Ronald Reagan’s mantra with respect to US-Soviet relations in the 1980s applies with equal force to today’s world of due diligence. (I know it shows my age that I can recall this statement).  Not all due diligence cases require a skeptical eye. But most compliance professionals know when they are digging into a due diligence review that will require a substantial investigation.

Government enforcement agencies have pushed companies to design and implement effective due diligence systems for managing third party risk. A larger number of companies have implemented some form of automated due diligence. In some cases, companies have celebrated this accomplishment by resting on their laurels.

In the process, companies have put themselves at risk.   An automated due diligence system requires important follow up steps to ensure that companies meet their due diligence requirements. Interestingly, we see more DOJ and SEC enforcement actions where companies failed to follow through on due diligence or ignored obvious red flags.

Due diligence depends on information provided by the third party candidate. In providing such information, companies rely on written or automated questionnaires that are completed by the third party candidate. A questionnaire, however, is only the starting point, not the end point.

The information provided in the questionnaire has to be validated, not based on the candidate’s assurance or signature on the page, but through meaningful independent information.

One key issue is who owns the company – meaning the natural person(s) who owns the company.   Depending on the location of the third party and the industry, this can turn into a tricky issue. Layers and layers of organization entities, with complicated family or related party interests, can be difficult to unravel. Every due diligence system has to dig into a candidate’s ownership structure to identify, validate and investigate the natural persons who own the third party.

There is no easy solution to this requirement. Unless a company knows who it is dealing with, the company cannot go forward. Sometimes companies will decide to rely on a certification from a third party candidate that the company ownership does not include any government officials or any prohibited persons under sanctions laws. A certification is no substitute for knowledge.

Companies have faced enforcement actions when they rely on certification to satisfy due diligence requirements. For several years, Cobalt Energy was under investigation because it relied on a partner’s certification of lack of government ownership. When that certification provided to be inaccurate, Cobalt had to spend hours arguing to prosecutors that an enforcement action was not warranted.

The validation of company ownership requires documentation of the company’s ownership and a reliable source for verifying a company’s natural person ownership. One of my blog sponsors, BVD, provides such validation services and is uniquely positioned to do so based on its investigation and collection of ownership data.

Ownership information, however, is just one part of the validation process. Additional corporate registration and tax information can be validated as well to ensure that a company is dealing with the real third party in interest. Searches of country-specific corporate registration information is becoming a valuable source of information to verify specific representations as to location of incorporation, date of registration and other specifics that corroborate representations made by the third party candidate.

A due diligence investigation has no usual or even typical path. Instead, the facts will lead the investigation and require certain areas of inquiry. Specific individuals who turn out to own parts of a third party candidate have to be confirmed, investigated and cleared of any red flags. It is a lengthy process that needs to be documented and retained in the company files.

The initial due diligence investigation creates a baseline from which the third party’s conduct can be measured and monitored as the relationship continues. It is the foundation of a third party relationship and must be treated as such.