Mapping and ranking third-party risk across global supply chains

A global supply chain rarely exposes corruption risk through a single high-risk country flag. Exposure sits inside relationships with agents, distributors, labour suppliers, freight forwarders, consultants and technology vendors, often several contractual layers away from the purchasing organisation. Useful third-party due diligence connects those relationships to what the business actually buys: influence over decisions, access to public officials, discretionary payments and control of sensitive data.

The best practices for mapping and ranking third-party risk across a global supply chain begin with a complete risk universe, move through a transparent assessment of exposure, and end with monitoring tied to evidence and ownership. Geography informs that work, but it cannot reveal a hidden beneficial owner, a conflicted intermediary or a supplier whose invoices conceal unusual commission. Australian organisations can apply this approach while accounting for local legal duties, lean compliance teams and supply chains reaching well beyond Australia.

Build the complete third-party universe

Create the third-party inventory from actual transactions rather than a procurement category list. Record every supplier, intermediary and subcontractor involved in delivering products or services, including entities that appear only on a purchase order, invoice or bank mandate. For each relationship, identify the contracting entity, beneficial owners, the country where performance occurs, the payment destination and the business unit responsible. Agents and distributors deserve particular attention because their influence may exceed the value of the goods or services they provide.

Australian working habits can make an incomplete register look adequate. Procurement teams in Sydney and Melbourne often manage supplier information through email, spreadsheets and shared drives, while smaller organisations may depend heavily on personal networks and longstanding relationships. A distributor serving a mining operation near Perth might be incorporated elsewhere and paid through an overseas account while the work takes place in Western Australia. Remote procurement and digital supplier portals create efficiency, but they can also conceal ownership changes, additional subcontractors and duplicated records.

Start with country-level indicators from the portal’s country risk profiles, then connect them to the specific relationship and transaction. A country score is a baseline, not a verdict. The relevant questions concern the supplier’s ownership, conduct, sector and role in the chain, including whether it can influence a public decision without a formal government contract.

Rank risk with consistent evidence

A useful risk-scoring model separates inherent risk from residual risk. Inherent risk reflects the exposure presented by the activity, geography, transaction structure and nature of the counterparty. Residual risk reflects the controls that reduce or manage that exposure. Assess factors such as political exposure, regulatory pressure, transparency, transaction complexity and the likelihood of misuse, then document why each material factor affects the rating.

Apply consistent criteria across business units and regions. A high-risk designation might arise where several factors coincide, such as an undisclosed intermediary, discretionary commissions, weak accounting records and contact with a public authority. A serious red flag should trigger escalation rather than disappear inside an averaged score. Conversely, a low rating should indicate verified, proportionate controls rather than an absence of investigation.

Present rankings in a form that decision-makers can understand. Each entry should show the score or tier, principal risk drivers, evidence reviewed, assessment date, control owner and next review date. Periodic reviews should cover the entire register, with event-based reviews reserved for material changes. This creates a defensible prioritisation process and reduces the risk that compliance becomes detached from purchasing decisions.

Apply Australian legal and operational realities

Australian legislation makes certain third-party relationships especially significant. The Criminal Code Act 1996 (Cth) addresses bribery of Commonwealth public officials, while relevant provisions of the Crimes Act 1914 (Cth) deal with bribery affecting employees and agents. The Modern Slavery Act 2018 (Cth) also creates reporting duties for qualifying entities, including those meeting a consolidated revenue threshold of AUD 50 million. The applicable obligations should be confirmed against the organisation’s activities and Australian legal advice.

Due diligence also creates data-protection responsibilities. Obtaining ownership information, politically exposed person screening results, bank details and adverse media may involve personal information about directors, beneficial owners and reference contacts. Where the Privacy Act 1988 (Cth) applies, the Australian Privacy Principles inform decisions about purpose, collection and security. International transfers and European data-protection requirements may also matter. The legal and privacy overlap provides useful context for balancing investigative needs with privacy obligations.

Controls must suit the operating environment. A mining, energy or infrastructure business may combine office-based buyers in Melbourne or Brisbane with remote operations, fly-in fly-out teams and multilingual suppliers. Lean teams may work from shared files, supplier portals and informal approvals, making continuous verification difficult. Practical safeguards can include known-contact telephone confirmation of bank changes, translation support, in-country verification through approved advisers and documented escalation paths. A contract promising instant transparency will rarely help if local personnel lack a workable process for meeting it.

Test rankings through proportionate due diligence

The depth of due diligence should follow the ranked exposure. Higher-risk relationships warrant stronger identity checks, ownership tracing, sanctions and politically exposed person screening, review of government connections, source-of-funds enquiries and independent references. Medium-risk relationships need proportionate corporate, contractual and payment checks. Lower-risk relationships still require basic identity verification and a defined process for responding when circumstances change. Politically exposed person status is a risk indicator, not proof of misconduct.

European relationships may involve agents, distributors or subcontracting chains that complicate ownership tracing. The SUD Europe resources can supplement internal research when an external perspective on due diligence is useful. Whatever source is used, record the question asked, the evidence obtained, unresolved gaps and the decision made, so that an assessment remains auditable.

Approval should not end the review. Monitor ownership changes, adverse media, new government roles, unusual commission requests, refusal to provide records and payment diversion. Verify requests to change banking details through a previously established contact rather than the email thread containing the request. Control effectiveness should be tested during performance, including through audit rights, sample invoice review and periodic questionnaires informed by the original risk assessment.

Recommendations for prioritising third-party risk

A defensible exercise combines evidence with clear ownership. Teams that need external guidance or support can use the portal contact page to request information about building a repeatable assessment. The following measures help convert a complex register into a practical sequence of attention and action.

Establish one register with named owners. Consolidate supplier, agent and intermediary records, and assign responsibility for data quality, due diligence, contractual controls and follow-up.
Show inherent and residual risk separately. Explain how controls reduce exposure, and prevent unsupported mitigation claims from concealing an unacceptable underlying risk.
Prioritise relationships by influence as well as value. Give early attention to agents involved in permits, customs, tenders, public clients and high-value discretionary commissions, even when the contract appears modest.
Establish time-bound escalation. Define when a red flag requires review, who decides, what evidence is needed and which senior executive may accept unresolved exposure.
Reassess when circumstances change. Set review dates by risk tier and trigger immediate reassessment after ownership, banking, scope, location or adverse-media changes.

Measure the process through completed reviews, overdue actions, verified ownership information and documented closure of identified gaps. Reporting only the number of third parties screened can make activity look stronger than it is. Leaders need to know which high-risk relationships lack evidence, which exceptions remain open and whether the organisation has acted on its own findings.

Turn the ranking into an owned compliance process

Third-party risk cannot sit solely with procurement or compliance. Procurement identifies commercial exposure, finance sees payment behaviour, legal interprets obligations and business leaders understand the consequences of disrupted supply chains. Assign these functions clear responsibilities within the assessment process, including approval thresholds, escalation routes and criteria for pausing or terminating a relationship. Training should help employees recognise warning signs such as commissions paid in cash, requests for unusual success fees or pressure to bypass documented procedures.

Begin with a usable system. A controlled register may be more effective than an expensive platform when ownership, evidence and actions cannot be maintained reliably. Whichever tool is chosen, preserve an audit trail, restrict access according to privacy obligations and make the current evidence and next review date visible to the responsible teams. Review rejected or high-risk relationships periodically to determine whether controls are producing genuine results.

The immediate next step is to convene a two-hour workshop involving procurement, finance, legal and compliance, export the active supplier and intermediary register, and select ten relationships representing the greatest exposure. For each, record ownership, payment route, principal risk drivers, due-diligence status and decision owner, producing a first prioritisation queue with named gaps.