Third-party and vendor risk
A risk-tiered programme for suppliers, distributors, agents and contractors that you can run, evidence and defend.
Risk-tiered screening and ongoing monitoring of suppliers, distributors, agents and contractors.
Third parties carry a large share of bribery, fraud and supply risk. Agents deal with officials on your behalf, vendors may be owned by employees, and contractors can expose you to labour and safety failures. Regulators, customers and partners expect you to know who they are.
We tier the whole third-party population by risk, so that checks are proportionate: light screening for low-risk suppliers and deeper due diligence for agents, distributors and high-value contracts. Contract clauses, declarations and certifications set expectations, and ongoing monitoring catches changes.
The programme is documented so it can be shown to a regulator, an auditor or a customer. Where Pactinex or IP Octopus M2 is in use, contracts and partner records sit in one place with their risk ratings.
Your supplier, distributor and agent base is growing faster than your ability to check it.
Signs we see most often
- 01Your supplier, distributor and agent base is growing faster than your ability to check it.
- 02Agents or consultants deal with government officials for you.
- 03A vendor turned out to be linked to an employee.
- 04Customers or investors ask how you manage supply-chain risk.
- 05You are exposed to the US FCPA or the UK Bribery Act through your operations or ownership.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01InventoryBuild a single list of third parties from finance, procurement and business records.
- 02TierRate each by spend, geography, government contact and type of service.
- 03ScreenApply checks proportionate to each tier, from screening to enhanced due diligence.
- 04ContractAdd clauses, declarations and audit rights matched to the risk.
- 05MonitorRe-screen on a cycle and on trigger events.
- 06ReportGive management and the audit committee a view of third-party risk.
A risk-tiered third-party programme you can run and evidence.
- A risk-tiering model and a tiered third-party register
- Due diligence questionnaires and screening procedures
- Model contract clauses and declarations
- A monitoring and re-screening calendar
- Periodic third-party risk reporting
The law and frameworks this work is aligned to
- Aligned to ISO 37001 due diligence on business associates
- Aligned to ISO 37301 compliance management systems
- OECD Due Diligence Guidance for Responsible Business Conduct
- UK Bribery Act, 2010 s.7 and Ministry of Justice guidance on adequate procedures
- US DOJ Evaluation of Corporate Compliance Programs
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerWhere this service meets BDI's technology.
The platforms below record, monitor or act on the work this service produces.
Questions clients ask before we start.
We have thousands of vendors. Where do we start?
With tiering. Most vendors are low risk and need only basic screening. The effort goes to the smaller group whose spend, geography or government contact makes them high risk.
Can our procurement team run the programme afterwards?
That is the aim. We design procedures, templates and training so your team can run it, and we can support with deeper checks when they are needed.
How does this differ from business partner due diligence?
This is the programme: tiering, procedures, contracts and monitoring across all third parties. Business partner due diligence is the investigative work on individual partners within it.