Third-party compliance: Doing the right thing for the sake of it


Third-party compliance: Doing the right thing for the sake of it Ethical BoardroomBy Alistair King, Content and Communications Manager, Bureau van Dijk



We live in an age of lightning-fast social media, where disgusted customers vote with their feet like never before. The need for watertight, reputation protection – much of it preventative – is at an all-time high, particularly when dealing with third parties. And there are other pragmatic reasons for examining who you’re working with: if you stem the flow of cash into money laundering, tax evasion and black-market activities, legitimate businesses and the macro-economy will prosper.

But should the media glare and economics, as well as the law, be our only motivations? Indeed, are they everyone’s? And are some companies going above and beyond in their ethical activities, especially in their interactions with third parties?

What are third parties?

Before we go on, let’s clarify exactly what we mean by ‘third party’. The term has a variety of narrow definitions in business and law, some implying a layer of separation between two parties. But in the expanding world of enhanced due diligence (EDD), it’s become much broader, extending to any person or entity outside your organisation with whom you have any sort of contractual relationship. Far from separation, it implies inextricable closeness.

These third parties could be your customers, suppliers, agents and distributors, or joint-venture business partners. Indeed, ‘business partner’ could be used as a near-synonym for third party in the context of ongoing and significant relationships.

Gone are the days when trade was purely transactional; we must all now engage in Know Your Customer (KYC) and Know Your Supplier (KYS) programmes to mitigate reputational or regulatory risk. But back to the theme of ‘doing the right thing’ for the sake of it. Thinking of the boardroom, corporate social responsibility might spring to mind. But it sometimes goes further than that.

Enlightened self-interest

“Branson has set the bar high and many of us are too busy building our businesses to divest much of our time into making the world a better place”

Consider Richard Branson’s Virgin Group. I recently attended a conference at Sir Richard’s Oxfordshire home.¹ My golden ticket was in recognition of the detailed company data that Bureau van Dijk supplies from its Fame database to help compile the Sunday Times Fast Track 100 list, which Virgin sponsors. Interviewed by his group’s CEO, Branson focussed on the culture of family businesses – the group is still privately owned and staff includes his daughter and son – and he outlined the importance of company values and brand integrity.

He also spoke about reputation management, which struck a chord with me, as earlier this year I produced a white paper on getting to know your third parties through better due diligence.² Few would dispute the scale of Branson’s entrepreneurial ambitions when he started out in the 1960s. But his success has allowed him to pursue philanthropic ventures. As well as dealing directly with charities, he works with and encourages third-party enterprises in parts of the developing world.

What I’d describe as examples of enlightened self-interest, these ventures have arguably furthered the success of Branson’s businesses, too and, as he confirmed at the event, they have for more than a decade been the focus of his own day-to-day activities. In 2004, he set up the not-for-profit Virgin Unite foundation to ‘unite people nd entrepreneurial ideas to create opportunities for a better world’.

The foundation has a number of overlapping aims. Some of them are purely charitable. But it also exists to foster ideas of better, more ethical ways of doing business. In a guest blog on the Virgin Unite website on the subject of things entrepreneurs should consider when starting a business, Gayle Northrop, president of Northrop Nonprofit Consulting, says: “This question is often asked, ‘Isn’t being a socially good business more expensive?’ The answer is, ‘Yes, it can be, but doesn’t have to be.’ There is an ever growing list of business practices that prioritise people and planet, which cost less and generate more revenue.”

That last point is echoed in Virgin Unite’s activities but also in Branson’s wider for-profit group. For example, as part of Virgin’s general commercial operations, its self-imposed supply chain standards have for two years included guidelines on protecting sea mammals. “In February I announced that Virgin businesses will only continue to work with suppliers that pledge to no longer take sea mammals from the wild,” said Branson in 2014, referring to a new internal policy that most closely applies to his Virgin Holidays division.

“I feel strongly that this is a very positive development for the industry. Although many of our suppliers have not taken whales or dolphins from the wild for years, the Virgin Pledge seeks to build much-needed momentum to effectively end a brutal practice that continues to this day,” he added.

Branson has set the bar high and many of us are too busy building our businesses to divest much of our time into making the world a better place. But it’s with steps, such as these that we can do our bit to at least make it less of a bad place. With the right tools, getting our supply chain in order is one of the best places to start.

Beyond Branson

In June this year, the Bureau van Dijk blog reported on a story from Supply Management magazine, in which Jaydeep Solanki, head of global purchasing and supply chain at General Motors Holden in Australia, said that always focussing on what you can control and not worrying about things you can’t control was the best advice he got from one of his mentors.³

“I always remind my team to follow this as we manage our global purchasing and supply chain,” Solanki added. He makes a good case – up to a point. Certainly, there’s not much we can do about unknown unknowns and he goes on to highlight unpredictable risks, such as natural disasters, major accidents, terrorism-related disruption or ‘a simple malfunction in one stage of the supply chain we did not expect to happen’. But when examining your third parties, you’d be surprised at how much control you actually can exercise, particularly when considering what you might think are known unknowns.

Third-party vetting and ethical procurement

At least this is the contention of Ted Datta, Bureau van Dijk’s director of governance, risk and compliance solutions at Bureau van Dijk’s London office. Bureau van Dijk holds information on more than 200 million companies on its databases, such as Fame that covers the UK and Ireland, and Orbis, which covers the world. The databases in its range make available company financials, ownership structures and the like.

They also have information on whether individuals associated with companies – such as directors and owners – are on PEPs and sanctions lists. Datta draws my attention to a recent document compiled by Kroll and the Ethisphere Institute: The Year of Global Expansion and Enforcement: 2016 Anti-Bribery and Corruption Benchmarking Report. The section on third-party due diligence talks of the ‘sheer volume of third parties that companies must manage’.

Nearly half of respondents to the report’s worldwide compliance survey said that they engage with at least 1,000 third parties, while 17 per cent of all the respondents claim to deal with more than 25,000. Unless you have an astonishingly well-staffed team of investigators, surely those are too many companies to vet in a meaningful, watertight manner, right?

Not necessarily, according to Datta. “The trick is to find the relevant two or three-hundred to escalate and thoroughly investigate,” he says. “25,000 is not unimaginably high when working with us in the right way,” he adds. “Our platforms help you automate the screening of low-risk companies – the majority – and identify those that need enhanced third-party due diligence.”

Risky businesses

So what risks are thrown up when examining these third parties? The biggest area is sanctioning, either of people or organisations. They might be judged to be too closely connected with proscribed activities – money-laundering, drugs trading or worse – or they might operate in sanctioned jurisdictions, such as Iran, Myanmar, North Korea, Sudan and Syria. If you include countries where involvement with the government is a barrier, the list of countries, organisations and people is even longer and harder to track.

Politically exposed persons (PEPs) associated with your third parties can also be revealed, a concern for some risk appetites. But there are ways you can mitigate these risks; the main challenge often being how to identify whether a company you’re considering working with is suspicious. You will have your own definition of ‘suspicious’. It might relate to official sanctions lists, either of companies or of people associated with them. Or it might tie in with your own ethical code.

Crucial to any assessment are corporate ownership structures, brought into sharp focus in the wake of the Panama Papers revelations. If you use the right tools to analyse these, the warning signs – particularly of being ‘sanctioned by extension’ through beneficial ownership – are much easier to spot.

From an ethical point of view, beneficial ownership is at the heart of these considerations and, as a boon to the more ethically conscious decision makers, some platforms let you choose a lower ownership percentage threshold than the regulations prescribe. This makes it easier to rule out doing business with companies owned at least in part by the ‘wrong’ people, thereby protecting your reputation – and your conscience.

As a by-product of this research, you can also gain a better understanding of the financial risks associated with doing business with these companies. Are they a good credit risk? Will they deliver on time or might they fold, crippling your supply chain? By adopting this approach, you can easily do the right thing commercially and in matters of ethical certainty.

The road less travelled

But what of less objectively dubious activities, or simply the more nuanced choices you want to make about the people and organisations you collaborate with? For whatever reason, there might be certain causes you want to champion through your third-party relationships – and that should be your privilege. In these scenarios, it’s less about checking and screening companies that are already on your radar and more about actively seeking out companies to work with based on your own very specific criteria.

The right tools can, for example, help you identify companies according to their place on the OECD’s Small and Medium-Sized Enterprises (SME) Policy Index. Or you might be keen to guarantee a certain level of diversity in your supply chain, whether that’s based on a company’s location, its number of employees, financial information, its company status or how long it’s been trading.

Maybe you want to select and filter by the number of female directors on a company’s board, by ethnic minority criteria or by the age of company directors and owners. Or you might want to trace lines of ownership to make sure that a company you’re thinking of working with – itself in an “innocent” industry or sector – isn’t owned or part-owned by any companies involved in areas that you feel uneasy about.

These areas might be in oil, gas or other fossil fuels, for example. They might involve certain types of mining or activities involving deforestation or pollution. Or they could be in a number of food and agricultural industries whose operations are clouded by environmental, humanitarian or employment issues. These might include intensive farming, palm oil production, coffee, chocolate, bananas, honey, milk, fruit-picking, cockle-picking – the list goes on.

Screening an entire corporate group becomes possible

With these considerations and parameters, tools can help you explore and make sense of your network of relationships. It’s all about data empowerment. And this empowerment makes it easier to do the right thing – what you consider to be the right thing – often simply for the sake of doing the right thing.


About the Author:

Alistair King is Content and Communications Manager in Bureau van Dijk’s global marketing division. He has written white papers and in-depth case studies on governance, risk and compliance, financial data gathering, corporate credit risk, and CRM integration. He also manages the company’s blog, PR and social media channels. With an academic background in civil engineering, his career has taken in construction journalism, academic book publishing and legal database marketing, the latter of which saw him interview a number of high-profile QCs at the English Bar.


¹ ²