Third-party due diligence means checking out the businesses you rely on and the people who run them. You do it before you sign, and again while you're working together. Many companies start with their suppliers, which makes sense. But the relationships that deserve the closest look are often the ones acting in your name, like the offshore firm delivering work to your clients, the provider listed on your marketplace, or the distributor selling your product in another country.
When one of those goes wrong, the question usually isn't whether they could deliver. It's what they did while they were representing you. That calls for a different kind of check than making sure a supplier can pay its bills.
Contracts call them vendors, partners, consultants, or resellers, but the label doesn't tell you much. What matters is what they do for you.
With a supplier, the main worry is whether it can hold up its end. It might miss a delivery, run out of cash halfway through a contract, or drag you into a dispute with someone else. So the check leans on money and court records, things like liens, judgments, bankruptcies, and lawsuits. Our explainer on vendor risk management covers that side in more detail.
Someone acting for you carries a different risk. An offshore provider, a distributor, an agent, or a seller on a marketplace you run makes promises, takes payments, and deals with customers or officials with your name attached. The questions shift to who really runs them, whether they show up on sanctions lists, whether their history fits the job, and whether they're close to anyone in government.
Plenty of relationships are both. A distributor buys from you and sells for you, so it gets both checks.
Third-party due diligence is one piece of third-party risk management (TPRM). A third-party risk management program also keeps one running list of who your partners are, writes in the right to audit them and walk away, watches performance, and handles what happens when a relationship ends. Security reviews of vendors who can reach your systems or data are their own discipline, usually run through questionnaires, and our piece on where a vendor questionnaire stops covers where the two meet. And since these are business decisions rather than hiring ones, you generally don't need the company's consent to run the check.
The Foreign Corrupt Practices Act (FCPA) treats a bribe paid through your agent the same as one you paid yourself, and "we didn't know" doesn't hold up if the warning signs were there. That's why anti-bribery checks focus on the people in between. When the Organisation for Economic Co-operation and Development reviewed hundreds of foreign bribery cases, 3 out of 4 ran through a third party.
The warning signs usually look ordinary. A commission that seems high for the work. A consultant whose real business has nothing to do with what you hired them for. A request to be paid into an account in another country. These tend to show up in your own paperwork rather than in a background check, so it helps to know which questions a check can actually answer.
A good check tells you whether the company is registered where it says it is and has been around long enough to have the history it claims. It tells you who runs it, and whether the company or those people turn up on sanctions lists, carry a record of lawsuits, or have local news coverage that doesn't fit the role. A sanctions check only covers the names you run, so run it on the principals as well as the company, and look at the other businesses they operate. Someone with a problem history often turns up under a different company name.
Ownership is where you should expect limits. A registry will name the officers, but following the money through layers of offshore companies can go past what public records show, so it's worth knowing where beneficial ownership records stop before you count on them. Many of these middlemen also work abroad, where records vary a lot by country and checks take longer. Searching on individuals overseas generally requires their consent, too.
None of this tells you whether a payment was a bribe. It tells you whether the person you're paying is who they say they are, and whether their background fits the work. That's the part a background check can answer.
Many teams we talk to check new partners before signing, then aren't sure what to do about the ones they already have. You don't have to rescreen everyone at once. A quick sanctions sweep across the whole list is a reasonable first pass, and the deeper checks can go to the relationships that carry the most exposure.
One marketplace we work with has about 550 providers and decided to start with roughly 100 in its higher-risk countries. Another company tied its screening to its contract renewals, about 1,200 a year, so each renewal becomes the moment to take another look.
When you're deciding who goes first, these are the ones we'd put at the top.
The long tail deserves less. A low-spend supplier you could replace in a week probably needs nothing more than a fast database check, and putting investigator time into it buys answers that won't change anything. Right-sizing the escalation covers where that line sits for a single file, and our guide to screening a new supplier walks through what to run.
Whatever you approve today was approved on today's records. A renewal, a change in ownership, an agent moving into a new country, or a bad headline is each a good reason to look again, and ongoing monitoring can flag new lawsuits, liens, and sanctions listings in between.
If you're setting up third-party due diligence for the first time, start by listing who acts for you, not just who sells to you. Check new relationships before you sign. Then work through the existing list in passes, starting where the exposure is highest. The real effort ends up on a short list, and the rest can usually get by with a quick check and a clear rule for when to look closer. Our vendor and supply chain page shows how that fits a supplier program.
If you'd like a second opinion on how to sort your third parties, use the Get Started button below to fill out the form. Our team can go through your list with you and point out where a lighter check is enough, which is often a lot of it.
.png)
