Most companies fully understand the need to comply with the Foreign Corrupt Practices Act requirements around third parties, as they represent the greatest risks for an FCPA violation. Most companies, however, are not created out of new cloth but are rather ongoing enterprises with a fully up-and-running business in place. This means they may need to bring resources to bear to comply with the FCPA while continuing to operate an ongoing business. This can be particularly true in the area of performing due diligence on third parties. Many companies understand the need for a robust due diligence program to investigate third parties, but they struggle with how to create an inventory to define the basis of third-party risk and thereby perform the requisite due diligence required under the FCPA.
Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. A business justification and questionnaire aimed at a potential third-party in your third-party management process should provide you with a jumping-off point to consider the level of due diligence that you should perform on third parties. This leads to Step 3 in the five steps of the third-party management: due diligence.
Jay Martin, CCO at BakerHughes, often emphasizes that a company needs to evaluate and address its risks regarding third parties. This means that an appropriate level of due diligence may vary depending on the risks arising from the relationship. The appropriate level of due diligence required by a company when contracting for the performance of IT services may be low to reflect low risks of bribery on its behalf. Conversely, a business entering the international energy market and selecting an intermediary to assist in establishing a business in such markets will typically require a much higher level of due diligence to mitigate the risks of bribery on its behalf. Performing due diligence is not simply a nice element to have in your compliance program. It is a mandatory step that is risk based and designed to give you the information to move forward.