Global Anti-Bribery Guidance

Increasing Exposure to Third Party Bribery Risk

Third parties and intermediaries in particular are the single greatest area of bribery risks for companies. These risks are growing as companies move into new markets and put ever more of their operations in the hands of third parties. In this dynamic and challenging arena, anti-bribery programmes need to be tested regularly to provide confidence that they are suitable for countering third party risks and are working effectively.

Wide Scope of Third Party Bribery Risk

It is important to recognise that bribery risks are attached to many kinds of third party relationships. Companies may think that some types of third parties fall outside bribery legislation. In fact, there is no distinction between different types of third parties under the UK Bribery Act or the US Foreign Corrupt Practices Act (FCPA). Under the FCPA, companies have been held liable or put under investigation for improper actions involving various types of third parties.

Integrate your approach

Develop and implement an integrated and consistent approach for managing third parties across the company’s operations. Clearly assign responsibilities for third party management and ensure a cross-functional working and risk-based approach, supported by tone from the top.

Managing third party relationships is complex and involves many different functions spread across the company’s operations. Misaligned processes and undefined responsibilities can lead to bribery risk. The company should therefore ensure that the anti-bribery programme reaches across the company and is applied to a consistent and required standard.

There are many organisational challenges attached to managing third parties and countering bribery risk. Above all, management and the board may not have a complete picture of the company’s activities for countering third party bribery risks and may lack understanding of the risks or fail to give them the required level of attention. A further challenge is integrating the management of bribery risk with other forms of third party risk, such as financial, human rights, data privacy and cybersecurity risks. 

An integrated approach – examples of good practice

• Allocate responsibilities: Give overall responsibility and accountability for third parties to a senior manager and assign clear managerial responsibilities across the company.  Business units should have responsibility for managing relationships with third parties and embedding the anti-bribery programme into their activities.

• Integrate your approach to risk management: Apply consistent standards, policies and procedures across the organisation, including coherent automated data systems and tools. A central risk management function may be used to guide risk management across the company, including countering bribery in third parties.
• Involve and empower support functions: Ensure that functions such as compliance, legal, finance, procurement, internal audit, risk management, security, human resources and corporate affairs are fully appraised of the bribery risks attached to third parties. Clearly communicate their roles in supporting line management and countering bribery in the supply chain and ensure they are adequately resourced to carry this out.
• Ensure cross-functional working: Ensure that country and business units and support functions work together. This will involve integrating the approach to managing risks attached to other issue areas within compliance and sustainability.
• Guide local decision-making: Ensure there is local application of third party anti-bribery measures. Local management know the local culture and risks and are best able to respond to changing circumstances. At the same time, there will be a balance between central and local management and the company will need to ensure that local management itself is supported to manage risks such as misinterpreting or failing to implement policies and procedures - or even acting improperly. It can do so, for example, through risk-based visits by legal and compliance, enhanced communication for high-risk units and periodic “check-ins”. 

Build trust and constructive relationships with third parties

Foster positive relationships with third parties and shared goals to enable better understanding and identification of risks. 

Bribery risk can arise from dysfunctional relationships with third parties, where misaligned objectives and communication gaps can lead to third parties dismissing corporate integrity standards in favour of quicker and cheaper performance. Anti-bribery compliance can easily be seen as a burden by the third party and addressed on a tick-the-box basis, undermining the effectiveness of training, contractual provisions and other controls.

Companies can manage these risks of misunderstanding and compliance fatigue by working to ensure that employees and third parties have agreed on common goals and strive together for excellence and corporate standards of integrity.

Countering bribery in third parties is more likely to be effective when the company operates positive relationships and builds trust with third parties, aligning objectives and working towards shared goals. Relationship management is a critical tool: the relationship manager is the link between the company and a third party and they should not only manage the contractual aspects but also promote the business value of complying with the company’s standards, including the anti-bribery policy.

Building Trust – Examples of Good Practice

• Align your expectations: Align anti-bribery communications to third parties with wider corporate expectations on integrity, professionalism and quality.
• Assign formal responsibility: Give relationship managers formal responsibility in relation to anti-bribery due diligence, training and monitoring of high risk third parties. For example, responsibility can be addressed through job titles, appraisals and performance reviews.
• Ensure consistency: Establish initiatives for quality management of integrity and consistency in approach to relationship management. For example, create “ambassadors” or working groups dedicated to anti-bribery third party management and provide tailored anti-bribery resources and training to relationship managers.

This section sets out seven components that form the core of good practice in third party anti-bribery management: a systematic process for identifying, engaging and managing third parties.

Identify all your third parties

Identify and register all your third parties and collect, analyse and store relevant information about them, including their ownership, how they operate, their integrity and anti-corruption standards and any significant bribery and corruption risks.

To achieve effective procedures to counter bribery, the company should have a clear understanding of its third party population.  Depending on the size and type of business it conducts, a company may have a handful, hundreds or thousands of third parties and the types of third parties can be homogenous or vary widely.

A third party is any associate with which a company carries out its activities.[1] The company’s third party population[2] can include:

• Vendors/suppliers
• Distributors/resellers
• Joint venture partners/consortium partners
• Advisors and consultants (tax, legal, financial, business)
• Service providers (logistics, supply chain management, storage, maintenance, processing)
• Contractors/subcontractors
• Lobbyists
• Marketing and sales agents
• Customs or visa agents
• Other Intermediaries

The highest bribery risk lies with agents, as they are authorised to represent the company. However, bribery risk is also associated with other forms of intermediary, such as lobbyists and law firms. Suppliers can also bring substantial risks, such as bid-rigging and kick-backs.

In order to obtain a high-level view of the risk profile of its third party population, a company should gather basic information on all its third parties, which will be used in the next step of risk assessment. This information gathering step applies to all existing third parties and policies need to be adopted and procedures designed for the systematic gathering of this information for all new third parties.

The information to be gathered includes information about the country in which the third party is based and where the services are provided, the volume of business with the third party and the nature of the work it performs. Categories of work posing higher risks include representing the company before government agencies or other third parties, performing services on behalf of the company and having contacts with government officials.

Identification – examples of good practice

• Define third parties: Have a clear understanding and definition of third parties. Label and describe what each type of third party does for the company.
• Think ahead: Keep in mind the needs of risk assessment and due diligence, which will rely on an accurate and complete picture of your third party population.  Make an initial decision on what information you will need to gather at each stage. This will range from basic data for all third parties to extensive information for the highest risk third parties. Identify what suitable information you already hold.
• Create a centralised database: Create a centralised database where all information on third parties will be stored. Ensure enough flexibility to allow for additional categories of information to be added.
• Plan the process: Set out a clear process for gathering information and populating the database. Information can be gathered in various ways, such as accounts payable records, contracts held by legal departments and contracting functions and surveys of operating functions to find out who they see as their third parties and the nature of the relationships.
• Map out lower tiers: When describing and categorising your third parties, consider the extent to which they in turn rely on associates to conduct their business. If they are highly dependent on subcontractors, lower tiers in the supply chain or Politically Exposed Persons (PEPs), this will be relevant to the risk assessment process and information on these parties should be recorded.
• Comply with laws: Review the requirements of compliance with data and privacy laws for the jurisdictions which you and your third parties may fall under. There may be restrictions on the types of data you are allowed to collect, store or disseminate, or the matter in which you are permitted to do so.

Use a risk assessment process for addressing third party risks and ensure the level of resources provided is commensurate with the level of risk

Use a risk assessment process to identify, segment, mitigate and monitor the risks and risk factors attached to different types of third parties and use this information to design the criteria used in due diligence and  to design and/or improve the overall anti-bribery programme. 

A third party risk assessment process allows companies to develop a proportionate approach capable of identifying and responding appropriately to higher risk third parties. It does this by identifying and assessing factors driving third party bribery risk and using this information to devise risk categories based on types of third parties and other pre-defined criteria. These criteria are then used in the due diligence process, described at section 12.3.4.

The results of risk assessments should also be used by management to decide the scale of resources to be allocated to due diligence, third party management and monitoring. Management can also use the results of risk assessments to design the approach to phasing and prioritising types of third parties and other risk factors.

Apply a systematic procedure for engaging third parties

Adopt a comprehensive and consistent approach to registering, screening and engaging third parties to ensure that engagements are made to desired standards and that procedures are tailored to the different types of identified risks.

Bribery risk can arise from third parties being engaged through variable and incomplete processes, leaving the company unable to apply efficient and appropriate controls due to silo working and unreliable standards. Specific risks range from company procedures being undermined by local work-arounds for urgent requirements to deliberate falsification of third party documentation.

Carry out an appropriate level of pre-engagement due diligence on third parties and repeat periodically

Carry out due diligence proportionate to the risks identified for different types of third parties, with a focus on those of highest risk.  Use pre-defined risk criteria to assess individual third parties for inherent risk and vary the level of due diligence accordingly.

Due diligence screens third parties for red flags to enable the company to avoid association with third parties which could lead to reputational damage or legal liability. It is a systematic, periodic process carried out when entering into or renewing a contract or agreement with a third party. It commonly receives the greatest attention in countering bribery in third parties.

Even so, companies struggle to design and implement an effective due diligence process due to large numbers of third parties, variations in their forms and activities, the multiplicity of risks and uncertainty on how best to assess risks.

The Due Diligence Process

Companies must find a suitable methodology for screening their third parties to ensure they obtain the right information to discover red flags and assess the level of integrity and compliance of a third party against consistent criteria. While focused on identifying high risk third parties, the due diligence methodology should be capable of managing large numbers of third parties within the available resources and without disproportionate time and effort for the majority of low risk third parties.

The company can reach a deeper level of understanding of higher risk third parties through a deeper level of diligence. Depending on the circumstances, this may include in-person meetings with senior officials of the third party, a site visit, obtaining information on the third party and principals from specialised databases and engagement of in-country experts to provide additional due diligence. If a decision is made to proceed with the third party, the engagement should be commensurately controlled and monitored, as described at sections 12.3.6 and 12.3.7.

The methodology should be built on the results of the company’s third party bribery risk assessment, making use of the risk categories for types of third parties and other bribery risk factors to structure decision-making for individual third parties (described at section 12.3.2, steps 4 and 5). These pre-defined risk criteria allow the company to assess individual third parties for inherent risk and vary the level of due diligence accordingly.

The methodology should also be shaped by the risk approach set by the board and matched against norms for due diligence, including guidance from regulators, professional advisors and anti-corruption initiatives. The company can also learn from past cases and releases by authorities such as the UK Serious Fraud Office, UK Financial Conduct Authority, the US Department of Justice and the US Securities and Exchange Commission.

The methodology suggested in this section can be adapted by companies according to their risk profile and the size and nature of their third party population.

Due diligence step 1 - Assign a risk rating: Assign overall risk ratings to third parties by scoring them against pre-defined criteria (developed through the risk assessment process and based on types of third parties and additional risk factors). For example, if using three levels of third party risk, decide in which level the particular third party belongs.  

When assigning an overall risk rating to a particular third party, the company will check the type of third party and associated risk category and will also need to look for additional risk factors such as:

• How large is the contract the third party is bidding for?
• Is the contract in question unique/a one-off?
• What is the compensation structure for the third party? (e.g. sales commissions)
• What are the goods or services being provided? (e.g. lobbying, business development)
• How was the third party referred to the company? (e.g. by a public official)
• Does the third party have an anti-bribery programme and does the programme meet the company’s own standards?

The overall risk rating assigned to a third party will determine the appropriate level of due diligence. For example:

• High risk: This category receives the most attention, with detailed information gathering from the third party and public record research, often supported by market intelligence gathering. This level will often require face-to-face interviews and on-site visits (sometimes called “boots on the ground” due diligence).

• Medium risk: This category will typically require some information gathering from the third party additional to the PQQ followed by public record research to verify the information and identify any significant legal, regulatory or reputational issues.
• Low risk: This category requires very limited or no further information beyond the initial PQQ. If the relationship owner is aware, either through the PQQ or dealings with the third party, of any issues, this could raise the risk rating to medium risk. Very small contracts or spot purchases up to a specified threshold are not subjected to due diligence unless the PQQ throws up a red flag such as a connection to a foreign public official or past improper behaviour.
• Sampling: Due diligence at the level higher than the assigned risk category is carried out on a statistically valid sample of the medium and low risk companies to provide a check that the methodology for assigning risk categories is working.

Due diligence step 2 - Obtain further information: For medium and high risk third parties, further information and documentation is requested using a third party questionnaire and business unit questionnaire. The level of detail of the questionnaires will correspond to the risk category of the third party. Use of an electronic workflow system will enable these and any other communications with the third party to be recorded centrally. It can also serve as a repository for documents provided by the third party, such as a code of conduct, anti-bribery policy or proof of registration. The company should be prepared for red flags or questions to emerge and to expand the gathering of information accordingly in step 3. Red flags may include obscure ownership structures, resistance to requests for information, negative media coverage and links to senior public officials or other PEPs.  

It is important that the due diligence requirements imposed on the third party strike the right balance between the information required and the burden of providing this information. Designing a process that requires a well-resourced in-house compliance department to comply with your requirements will make it too burdensome for small and medium enterprises (SMEs) and local companies where the primary language is different from that of the company, amongst others.  Using existing standard forms or establishing them through industry bodies or initiatives may help reduce the burden on third parties.  It is also worth noting that in some jurisdictions or sectors general awareness of and engagement with anti-bribery and corruption is very low, which has the effect of disadvantaging local companies competing for business. In these cases, the company may consider investing in education, for example through collective action initiatives, to increase awareness and to create a level playing field in jurisdictions where the company operates.

Due diligence step 3 - Research, gather and assess other information: Based on an analysis of the further information provided by the third party, more comprehensive information is sought through company resources and externally. More information may be collected on areas such as:

·       Services being provided

·       Corporate information (such as proof of ownership, if not requested or provided previously)

·       Members of the third party’s leadership and those who will be working with the company

·       Governance structure

·       References from peer companies

·       Litigation/criminal or administrative actions disclosure

·       Negative coverage in media

·       Code of conduct (if not requested or provided previously)

·       Anti-bribery programme including policy and training given to employees

·       Adherence /alignment to the company’s own policies

·       Use of sub-contractors /other third parties (and any related policy documents)

·       Appearance on sanctions/debarment lists

·       Relationships with government officials including director and staff familial relations with PEPs and government officials and employment of PEPs and PEP-owned companies further down the supply chain

Due diligence step 4 - Mitigate any identified risks: Assess the results of due diligence and proceed to seek management approval if all is satisfactory. For high risk third parties, or where specific red flags have been identified for a medium risk third party (e.g. large or critical contracts, lobbying services), legal and compliance should be involved in the assessment.

Carry out further work to mitigate any significant risks identified or decide not to proceed. Mitigation of deficiencies in an anti-bribery programme can be made before appointment or it may be agreed that they will be implemented immediately after appointment by a set date, with a clear follow up mechanism in place.

Due diligence step 5 – Decide whether to proceed to contract: Subject to any identified risks being mitigated, the due diligence report is signed off by management as satisfactory and the necessary management approval is obtained to proceed to contract with the third party. For difficult decisions or where high residual risks remain, the decision whether or not to engage a third party may be referred to legal and compliance or to a special committee with representatives from legal and compliance.

Due Diligence – Examples of Good Practice

• Do not rely wholly on others: Do not assume that because a third party is used by a peer company or has been certified by an accredited provider this obviates the need for adequate due diligence. Similarly, when third parties are acquired through M&A, do not rely on previous due diligence or a long pre-existing relationship with the acquisition.

• Balance and integrate your approach: Ensure due diligence is balanced and integrated with the other components of anti-bribery management of third parties, such as providing tailored communications and training.
• Use sampling: Use quality control sampling to provide reassurance that your methodology works and is picking up the high risks.
• Allow time: Finish the due diligence process in good time to give the business relationship holder and/or third party an opportunity to mitigate properly any risks identified.
• Guide local decision-making: Include the judgement of those close to the business activity, such as relationship managers, in decisions on the results of due diligence. The local decision responsibility needs to be balanced and the company will need to ensure that there is central functional input of setting and monitoring the standards and application of due diligence and that, based on the level of risk, management approval thresholds and counter signature requirements are in place to provide a compliance check.
• Avoid over-burdening third parties: Ensure your due diligence process does not over-burden and therefore lead to the unjustified exclusion of smaller and local third parties.
• Involve legal and compliance: Involve legal and compliance in decisions using a risk-based approach. Where risks remain high or for difficult decisions, the decision may be referred to a special committee.
• Document the process: In all cases, document the decision-making process to show it is thoughtful and thorough.
• Make a qualitative assessment: Make use of the judgement of management and employees such as third party relationship managers and compliance officers - this is critical to effective due diligence. Bribery can often occur in unexpected areas and an automated or ‘tick box’ approach can only follow established channels or flag trends. The company must remain alert to new risks. Those involved in due diligence on third parties should be encouraged to be challenging, questioning and innovative.
• Deal with issues: If due diligence has identified issues, consider appointing an external advisor to conduct further research. The issue may also be raised through a face-to-face meeting with management of the third party and a timetable established for correction or mitigation. Exploration and analysis of the risk area jointly by both sets of management can also eliminate risks. Discussions about bribery risk should be handled carefully as they will be sensitive to the third party and cultural differences may also lead to misunderstanding or offence.

The contract with the third party is more than an agreement – it is a critical anti-bribery control. It communicates explicitly the company’s expectations on anti-bribery and ethical behaviour, establishes rights and specifies anti-bribery requirements and processes for monitoring, reappointment, remediation, termination and exit.

The anti-bribery provisions and rights included in a contract will be determined by the extent of the influence of the company in the relationship. As principal, the company will require contractually that its agents and similar intermediaries conform to its anti-bribery programme, but in other associations (such as suppliers, consortia and joint ventures) the company may have insufficient leverage to insist on conformity to all elements of its anti-bribery programme and may have to rely more heavily on due diligence to ensure ethical behaviour by selecting the right partners. In all cases, the company should seek a contractual commitment that the third party will comply with anti-bribery and corruption laws and establish its own controls to prevent and detect breaches of this commitment.

Use tailored communications and training, together with advice and reporting mechanisms, to manage third party relationships

Provide tailored communications and training to third party relationship managers and third party employees, commensurate with the level of risk. Provide third parties with access to confidential advice and speak-up channels and follow up any credible reports. 

12.3.6.1  Communications and training

The due diligence process should provide evidence of a satisfactory anti-bribery programme appropriate to a third party’s risk profile. Even so, it cannot be certain that a third party’s employees will have sufficient understanding and skills or even act in the desired way. Therefore, a company will need to communicate clearly and accessibly to third parties the importance it attaches to countering bribery, the ways it expects third parties’ employees to act and how to recognise and deal with particular risks.

Contracts and communication of the code of conduct and expectations for third party business conduct are the platform for conveying the company’s anti-bribery requirements of third parties.

“Education is key. That initial investment of time makes a big difference. We are an iconic company and want to make sure that we do not partner with a potentially damaging third party.”

Interview, senior compliance officer

Training should be a standard component in the toolkit for third party anti-bribery management and considered a requirement for high-risk third parties, however, it is often neglected by companies.

Communications and training should focus on high-risk third parties, such as sales agents, but it should not be assumed that large global companies do not need attention. Though they can be expected to have substantive anti-bribery programmes, continuing bribery enforcements involving large companies show that this is not a guarantee of good anti-bribery practice. The employees of large third parties and their sub-contractors may benefit from specialised training and tailored communications when working on behalf of a company.

Communications and training  – examples of good practice

• Take a risk-based approach to training: For example, use customised and more frequent and face-to-face training (considered more effective) for higher risk levels and remote online training for low level risk, and a hybrid of both approaches for medium level risk.
• Integrate your messaging: Position anti-bribery communication and training in the context of corporate standards and processes, other sustainability issues and responsibility commitments. Anti-bribery communications must be precise and prominent among the many corporate communications for the message to get through.
• Ensure tone from the top:  Involve third party senior management in training and communication as much as possible, such as appearing at the introduction to say a few words.

• Make it accessible: Communicate the anti-bribery requirements, guidance and training in local languages and in a style that explains clearly and in a non-legal manner what is expected of associates.
• Train your employees: Give regular tailored training for employees who engage with third parties – this should be consistent with identified third party risks and match the messages given to third parties.
• Integrate employee and third party training: For some third parties, such as sales agents, match training to that given to employees and consider extending it, through agreement with parties involved, to high risk lower tier subcontractors, such as customs brokers appointed by agents. Where appropriate, involve third parties in employee training sessions or modify in-house training – this can be cost effective.
• Provide tailored codes of conduct or business conduct guidelines: For example, publish a dedicated page on the company’s website which sets out guidelines for suppliers, subcontractors and other third parties, including standards of conduct and expectations of suppliers in specific issue areas, such as gifts and entertainment and conflicts of interest.[1]

[1] See, for example: http://www.bechtel.com/supplier/ethics/ [accessed 20 June 2016]. 

12.3.6.2  Advice and speak-up channels

Advice channels provide information and answer queries about the anti-bribery programme. Speak-up channels (also called whistleblowing channels, hotlines or helplines) are provided for employees to raise concerns or report instances of bribery. Less commonly, they are made available to business associates.

Companies should consider providing speak-up channels for third parties. Because whistleblowers often suffer from their actions, third party employees may be reluctant to report concerns. They can be encouraged by how well the company handles reports and deals with issues and by explaining confidentiality and protection. Use of an external provider for the speak-up channel may also encourage a third party to report their concerns in the knowledge that the line is being manned by an independent body. To further encourage use of the channels, the company should consider making them available both in English and relevant foreign languages.

Advice and Speak-Up Channels – Examples of Good Practice

• Encourage third parties to speak up: Extend internal speak-up channels to third parties.
• Check for existing channels: Include the presence of a speak-up process in the third party as a due diligence criterion.
• Build trust in the process: Overcome reluctance or concerns about reporting by third parties by building their trust in the procedure for speaking up by. For example, explaining and reminding about legal protections for whistleblowers, using an independent agency and/or reporting on number (not nature) of incidents and number of incidents resolved. 
• Provide training: If the company provides tailored training for third parties’ employees, include discussion of speak-up channels in the course. This will be subject to agreement with the third party as it may be a sensitive topic.
• Encourage direct reporting: Make clear that concerns should be raised through the company whether through the relationship manager, compliance manager or the whistleblowing channel.

12.3.6.3  Incident management

No anti-bribery programme will guarantee that a company will be free of bribery incidents in its supply chain. A procedure is necessary to anticipate and manage incidents promptly, thoroughly and efficiently. Incidents can be revealed through monitoring, audits, whistleblowing (including internal tips from speak-up lines or a report to authorities) and media allegations or by the authorities as a consequence of other investigations. The nature of the incident may vary from a suspicion to a high likelihood that bribery has occurred.

On receiving information or allegation of an incident, management should inform and consult the legal and compliance departments and flag the incident immediately to senior management. All alleged bribery incidents should go through triage to establish their credibility, as well as the scale and severity of the issues involved, which will determine the appropriate level of response. The company should have an internal and external communications and escalation plan and, in the case of a major incident, investors will need to be informed of the potential severity and the actions to be taken.

The company should investigate whether its controls failed and there is a potential exposure under bribery laws. As part of an investigation, the company will likely need to exercise its contractual third party audit rights, protect and review documentation and electronic files and conduct internal and third party interviews.  This can involve the use of outside firm with investigatory expertise. If an employee(s) is alleged to have participated in bribery with the third party, the company may need to suspend them as appropriate.

Incident Management – Examples of Good Practice

• Cooperate with the authorities: Establish a policy and procedure to report to and cooperate fully with the authorities if it is likely that bribery has taken place, managed by your legal department.
• Decide whether to continue or terminate the relationship: Decide if the relationship can be continued during the course of the investigation or should be suspended. For example, you may decide to continue the relationship where the third party is a critical partner or the bribery incident is contained to one function of the third party and does not reflect the whole company. If the association is continued, end contact with those involved in the bribery allegations or investigation. The conclusion of a legal case against a company will likely be followed by remedial actions, including change of management and strengthening of the anti-bribery controls. Even so, you may decide to terminate an association with a third party where the conduct in question has been egregious and concerns remain. The decision-making process should be thoughtful and documented.
• Learn from incidents: Once an incident has been concluded, improve your third party management in the light of any lessons learned.

Implement rigorous monitoring procedures to deter and detect bribery incidents and breaches of the anti-bribery programme

Require high risk third parties to self-certify annually that they have complied with the anti-bribery programme. Repeat due diligence periodically for existing third parties. For high risk parties and where there is a significant bribery concern, exercise contractual audit rights.

Rigorous monitoring procedures act as a deterrent to third parties and to employees contemplating bribery and are a way to bring to light suspicions or incidents of bribery.

A company should regularly collect new information on third parties by requesting updated information directly from them, requiring them to self-certify compliance with the company’s anti-bribery programme, conducting renewed due diligence, exercising audit rights and/or using technology to automate some of this process. A detailed account of third party audits is described at section 12.3.7.2.

Report publicly on your anti-bribery management of third parties

Provide up-to-date information in an accessible manner to communicate to stakeholders your company’s anti-bribery commitment and anti-bribery measures related to third parties.

Public reporting is a way in which companies can demonstrate to stakeholders that they manage third parties responsibly and have appropriate systems in place to counter risks, including corruption. This reinforces the anti-bribery messages being communicated in other ways by the company to its current and prospective employees and third parties. The business value of reporting should not be overlooked as it can drive reputation, quality, performance and change.

A documentation procedure for third party anti-bribery management is a key aspect of internal controls. It is important for a number of reasons, including:

Developments in technology are providing companies access to new sources and an increased amount of supplier data.  New technology is speeding up the digitisation of most forms of company information and these are increasingly accessible through electronic means.  However, the greatest developments are in the access to information that had hitherto been inaccessible; for example through social media and other forms of big data collection and analysis.  This surfeit of data also presents challenges in terms of the technology and the human resources and expertise required to process and analyse the data and turn it into useful information. 

The following categories show the various ways that new technology and data management can be used to support the management of third party relationships:

Due diligence on third party relationships

Official and unofficial data sources can be used to gain a more complete overview of a third party’s business, directors and management, potential conflicts of interest, relationships with PEPs or other high risk individuals and ultimate beneficial owners. Depending on the perceived risk and availability of information, non-traditional sources including data in other jurisdictions, news aggregators and social media can be considered.  Be aware of any local data-privacy restrictions (see “Data Protection Laws” below).

E-procurement systems and vendor management

Technology can also make it easier for third parties to comply with due diligence requirements through the use of self-service portals where the third party can fill in and upload the requisite data and update it periodically.  Such systems can greatly reduce the time and cost of preliminary due diligence for both parties. Supporting systems can pick up anomalies in any data entered and raise red flags. 

Continuous monitoring of existing relationships

Automation of ongoing monitoring is often overlooked[1] but, if well designed, a good system will pick up exceptions such as any changes of ownership, new allegations or court cases, breaking news stories (positive or negative) and any other information that may be relevant for the ongoing commercial management of the relationship.  The level of sophistication of such a monitoring system should be in line with the size of the contractual relationship and the level of perceived risk.

Management of existing relationships

Good data management and storage will of course allow for better management of the ongoing relationship. In addition, such systems will be invaluable in the case of any bribery incident or investigation. 

Examples of how such a system can be used:

• Relationship management: Documenting, analysing and tracking a relationship throughout its course, including contracts, transactions, meetings, negotiations and progress, performance and results, including audits.
• Compliance: Tracking compliance with the company’s anti-bribery programme using key indicators for internal controls, red flags and non-compliance.
• Audit trail: Providing accessible records that can be used as evidence in the event of investigations by auditors or the authorities.

Data Accessibility

Information can be processed centrally and made accessible to employees locally through the internet and mobile devices. Access can be given to all employees so that they know which third parties are registered or accredited, or access can be restricted by function or geography as appropriate.

Data Protection Laws

Due diligence and monitoring processes must comply with data protection laws in the jurisdictions where the company and its third parties operate. Data protection laws can be a significant constraint to carrying out due diligence by preventing companies gaining information on third parties. For example, the UK’s Data Protection Act 1988 requires that personal data must not be kept for longer than is necessary. The EU Data Protection Directive provides that data should not be processed at all, excepting where conditions are met in three categories of transparency, legitimate purpose and proportionality.

There will be some information that is protected under privacy protection laws and will be restricted to the compliance or legal departments. Some of the information held on a company’s system will inevitably be sensitive, such as evidence of bribery risk, conflicts of interest, improper behaviour, weaknesses or red flags.

New Technology and Data Management Tools – Examples of Good Practice

• Consult legal advisors: Involve legal advisors in the design and implementation of systems to ensure compliance with legislation.
• Develop and apply new technology: Decide whether to use commercial software systems, which are widely available for all sizes of company, or whether to design your own solutions. Discuss the design with those in the company who will use the system as well as third parties who may have to input data.