Best practices for surprise visits to high-risk country subsidiaries

A surprise compliance visit tests whether a subsidiary can explain what its policies say and how decisions, payments, approvals and records work in practice. Best practices for conducting a surprise compliance visit to a subsidiary in a high-risk country begin with independent planning in Australia, while counsel in the host country confirms that the approach respects labour, privacy, surveillance and evidence laws.

The visit should answer defined risk questions rather than become an improvised audit. An Australian sponsor, usually the board audit or risk committee, sets the mandate, scope and reporting line; the team holds sensitive logistics without briefing local management. The design should preserve access to records and people, prevent documents from being assembled for the visit, and include a route for urgent escalation if fraud, bribery or retaliation appears.

Prepare the visit without alerting management

Begin with an authority map showing the Australian parent’s ownership, board oversight, funding arrangements and lines of accountability for the subsidiary. The team should confirm which Australian and host-country laws apply to records, employee interviews, device access, recordings and cross-border data transfers. Where the statutory nexus exists, the foreign bribery provisions in Part 2.2, Division 6 of the Criminal Code Act 1999 may extend to agents and third parties acting for an Australian-connected business. Local counsel should approve the proposed methods before deployment.

Develop several testable risk hypotheses, such as inflated agency commissions, undisclosed conflicts, split invoices, payments to government-linked entities, manipulated licence renewals or sales rebates retained off-book. Permit files deserve particular attention because mining licence renewal risks can combine political influence, opaque criteria and valuable exploration rights. Any hypothesis should identify the records, approvals, counterparties and locations needed to confirm or disprove it.

Establish evidence controls before travel. Preserve existing repositories, restrict write access and avoid asking managers to compile documents in advance. Use chain-of-custody forms, tamper-evident copies and secure transfer channels for notes, images and electronic files. A narrowly focused request can be issued after arrival, but it must remain broad enough to prevent selective production. Counsel should determine whether a legal hold, notification to the subsidiary’s governing body or another preservation step is required.

Build a risk-led testing scope

Map the subsidiary’s money and decision paths from authorisation to payment. The initial scope may cover procurement, sales, customs, treasury, payroll, licensing, property, donations, hospitality, recruitment and government relations. Include the parent’s related-party transactions and any management override capability. High-value activity alone should not determine the sample; low-value payments split below approval thresholds can reveal stronger control signals than a single large invoice.

Open-source intelligence should test ownership, connections and events before money moves. A disciplined pre-transaction corruption screening process can connect a vendor with a politically exposed person, a disputed licence or adverse media that the internal system missed. Investigators should record each source, access date, translation and conclusion, while distinguishing verified facts from allegations. Corporate registries, official gazettes, sanctions lists and reliable news archives are generally more useful than unsourced social-media posts.

Select transaction samples and documents before receiving management explanations. Use both targeted exceptions and a small control baseline from routine business. Relevant anomalies include round-dollar payments, duplicate invoice numbers, weekend transfers, sequential payments to one beneficiary, altered bank details and invoices that straddle approval limits. Sample selection rules should be documented so the subsidiary cannot later argue that reviewers ignored inconvenient evidence or examined only outcomes it expected them to find.

Assemble the Australian field team

The team should be independent of the subsidiary’s management chain and include compliance expertise, forensic accounting, internal investigations, human resources, technology and knowledge of the relevant industry. A local lawyer and independent interpreter are essential where legal rights or language differences could affect evidence. Coordinators in Sydney or Melbourne can maintain direct reporting to the Australian sponsor, while investigators familiar with Perth, the Pilbara or fly-in-fly-out operations can recognise risks involving remote sites, roster changes and informal purchasing decisions.

Plan travel, security and data handling as one operation. Use Australian government travel advice, assess medical and evacuation arrangements, and establish secure communications that local administrators cannot monitor. Devices containing interviews or subsidiary records must be encrypted and access-controlled. Any device, sample or currency carried into Australia must comply with applicable Australian Border Force and customs requirements; internal authorisation never replaces a declaration obligation. Avoid placing interview details in ordinary email or shared calendar entries.

The briefing should give every team member the same escalation and evidence instructions. The sharp and flat notes explanation, although written for musicians, illustrates why shorthand cannot be assumed to carry identical meanings across different readers. Assign precise labels for urgent legal concerns, factual observations and follow-up items, and require interpreters to confirm that those labels retain their meaning in both languages.

Conduct interviews and document review

At the opening meeting, explain the compliance purpose, independent reporting line and protection against retaliation without disclosing the evidence under review. Ask the custodian to preserve records and systems, but do not imply that every discrepancy is already a breach. Employment representatives or local counsel should remain available for interviews where individual rights may be affected. Where consent to record is not required or cannot reliably be obtained, contemporaneous written notes may provide the safer evidence path.

Interview people who perform approvals, payments, procurement, customs, licensing and government-facing work. Former employees may identify removed approvers or informal practices, while current staff can explain legitimate exceptions. Questions should seek concrete examples: who introduced an agent, what occurred at a meeting with an official, which bank account was verified, and what happened when a receipt was missing. Interviews should occur away from local management, and no participant should be promised anonymity, immunity or a preferred outcome.

Document review should test completeness as well as content. Compare contracts with purchase orders, delivery evidence, invoices, customs entries, ledger postings and bank beneficiaries. Inspect metadata and version histories where lawful, looking for post-event edits, mismatched dates or files stored outside approved repositories. Source discipline matters: a search result is not evidence merely because it ranks highly. An unrelated Dutch page about mobile craps gaming, for example, belongs in an exclusion log rather than a report; the same rule applies to anonymous allegations and unverifiable reposts.

Test transactions, third parties and controls

Trace selected transactions from the original business need to the final beneficiary. For procurement, follow the requisition, tender, negotiation, approval, receipt and payment, checking for duplicate claims, inflated quantities and fictitious suppliers. For sales, examine bids, commissions, rebates, credit notes, returns and receivables to identify value transferred without a genuine commercial service. Government contracts and licence renewals require comparisons against published criteria, authorised delegations and contemporaneous meeting records.

Test third parties at the point where reliance becomes financial reliance. Confirm incorporation, beneficial ownership, banking history, agency authority, government contacts and the basis for every commission. Look for side letters, success fees, confidentiality arrangements, unusually rapid onboarding and requests to pay an unrelated employee or consultant. A request to change verified bank details through an informal messaging application should trigger immediate escalation and independent callback verification. Payments cannot be separated from Australian bribery exposure merely by placing the contractor in another country.

Conduct physical walkthroughs of warehouses, offices, cash points and approval workflows. Reconcile petty cash, gifts, hospitality records, donations, recruitment fees and customs documentation with the general ledger. Test whether dual approval works in practice, whether original invoices are required before payment and whether staff can override system controls. Ask managers to demonstrate their authority rather than describing it, and compare host-country customs entries with shipping records and the Australian parent’s expectations for inventory, freight and related-party charges.

Close the visit and sustain corrective action

Hold an exit meeting that distinguishes confirmed facts, unresolved questions and preliminary control observations. Do not make legal conclusions or promise that identified gaps will be treated leniently. Provide the subsidiary with immediate containment instructions where continuing payments, system access or document destruction could harm the investigation. Preserve legal privilege over the investigation strategy while ensuring that investigators can communicate necessary findings to the Australian board sponsor.

Set each corrective action to a named owner, evidence requirement and deadline. A policy revision without changed workflow is weak remediation, while a new workflow without training and monitoring may fail under pressure. Test remediation through fresh transactions, system-access reviews and follow-up interviews rather than accepting updated screenshots. Strengthen speak-up channels in relevant local languages, protect complainants from retaliation and confirm that the board can receive allegations outside the subsidiary’s management line.

Assess whether findings affect the Australian parent’s financial reporting, governance disclosures, sanctions compliance or regulated activities. This includes reviewing the adequacy of ASIC and ASX processes where relevant, determining whether any AUSTRAC obligations apply to group entities, and applying Australian privacy requirements when Australian records or employee information are involved. The final report should track evidence of completion through repeated board updates until the control owner can demonstrate sustained performance. The practical takeaway is to arrive with an independent risk hypothesis, preserve evidence under a controlled chain of custody and leave with verifiable corrective action rather than an unclosed list of concerns.