Building a risk-based due diligence program for third-party intermediaries

Australian companies often rely on agents, distributors, customs brokers, introducers, consultants, joint-venture partners and local representatives to enter markets or win contracts. These relationships can create commercial value, but they may also expose a business to bribery, fraud, sanctions breaches, conflicts of interest, money laundering and reputational damage. A third party may interact with government officials, manage licences, arrange permits or influence procurement decisions without appearing on the company payroll.

A practical due diligence program should therefore match scrutiny to risk. A small domestic supplier with no government contact does not warrant the same process as an intermediary seeking mining approvals in Western Australia or representing an engineering group in Southeast Asia. The objective is to make informed, documented decisions before appointment and to continue testing whether the relationship remains appropriate.

Start with a clear risk model

Risk-based due diligence begins with a consistent method for identifying and ranking exposure. The assessment should consider the intermediary’s role, location, ownership, services, payment structure and access to decision-makers. A consultant paid to provide technical advice is different from an “advisor” whose main value appears to be personal connections with a minister or procurement officer.

Geography matters, but country risk should not be treated as a complete answer. A low-risk jurisdiction can still contain a high-risk transaction, while a reputable intermediary can operate in a market where public procurement is vulnerable to undue influence. Country profiles can help teams compare corruption indicators, enforcement trends, legislation and common business risks across markets. The country risk profiles are useful for establishing that initial context before a more specific review.

A simple scoring model may assign points for factors such as government touchpoints, use of subcontractors, opaque ownership, cash payments, success fees, adverse media and resistance to compliance checks. The score should guide the level of review rather than automatically approve or reject a party. High-risk cases may require enhanced background checks, senior approval, an interview with the proposed intermediary and legal advice. Lower-risk cases can use a proportionate questionnaire, identity verification and contractual safeguards.

The model should also recognise Australia’s operating environment. A contractor supporting a Queensland resources project may deal with state agencies, local councils, traditional owner groups and major international suppliers. Those relationships can be legitimate and sensitive, but the company should document who is being approached, for what purpose and under which authority.

Conduct meaningful pre-appointment checks

A questionnaire is only the beginning of third-party screening. Ask for the intermediary’s legal name, registration details, tax information, ownership structure, directors, professional qualifications, physical address, banking details and relevant experience. Confirm that the person or entity actually exists and that its proposed capabilities match the services described.

Beneficial ownership checks are especially important where a company uses layers of entities, nominee directors or offshore bank accounts. Compare documents supplied by the intermediary with corporate registries, licensing databases, sanctions lists, politically exposed person databases and credible media sources. Search in relevant languages where possible, and verify references independently rather than relying only on contact details supplied by the candidate.

The business purpose should be tested through evidence. If an agent claims to have expertise in government relations, ask for a clear description of the work, expected deliverables and the basis for the fee. Vague promises to “make things happen”, unusually high commissions, requests for cash, payments to unrelated accounts and reluctance to identify subcontractors are warning signs. A request to backdate an agreement or split a payment below an approval threshold deserves immediate escalation.

Cultural knowledge can improve the quality of screening, provided it does not become an excuse for informal controls. Understanding local symbols, titles and community protocols may help staff distinguish a legitimate relationship from a manufactured display of influence. Guidance on respectful local imagery illustrates why context matters when companies assess local representation, communications and public-facing conduct.

Make approvals and contracts do real work

Due diligence should produce a decision that someone is accountable for. The responsible business owner should explain why the intermediary is needed, what services will be provided, how the candidate was selected and why the proposed remuneration is commercially reasonable. Compliance, legal or risk teams should review higher-risk appointments, while senior management or a board committee may need to approve exceptional cases.

The written agreement should describe the services in enough detail to test performance. It should prohibit bribery, fraud, facilitation payments, undisclosed conflicts and unauthorised subcontracting. It should require accurate invoices, supporting records, cooperation with audits and prompt disclosure of government connections or changes in ownership. Termination rights should apply where the intermediary breaches compliance obligations or refuses reasonable verification.

Payment controls are equally important. Pay only against documented services, use a bank account in the intermediary’s own name and jurisdiction where practical, and avoid cash or payments to personal accounts without a compelling, documented reason. Commissions should be proportionate to the work and linked to defined milestones. Finance teams should examine unusual round amounts, vague descriptions, urgent payment requests and invoices issued by a different entity.

Australian businesses should pay attention to how “mateship” and relationship-based selling can blur boundaries. A client entertaining a potential partner at a Melbourne sporting event or a supplier offering to “shout” a dinner may be ordinary hospitality, but the timing and value matter. A gift or invitation close to a tender, licence decision or inspection should be recorded and assessed under the company’s gifts and benefits rules.

Cross-border relationships also create legal conflicts. Local custom or a foreign law may appear to permit conduct that Australian law or company policy prohibits. Teams can use this guidance on conflicting legal duties when determining which requirements apply, documenting the conflict and obtaining specialist advice before proceeding.

Monitor the relationship after appointment

Approval is not the end of due diligence. Risk can change when an intermediary takes on a new government project, hires a politically connected subcontractor, changes bank accounts or begins requesting expenses that were not part of the original arrangement. Monitoring should be proportionate to the risk rating and linked to events that trigger a fresh review.

Set review dates for all active intermediaries, with more frequent checks for high-risk relationships. Re-screen sanctions, politically exposed person and adverse media databases, and confirm ownership information periodically. Ask business sponsors whether the intermediary is delivering the agreed services and whether any public officials, family members or related companies have become involved.

Expense and invoice testing can expose problems that a background check misses. Sample claims for receipts, dates, attendees, business purpose and approval history. Look for duplicated receipts, round-dollar claims, personal spending, payments made shortly before contract awards and descriptions such as “special handling” or “facilitation”. Practical guidance on red flag expense reviews can be adapted for intermediary expenses and pass-through costs.

Operational teams should know how to raise concerns without damaging legitimate commercial relationships. A sales manager in Sydney may be reluctant to challenge a long-standing introducer who helps secure work in Asia, while a project director in Perth may feel pressure to keep a local broker engaged during a delayed approval. Training should make clear that asking for evidence is a normal control, not an accusation.

Records should show what was checked, who reviewed it, what risks were identified and why the final decision was reasonable. If the company accepts a residual risk, the approval should state the justification and compensating controls. Good documentation helps management identify recurring weaknesses and gives investigators a reliable account of the relationship.

Connect screening with broader compliance controls

Third-party due diligence works best when it is connected to procurement, finance, sanctions compliance, privacy, modern slavery, competition law and whistleblowing processes. A supplier may pass an anti-bribery review but still present forced labour, export control or conflict-of-interest risks. The same core information can support several control functions, reducing duplication and improving consistency.

The Australian context includes obligations and expectations that vary by industry and transaction. Companies working across the Northern Territory, Queensland or Western Australia may engage contractors through complex supply chains linked to resources, construction or infrastructure projects. Businesses should consider the Modern Slavery Act where it applies, sector procurement rules, state and territory requirements, and the foreign bribery provisions of the Commonwealth Criminal Code. Legal advice is appropriate when the intermediary’s conduct involves public officials, political donations, permits or cross-border transfers.

Training should be practical rather than limited to policy distribution. Staff who appoint or manage third parties need examples of acceptable hospitality, conflicts of interest, referral fees, community engagement payments and government-facing activities. They should know where to find the approval form, when to pause a payment and how to report a concern confidentially.

International monitoring also requires careful source selection. Official registers, court records, regulator notices and reputable journalism should carry greater weight than anonymous allegations or promotional material. Regional reporting can help teams understand market conditions and public controversies; for example, regional business coverage may provide useful context when a review involves companies or political developments in southern Europe. Any external information should be corroborated before it affects a person’s reputation or a commercial decision.

A mature program measures whether controls work. Useful indicators include the percentage of intermediaries reviewed before appointment, overdue refreshes, unresolved red flags, payments made without complete documentation, training completion and the time taken to investigate concerns. These measures should be reported to management with enough detail to identify patterns rather than simply demonstrate activity.

The program should also include an escalation path. A serious allegation should trigger a temporary payment hold, preservation of records and a defined investigation process. Remediation may involve enhanced monitoring, revised contract terms, repayment, disciplinary action or termination. Where conduct may breach Australian or foreign law, the company should obtain legal advice on reporting and cooperation obligations.

A defensible due diligence program is built around decisions, evidence and ongoing attention. It recognises that intermediaries can be legitimate business partners while accepting that trust, local knowledge and commercial urgency are not substitutes for verification. The right level of review depends on the actual risk, and the rationale should remain clear to someone who was not involved in the original appointment.

For an Australian company, the next practical step is to create a single intermediary register, assign each active third party a documented risk rating, and schedule enhanced reviews first for those with government contact, unusual payment terms or operations in high-risk markets.