of those third parties—sub-contractors, local agents, and many others, nearly untraceable to corporate headquarters. That final circle is, of course, bright red and for good reason: some multinational companies refer to it as the circle of fear.

Indeed, several compliance and risk executives who attended ...