Building or overhauling your compliance program can be daunting. Where do you start?

Third parties pose substantial risks to your organization. An effective and robust compliance program is critical, as companies can face reputational damage and accountability due to illegal actions or poor decisions made by third parties.

Key Questions to Ask About Third Parties

• Does the company exist?
• Is it legal to work with this entity?
• Is this a company we are proud to work with?
• Has it broken the law?
• Is it linked to a government?
• Can it deliver the service?
• Is it financially stable?
• Most importantly: How will I manage the potential risks this third party poses to my organization?

LAP can assist in answering all the above questions and more with our Due Diligence products and Compliance Solutions.

1. Evaluate (or Design) Your Policies

Decide the outcome you want your transformation to achieve and work backwards. Consider each scenario requiring a compliance overview and map out the necessary steps before sign-off. We recommend an initial assessment, a risk-based review, evaluation of the result, mitigation measures, and a regular refresh.

No matter the maturity of your compliance approach, LAP is here to assist.

Through LAP Design, you can access compliance experts with extensive experience providing solutions to clients across multiple sectors and geographies. These experts will guide or review your current procedures to help you build a policy and vet procedures tailored to your organization, industry, and risk appetite.

2. Review Your Third-Party Base

Once your policy and compliance processes are in place, review your third-party base.

Consider:

• Who you will be interacting with
• Where in the world they are
• Where the services will be provided
• What kind of contracts and permits are needed
• What kinds of activities they are undertaking
• How much you plan to spend with them

Consider the associated risks for each of these factors. A technology solution such as LAP Platform can help streamline this process. LAP Platform can be used directly or integrated with your systems via an API. Having an overall view of all third parties and their associated risks is vital for a risk-based approach.

3. Implement a Risk-Based Approach

Adopt a risk-based approach for compliance. Not all third parties require the same level of due diligence.

Categorize risk types and prioritize the review order. Use parameters such as country-specific, activity-specific, or contract-value rules. Run all your third parties through an automated database search, such as LAP Screening, to identify potential sanctions risks.

Following this, a more nuanced review is recommended. Determine the appropriate diligence level for higher-risk third parties, whether it be a red flag report or a deeper-dive insight report.

4. Assess the Risks to Your Organization

Some organizations focus on reputational issues, while others prioritize Anti-Money Laundering (AML)/Anti-Bribery and Corruption (ABC) risks or Environmental, Social, Governance (ESG) risks.

Consider your organization’s legal requirements and risk appetite. Adding LAP Assess, a compliance specialist can contextualize the findings of a LAP Screening or Diligence report, providing a risk assessment that mirrors your policies and approach to risk.

5. Mitigate the Risks Found

Identify and mitigate risks in your third-party population. This could involve additional checks, requesting more information, conducting compliance-focused interviews, requiring training, or adding specific contract clauses.

LAP Act can help manage these mitigation measures, assisting with implementing steps to manage identified risks.

6. Monitor the Future

Regularly review completed checks based on associated risk levels. Automatic ongoing monitoring in the screening database for all third parties is recommended. Set review dates and re-run due diligence checks regularly, typically every 1 to 3 years.

Assess changes in third-party ownership, government relationships, or political climates, as well as changes in your relationship with the third party, spend, and services provided.

7. It Takes Time

Start as soon as possible. Begin with what you have and improve as you go.

The first steps may be small, but they will significantly impact your compliance program’s future and lay the groundwork for success. If you need assistance with day-to-day management and compliance program steps, LAP Manage can help. Outsource elements of your compliance program to our team, who will run third parties through the vetting process on your behalf.

Time to Get Started

As you transform and develop your compliance function, gathering data on risks and mitigation actions will inform future decisions, streamline processes, and create efficiencies. While it may appear daunting, getting started is the first step to analyzing and addressing risks in your third-party universe.