When and how to conduct cost effective due diligence
While the quality of intelligent computer-led research is improving, for this level of work to be performed well it is imperative that the work be carried out by humans who are able to process and assess the research tasks in a more efficient manner than a computer can be programmed to do.
So when performing this level of research, which types of data can be used?
The most basic set of information that can be used is that stored in databases. These databases may include information about sanctions, government officials and adverse media.
Sanctions can be defined in many ways, but are usually directives imposed by national governments to achieve public policy aims. They come in a variety of types, the choice of which depends on the aim of the country imposing the sanctions. Examples of types of sanctions include restricting:
- assets, by imposing freezes or restrictions on sale
- the sale of certain goods or business relationships in general
- the export of certain technologies from a country, especially those that can have a military function (whether the primary function or not)
- the right of individuals to travel.
Government officials are important for corruption risks because they are specifically mentioned in legislation (such as in the Foreign Corrupt Practices Act) and they tend to have decision-making authority over large projects. These officials can be members of formal government departments (such as industry, health or defence), regulators and agencies, or state-owned enterprises. While officials of a government are generally easy to recognise, issues arise when considering people working for semi-governmental bodies.
Given the volume of media sources and the ability to aggregate them, most adverse media databases use keywords to attempt to pick up stories about specific risk items, such as corruption or money laundering.
For each of these types of information it must be determined if the information you are researching is correctly matched to the data in the database, and if the specific information is relevant.
The first step once finding a possible match (or ‘hit’) is to ensure that it is correct. Often this is a simple process of reviewing the information (e.g. a person’s name) and confirming against obvious criteria (such as location, industry or exact name). There are times, however, when the information in your possession and the information in the database are not sufficient to allow for quick confirmation. In this case a ‘false-positive analysis’ is needed. This type of analysis usually involves finding more information on both sides, including asking for additional details internally of the entity or person being researched, and performing extra research on the entity or person named in the database.
Once the match is confirmed, the next question to ask is whether the finding is relevant to the activity or transaction you are seeking to undertake.
Depending on your business, it may be that your compliance programme needs to consider some, but not all, government sanctions. It is likely that you need to comply with those of your own country, but not with those of other countries (unless you have a business presence there). Names on travel-ban lists are not relevant to companies who aren’t involved in moving people, and bans on certain goods will only be relevant if you sell those goods.
For government officials, a decision needs to be made about whether you are dealing with them in a manner that may cause you risk (i.e. selling to them or seeking their approval), or whether they work for an entity that is actually state controlled to the extent that makes them a government official. Those who collate information for databases often need to make simple decisions about whether a name should be included or not, and for state ownership that decision is often based on an ownership threshold. The actual determination of state ownership is more complex, however, and relies on factors relating to whether it is both under the control or dominion of the government and performing a function of government.
For adverse media, the determination tends to be about whether the article indicates a risk that is relevant to your business. Often media reports will cover a broad set of topics that may not be applicable to your business or transaction (such as tax disputes or competition-law issues), and these can be removed from the results.
Knowing that the match is correct and relevant leads to the final key question: What is the impact on your business relationship? Sometimes the result will be simple: that you cannot work with the entity. Often, though, it will be difficult, and will require an escalation and further work either internally or externally to determine the correct steps to follow. It is important to have this step included in the process, although it is normally beyond the scope of work given to the analyst.
In addition to the adverse media that may be stored in a database, there is also the active media research that will look for articles about the entity, either positive or negative. The scope of this media can cover a broad set of activities, from blogs and social media through to local and international media publications.
The quality of media research that can be provided comes down to a number of factors.
Given the extent of media sources available, the main determinant of the quality of research tends to be the amount of time a researcher is given to perform their work. Extra time will allow the researchers to review more sources, as well as analyse and cross-check their work.
Sources vary from well-known global publications through to minor local papers and blogs. Researchers need to know how to access the most relevant publication for the type and location of the subject (for example, small Chinese companies are never going to appear in The Wall Street Journal unless they are associated with a multinational company, and large multinationals will have articles about themselves syndicated widely). Providing researchers with access to a multitude of research sources and platforms (both open and proprietary) means they can use their own judgement as to where is most valuable to search, which can help when time is limited.
Having analysts who speak the language of the media source is essential in allowing direct and efficient review of materials. Any translation adds time to the review and often increases errors or misunderstanding.
In a similar way as for adverse media, researchers must analyse each media report to be able to assess the meaning from their knowledge of how a country works and remove articles that are not going to be relevant to the compliance issues at hand.
The last broad area that may be useful for cost-effective due diligence is information about the legal standing of a corporate entity. This is generally provided from a corporate registry, which is the official source of information about incorporated entities. Almost every country has a registration process, mostly through a nominated government department at either a national or state level. In some countries the registrar will also differ according to the type of legal entity (e.g. partnerships or trusts).
There are many reasons that there is value in accessing a corporate registry as part of a due diligence process.
To ensure that the entity exists
Ensuring that an entity actually exists is the most basic verification step, where a registration identification number can be provided and confirmed to ensure that the entity is legally formed.
To understand the type of entity
Understanding the type of legal entity (public or private, or the limits to liability) will allow for an assessment of the risks posed in dealing with the entity.
To understand the history of the entity
Finding out who the current owners, management and representatives of an entity are, and researching the history of its ownership structure, allows an assessment of not only whether the entity is reputable, but also whether the key controlling principals are people of concern. When performing due diligence for trade compliance purposes, checking key principals against sanctions lists is vital to meeting your obligations.
In addition to compliance benefits, knowing the ownership and controlling interests of a partner also provides commercial advantages of knowing who you are really negotiating with.
The primary reason that a registry file is provided is for conducting history checks.
To know where the entity is officially located
The official registered address is an important piece of information when considering site audits or serving legal papers. Analysis of the location can also provide extra insight into the background and standing of the entity.
A full extract from a registry will generally provide enough information to support all these objectives, though the extent that this information is available differs between jurisdictions. There are also differences between the methods available to access the information, which can affect the information that is obtainable from low-cost desktop research.
Historically, all corporate registration documentation was available only from the registry itself and was typically accessed in person. Many locations around the world, especially in the developing world, still require physical access to the records. In some locations these records are becoming available over the internet (by the payment of a fee or subscription), thus removing much of the cost and time delay.
You can also use an intermediary to liaise between you and the official registry. These businesses can provide online records, but they do not always retrieve them directly from the registry. These services often run automated checks at timely intervals, and if they cannot access the registry they fill gaps in their findings by having a call centre contact the subject company to ask for ownership information.
Finally, there are services that collate corporate-registry data for purposes other than due diligence, but are able to provide that data if required. Examples of these services are credit reference agencies.
When deciding how to obtain corporate information, you should consider:
- the accuracy of the information – direct access to a corporate registry, whether physically or online, will provide the most accurate and timely information as it is not subject to miscommunication between intermediaries
- the completeness of the information – when an intermediary retrieves the information for purposes other than due diligence, often only the information relevant to their primary purpose is retrieved
- the delay between the original sourcing of the information provided and the day it is delivered – if there is a significant delay there could be a change in ownership and management in the interim
- the verifiability, so that when questions arise relating to the source of information it is possible to state that it came from a known, traceable source rather than an intermediary of questionable providence
- how secure the information is, to ensure that the information can be retrieved without the subject entity’s knowledge.
Given the information that is available, the primary concern for most businesses is how to perform the research in the most efficient manner. There are a number of ways that this can be achieved.
Using the business units
Often the responsibility to perform the due diligence work is pushed on to the business units themselves. This has the benefit of involving those who are in the relationship with the partner in the diligence research, but it can be harder to train a diverse set of people to provide consistent research and analysis.
Building an internal team
Building an internal team to perform the research avoids the issues of training, but will only be cost effective if there is a very large volume of research needed, or if the number of different language skills needed is low.
Outsourcing part of the research
An external team could be assigned to either provide a specific part of the research or to provide independent confirmation of information gained elsewhere. This can be an effective method to alleviate the problems of inconsistent research and lack of language skills, but its success depends greatly on the research abilities and technology available to integrate the outsourced providers into the business process.
Engaging external consultants
The traditional method of performing research is to engage external consultants. This allows negotiation on the scope of work provided and price, and is not dependant on any technology.
To efficiently use cost effective due diligence services, it is necessary to have a good understanding of the needs of your business, including the:
- volume of people and entities that fall into the category of low-risk partners
- types of data that are needed to match the risk
- locations, and therefore languages, that will be needed
- availability of resources within your business to perform research.
Based on this information, a cost effective process can be built for higher-risk partners as part of an overall third party due diligence programme.