Third-party due diligence, explained.

What third-party due diligence is: finding out who you are really paying, before you sign

One distributor review, from a business request to a re-review date

1. The business asksA country manager names a distributor, gives a business reason and shares the draft terms. The request gets a first-look risk tier. In the example, this happens on September 29.
2. The firm answersA questionnaire goes out in the local language and English. The firm answers it and signs it. In the example, 62 answers come back on October 7.
3. The answers are checked against the evidenceOwners are traced to people, every person is screened, news and courts are read, and the terms are compared with policy. The tier is set. This step is what this guide is about.
4. A person decides, with conditionsThe risk lead approves, rejects or escalates and signs. Legal counsel turns each condition into contract language before anyone signs with the distributor.
5. The relationship is watchedDaily list checks, payments against the caps, annual certifications, and a full re-review on the tier's schedule. In the example, the next one is due October 7, 2027.

The people, companies and figures in this example are fictional.

Why a clean sanctions result can sit beside a High tier, and three more surprises

Beneficial owner, PEP, red flag, tier: four words this work runs on

Fourteen terms are defined in the one-page summary.

Distributors, customs brokers, CROs and event firms: which outside partners carry bribery risk, and why

In shortClose to nine in ten US foreign bribery matters on record involve an outside firm or person: Stanford's FCPA Clearinghouse counts 305 of 342 through mid-2025. In life sciences, the risk depends on what the partner does and whom it meets: a firm that bids in public tenders needs far deeper checks than a translator. Reviewing all of them the same way wastes effort and misses the ones that matter.

DOJ's guide to evaluating compliance programs says companies should understand the "qualifications and associations" of partners, because distributors and similar intermediaries are "commonly used to conceal misconduct, such as the payment of bribes to foreign officials".4 UK guidance adds a point about depth: an IT contract may need little checking, while an intermediary helping a company enter a foreign market "will typically require a much higher level of due diligence".8

Counts disagree a little, so treat this as "about eight or nine in ten". Stanford's second chart on the same page lists 68 of 343 matters with no intermediary, which implies 80%. For 2015 through 2024, the yearly chart gives 133 of 154, or 86% (our arithmetic).9 A February 2026 law firm deck says "90%+".10 An older OECD study of 427 cases, as a law firm summarizes it, found intermediaries in three of four.11

Eight kinds of life sciences partner, and what puts each near an official

The tiers here are our illustration, drawn from the fictional register in Part B. Your own policy sets them.

Why a doctor at a public hospital can count as a foreign official, and what that does to a drug company's risk

In shortIn many countries the state runs the hospitals and buys the medicines, so a purchasing manager, a tender board member or a doctor on the payroll can count as a government official under anti-bribery law. Healthcare ranks second among all industries in Stanford's count of FCPA matters. A drug company can be exposed in a single country through dozens of ordinary business contacts.

The FCPA covers employees of a foreign government's "instrumentality", which can include state-owned or state-controlled entities. The US government's FCPA Resource Guide names healthcare and life sciences among the areas where governments often operate through such entities, and it gives factors for telling: ownership, control, status and function.1 This surprises many people outside compliance. Selling medicines to a public hospital means dealing with officials every working day, without anyone ever visiting a ministry.

Four life sciences moments when a third party stands between you and an official

The MedTech Europe code has its own chapter on these partners. Member companies should run "risk-based pre-engagement and renewal" due diligence and should write the code's duties into contracts.12

The anti-bribery rules that shape a review in November 2026, and what changed since 2025

In shortAnti-bribery laws set liability and prescribe no questionnaire or score, and prosecutors judge whether your checks fit your risks. US enforcement narrowed in 2025 while the FCPA itself stayed unchanged; its last amendment was in 1998. The UK added a fraud offense, and the EU now has an anti-corruption directive that national laws must carry by June 1, 2028. The ownership registers you rely on changed in 2026 too; section 05 covers those.

Eight rules a third-party review answers to, with their status today

A policy can change after a contract is signed. US anti-bribery charges generally have a five-year limitations period, so a deal signed in 2026 could be looked at under a later approach; that reading is ours.1 Prosecutors in the UK, France and Switzerland also announced a joint anti-corruption task force on March 20, 2025.5

US enforcement continues. On March 19, 2026, DOJ announced its first declination under the new policy, a decision not to prosecute a French medical device maker that self-disclosed payments, which DOJ called bribes, to a worker at a state-owned hospital, routed through a consultant. The company agreed to give up about $1.2 million.26 As of July 2026, the SEC had brought no new FCPA action that year, and a Senate bill to extend the limitations period to 10 years had gone to committee with no change enacted.27

How to trace a beneficial owner in 2026, when some registers are closed and thresholds disagree

In shortYou follow each corporate owner up the chain until a person appears, and you multiply the shares as you go. Legal registers mostly stop at 25%, so a company policy set at 10% has to rely on other evidence below that line. Access has changed: the US register now excludes US companies, EU and British Virgin Islands registers require a legitimate interest, and Vietnam's new decree requires a look-through, tracing through every layer to a person. When you cannot find an owner, record that as a finding.

The four steps from "other investors 30%" to a person's name

Multiplying down the chain: how 60% of a 30% owner comes to 18%

Regulation (EU) 2024/1624, which applies from July 10, 2027, sets out the method for indirect holdings in its recitals: multiply the shares in the ownership chain, then add together everything the same person holds.28 In the example, Thach Thu Hanh owns 100% of a company that owns 30%, so her share is 100% × 30% = 30%.

Now change one fact (illustrative): if she held 60% of Lotus Ridge, her share would be 60% × 30% = 18%. No 25% register would need to name her. A policy set at 10% would still want her name, so you would have to ask for it and verify it another way.

Who can read the owner of a company in five places, as of November 2026

The UK and EU rows come from primary text. The British Virgin Islands and Vietnam rows rest on law firm notes, and we did not read the decrees themselves. Those firms say their notes are not legal advice, so check with local counsel before you rely on any of them.

How a third-party risk score works: six factors, worked through from 62 to 82

In shortMost programs score a few weighted factors and add rules that force a tier whatever the sum. No regulator prescribes the factors or the weights, so yours must be written down, approved and applied the same way each time. The example shows why the input matters: the same firm scores 62 as declared and 82 as traced, and a single fact, a family link to an official, forces High by itself.

UK guidance groups bribery risk into country, sector, transaction, business opportunity and business partnership.8 A common scorecard turns those groups into factors, each rated 0 to 4 and weighted to total 100. In the example, the points for each factor are its level ÷ 4 × its weight. Country risk is level 3 of 4 at a weight of 20, so 3 ÷ 4 × 20 = 15. One factor, adverse media, means news and court records of possible misconduct.

What the sum hides: why scorecards need forcing rules

A weighted score lets a good result in one place offset a bad one elsewhere. Sanctions at zero pulls the example's total down, though it says nothing about the tender board. So programs add forcing rules on top. In the example, any government link makes a third party High, and a true sanctions match blocks onboarding on its own.

Write these down as carefully as the weights. Without the government-link rule, a firm with such a link at 69 would get a lighter review than a firm with no link at 70.

Country risk: a useful input with a known weakness

Many programs start from Transparency International's Corruption Perceptions Index, which scores perceived public sector corruption from 0 (highly corrupt) to 100 (very clean). The 2025 edition covers 182 countries, and the global average fell to 42.33 It measures perception by experts and business people. It says nothing about your partner. Many teams pair it with their own view of where they have seen problems.

What each tier usually buys: an example scheme

These lines come from the guide's fictional scorecard. Regulators ask for a risk-based approach and name no numbers.4,8

Reading the deal terms for bribery risk: margins, success fees and offshore accounts, with the sums

In shortBribes need funding, so a good review follows the money. The US Resource Guide lists excessive commissions, unusually large distributor discounts, vague consulting services, partners tied to officials, offshore shells and offshore bank accounts. In the example, the proposed terms pay the distributor about $216,000 a year above the top of the local benchmark, with no service named to justify it. That gap is the question to answer.

The US government's own red flag list, set beside the guide's example

What the 3% and the 18% come to, worked through

The proposed distribution deal in the example is worth $2.4 million a year. An 18% margin pays 18% × $2,400,000 = $432,000. A 3% success fee on the same value adds $72,000, for $504,000. The top of the benchmark, 12%, pays $288,000. The gap is $504,000 − $288,000 = $216,000 a year, or $648,000 over the draft's three-year term (our arithmetic).

That is money with no stated service behind it. The SEC described the risk in a real case in 2023: special distributor discounts "created a corruption risk that the increased margins could be used to fund improper payments".34

The example applies the 3% to the same $2.4 million. A real tender fee depends on the value awarded. Higher margins can have honest reasons, such as cold chain, remote provinces or real marketing work. The benchmark in the example allows the upper end for these, and a review asks the firm to show the service.

Three more questions to ask about money

PEP lists, sanctions and adverse media screening: clearing name hits without clearing the wrong person

In shortScreening compares names with lists, so it throws up name hits: people who only share a name with a list entry. The skill lies in clearing those hits for a stated reason, and in finding the true link the list does not spell out. Local-language news adds what no list holds, and the follow-up article matters as much as the first one. A person confirms each result. No independent study of false positive rates in this work was found.

Three kinds of list, and what each one tells you

Clearing a name hit: same name, different person, stated reason

In the example, two owners produce three hits. Each has a match score, the tool's measure of how closely the entry fits. A false positive is a hit on the wrong person. A match score only orders the work. A person reads the reasons and decides.

Why the second article counts: an inquiry and its outcome

The first of those two articles, from March 2024, says a province canceled a cardiovascular medicines tender after bid-rigging complaints and that inspectors were reviewing three distributors, Halvora among them. The second, from June 2024, says inspectors closed the review with no further action, and that Halvora won in the re-run.

A reader who stops at March overstates the risk. A reader who never finds March misses something else: the firm answered "No" when asked whether it had been named in an inquiry in the last five years. The review closed cleanly, and the answer was still wrong.

Five life sciences cases where distributors and intermediaries became the problem, and what each one teaches

In shortThese public resolutions cost from about $30 million to $519 million, and they keep showing the same few patterns: a partner owned by or tied to an official, margins that could fund payments, and warning signs nobody acted on. One company kept using a distributor already known to have paid bribes. Each case below names its outcome: a deferred prosecution agreement, a non-prosecution agreement, a guilty plea or an SEC settlement.

Four terms these enforcement records use

Five public resolutions, and the lesson each one holds for a review

We read the Teva, Fresenius, Novartis and Zimmer Biomet rows in the agreements and court filings DOJ publishes. We could not open sec.gov, so we did not read the SEC's orders: its amounts come from those documents or the cited reports, and the Philips row from a law firm's account of its order. These are public enforcement records, cited as such, and each states what its record says. They are separate from the fictional example, whose companies and people are invented.

Six everyday errors that lead a distributor review astray

Keeping a distributor approval honest: conditions in the contract, monitoring, and what records to keep

In shortA condition only works if it reaches the contract and then the payment run. Prosecutors ask whether you manage third-party risk through the whole relationship, whether you have audit rights, and whether you have ever used them. Records raise their own questions: how long to keep them, and how to hold personal data about owners, relatives and news reports lawfully in several countries at once.

How each red flag in the example becomes a contract clause and a control after signing

The questions DOJ asks about the relationship after signing

Records and personal data: four limits to set with counsel

Where FCPA cases cluster, which review steps suit AI, and what regulators expect of it in this work

In shortRecorded matters cluster in large markets that rely on public health systems. AI suits the reading, translating and comparing that eat analyst time, and it can get identity and citations wrong. The good-practice (GxP) quality rules life sciences people know best, such as Part 11 and draft Annex 22, mostly do not govern this work. DOJ's questions on AI do. There is no reliable public figure for the size of this market.

Where AI helps in a third-party review, and where a person must stay

What DOJ, FDA and the EU say about AI in an anti-bribery review

How compliance teams run a distributor review today: who does what, and where 24 days go

In shortA country manager asks, an analyst or risk lead investigates, legal writes the clauses, and procurement releases the vendor. We found no published study of how long this takes; the estimate below puts a High review at about 24 days, and most of that time goes to waiting on the firm and tracing owners. Teams mix in-house work, outside investigators and third-party risk software, and most use more than one.

Country manager to chief compliance officer: who touches one distributor review

From request to a released vendor, with the hand-offs

Three ways teams staff these reviews, and what each one trades

October 7: Halvora's anonymous 30% becomes a company, then a person, then a tender board link, and the tier moves

In shortThis is the example from the top of the page, inside the product. Dana Okafor, the third-party risk lead, opens a questionnaire that scores 62, Medium. She traces ownership. Records show a British Virgin Islands company, its owner and that owner's husband on the tender board. The score reaches 82, and a rule makes the firm High. Each box opens the record it came from.

1

The review opens on what Halvora declared, and says so

Minh Tran, General Manager for Vietnam, raised this request on September 29 with draft terms and a reason: Halvora is the only distributor with tender registrations in all four provinces before the November round. The questionnaire went out the next morning in Vietnamese and English, and it came back on October 7 at 6:52 am.

Dana's home screen draws what the answers say: two named owners, "other investors" at 30%, a Singapore account and resellers to be named later. A note makes the status clear: this is only what Halvora declared.

2

Dana clicks Trace ownership, and the graph grows in view

Each agent's step runs below the graph as it happens. The questionnaire reader turns 62 answers into claims. The ownership tracer reads the registry extract, then the offshore record. The screener runs six subjects against four sanctions lists and the PEP database. The adverse media reader goes through 214 articles in Vietnamese and English.

The risk tier reads "Not set" until the trace is complete, with the As traced bar filling in as each source lands.

3

The finished graph: red paths, a dashed official, and a tier that moved

This is the screen the whole review builds toward. The 30% is Lotus Ridge. Lotus Ridge is 100% owned by Thach Thu Hanh. She is the spouse of Mac Dinh Khoi, a deputy provincial health director and member of the board that approves the tenders Halvora would bid in. Officials are dashed. Red marks the path that matters.

On the right, the score moves from 62 to 82, because three factors changed: government touchpoint +5.5, ownership +10 and adverse media +5. The rule "a government link makes a third party High" fires, and three answers are listed as contradicted by the graph: 3.1, 4.2 and 8.4.

4

One click flips back to the declared view

The As declared and As traced buttons switch the graph between what the firm said and what the records show. The difference between them is easy to put in front of a committee, a sponsor or the firm itself when it is asked to correct its answers.

5

Every box opens the record behind it

Dana clicks the official's box and reads the PEP record: spouse, role, tender board since 2021, match score 0.93, and the reasons for the match. It also says what did not match: national ID was unavailable. The highlight shows which passage the graph relied on.

The PEP entry is sample data, as is every record here, and the province is never named.

Inside Halvora's dossier: seven red flags, each answer against the record, and the $216,000 question

In shortThe dossier, the review's written file, holds what a decision needs: the score by factor, seven cited red flags, what passed, each questionnaire answer against the evidence, screening hits to confirm and each term against policy. Agents propose. People confirm. The 31 citations each open a passage, so a reader can check any claim where it stands.

The two ownership records, and a caution about the second one

Answer by answer against the evidence

The news and its follow-up, side by side

The term sheet against the benchmark and the policy

Approve only with conditions: how each red flag gets a condition, a signature and a contract clause

In shortThe dossier writer maps eight proposed conditions to seven red flags. Dana keeps them all and e-signs with a stated meaning. Clauses go to legal counsel before any contract, procurement releases the vendor only after signature, and Halvora goes on daily monitoring. A red flag left open goes to the chief compliance officer as an exception.

1

Dana chooses: approve with conditions, reject or escalate

The recommendation is plain: "Approve with conditions, only if the recusal or sale of the 30% stake is in writing before signing. Otherwise reject." She can follow it or overrule it. The agent recommends, and the signature stays hers. Rejecting tells the sponsor and records the reason, and escalating sends it to Omar Haddad, the chief compliance officer.

2

Eight conditions, each tied to the flags it answers

Written recusal or sale of the stake. No success fee. Margin capped at 12%, with the marketing fund only against a plan and receipts. Payment only to Halvora's account in Vietnam. Audit rights. An anti-bribery clause with termination, a corrected questionnaire and yearly certification. The resellers named and reviewed. Quarterly monitoring, with re-review in 12 months.

3

Drop a condition, and the screen names the flag left open

Here the payment condition is unticked. No other condition covers the Singapore account, so a warning appears: F4 is not mitigated, and approving with an open red flag goes to Omar Haddad as an exception. If a business reason is strong enough to keep a risk, someone senior puts their name on it. That record answers DOJ's question on how red flags are tracked and addressed.4

4

She signs, with the meaning of her signature

Her name, her role, the decision, the number of conditions and the meaning, "I approve this third party with the conditions listed", all sit on one small form, confirmed with her password. The record keeps them with the date and time.

5

The conditions become clauses, and the next steps are named

The dossier writer drafts a clause for each condition: conflict of interest, compensation, margin cap, payments, audit rights, anti-bribery, sub-distributors, monitoring. Lena Ortiz, legal counsel, approves them. Minh Tran takes the conditions to Halvora, which signs the recusal or sells the stake. Priya Ranvelle in procurement releases the vendor only after contract signature. The re-review falls due on October 7, 2027.

Who signs what on a third-party review: four roles and the four-eyes rule

The four-eyes rule means whoever prepares never approves: agents read, trace and draft; analysts confirm; a named person signs. Scorecard and rule changes take effect only as an approved version, and every agent step and human action stays on the audit trail.

Beyond one distributor: the 18-review register, a consultant's success fee, daily monitoring and a dashboard for the committee

In shortHalvora is one of 18 reviews in the fictional year. The same method handles a Saudi regulatory consultant with a fee tied to approval, a register across 18 countries, 312 parties watched each day, and a dashboard for the compliance committee. Tiers, rules, re-review cycles and approvers are settings you control.

The eight agents behind a review, the records they read, and the design targets to hold them to

In shortEight agents read, trace, screen, compare, score, draft and watch, each with one thing it must never do. A person confirms every disposition, whether a hit is true or false, and decides every tier and approval. The solution works with the questionnaires, registries, screening lists and payment system you already use. Outcome figures here are design targets, measured when the solution runs on your reviews.

Eight third-party review agents, and what each must never do

What goes into a review, and what comes out

Systems a third-party review connects to

What a missed owner and a slow review cost a drug or device company, and how to find your own number

In shortPublished costs are settlements and fines, and they are large and rare. The costs you carry every month are quieter: analyst days, investigator fees, tenders lost to a late approval, and reviews people skip because they take too long. Almost none of this has a public benchmark, so measure it on your own last 20 reviews.

Where third-party review costs hide, and how to find your number in a week

Costs a return calculator leaves out: investigations, monitors, lost tenders and more

Sizing the return on faster anti-bribery reviews: four levers and a calculator you fill in

In shortAnalyst hours and investigator fees can be counted. Speed and risk avoided mostly cannot, so leave them out of the sum and describe them separately. Every default below is an assumption. Change them to your own, and treat a result that only works on the optimistic inputs as a reason to run a pilot before you commit.

Four value levers in a third-party risk program

Third-party review return calculator

Where to start: which third parties pay back first

Is your third-party program ready to automate? Eight scored questions and one to reflect on

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like. A low score points to useful work you can start now.

What to ask a third-party due diligence vendor about owners, screening, citations and data

In shortBring your hardest past case and watch what happens. These questions test whether a tool reaches a real person, says when it cannot, cites what it claims and leaves decisions with your people. Ask us too. Each question says why it matters and what a strong answer sounds like.

A 12-week pilot on your own distributors: replay 20 past reviews, then run one country in parallel

In shortStart by replaying past reviews whose outcomes you know, and measure whether the solution finds what your team found and anything it missed. Then run one country live in parallel for six weeks. Your people keep every decision. If the numbers do not hold on your own files, you have learned that cheaply.

Eight things to measure in a third-party review pilot

Third-party due diligence questions, answered

In shortShort, standalone answers to the questions people most often search, as of November 2026. None of this is legal advice.