It is surprising that companies have not really instituted more procedures for conducting due diligence of third parties.  The 2011 Deloitte Anti-Corruption Practices Survey has some surprising results. 

Corporate leaders were pessimistic about their company’s anti-corruption compliance.  The four most cited reasons for this lack of confidence is the absence of a stand-alone anti-corruption policies; infrequent anti-corruption audits; lack of due diligence and monitoring of third parties; and increased corruption risk in emerging markets.

The most surprising area is the lack of third party due diligence and monitoring.  Every enforcement action in the last five years has involved some permutation of third-party violations.  You would think that companies and compliance professionals would get the message but unfortunately it does not seem to have sunk in. 

What are the reasons for this?  In most cases, there are two significant factors contributing to this compliance failure: (1) the lack of corporate leadership to establish a compliance tone at the top; and (2) the absence of leadership to audit existing third party relationships and enhance the due diligence process for screening and monitoring third-party consultants. 

Half of the executives surveyed cited the use of third parties as a significant source of corruption risk.  Amazingly, only  41 percent of executives said their company regularly conducted due diligence on third parties in foreign countries that sell to, or interact with, foreign government officials, while 34 percent said they sometimes did so. One- quarter of executives said they did not conduct such due diligence at all, including 38 percent of those from smaller companies.  Even those companies that do conduct due diligence, most of the companies use a limited due diligence inquiry to conduct the review.

Why have companies resisted changing their due diligence procedures?  In order to change the existing procedure, the company has to first acknowledge that its existing due diligence program is not adequate.  Companies fear that they are required to audit the past third party actions and fear finding violations.  But that is part of the cleansing process.  In order to reform the process you have to acknowledge the past and implement modifications.  There is no requirement that the company disclose the past violations, especially when the company is instituting new and improved procedures.

For companies, there is one thing they should be doing right now — identify and evaluate all third-party relationships for anti-corruption compliance.  Due diligence is a basic requirement and companies would be smart to focus on this issue.