The Third-Party Due Diligence Process, Step by Step

Third-party due diligence is the process of investigating a supplier, distributor, partner, or acquisition target before you take on the relationship, and again while it lasts. Its job is to establish who actually controls the other party and whether it brings legal, financial, or reputational risk with it. A sound process has six steps: tier the relationship by risk, identify who is really behind it, screen, investigate the people, decide and document, and keep monitoring.

Why third-party due diligence matters

A third party acts in your name, touches your data, or sits in your supply chain, and its problems become yours. Anti-bribery laws such as the U.S. Foreign Corrupt Practices Act and the UK Bribery Act hold companies responsible for what their intermediaries do, sanctions exposure follows ownership rather than the name on the contract, and a partner's scandal lands on your brand regardless of who signed. Due diligence is related to, but broader than, the Know Your Customer (KYC) checks a regulated business runs on customers at onboarding: KYC confirms who someone is, while due diligence asks whether the relationship is a risk worth taking on.

The third-party due diligence process, step by step

1. Tier the relationship by risk. Not every vendor deserves the same scrutiny. Score each third party on factors such as country, industry, contract value, access to your systems or data, and whether it deals with government officials on your behalf, then set the depth of review by tier.
2. Identify who you are actually dealing with. Confirm the legal entity and its registration, then trace beneficial ownership through holding companies and nominee structures to the people who control it, along with its directors and key officers.
3. Screen the entity and its people. Check the company and every individual identified in step two against sanctions, politically exposed person, and watchlist data, and run adverse media, litigation, and regulatory enforcement searches.
4. Investigate the high-risk tiers. For the relationships that warrant it, enhanced due diligence goes past databases: reputational history, undisclosed affiliations, conflicts of interest, and the public exposure of the key individuals, built from open-source research rather than self-reported questionnaires.
5. Decide and document. Approve, approve with mitigations such as contract clauses, audit rights, or training, or decline. Record the findings and the rationale, because a documented, risk-based decision is what regulators and auditors look for.
6. Monitor for the life of the relationship. Ownership changes, new sanctions designations, and new adverse media do not wait for an annual refresh. Re-screen continuously, or at minimum on a schedule set by tier, and re-run the deeper review when something material changes.

What a third-party due diligence report should cover

A finished report should let a decision-maker act without reopening the research. For a high-risk relationship, that means:

• Entity basics: legal name, registration, jurisdiction, and corporate history.
• Control: ultimate beneficial owners, directors, and key officers.
• Screening results for the entity and each individual: sanctions, politically exposed persons, and watchlists.
• History: adverse media, litigation, and regulatory enforcement.
• Bribery and corruption red flags, such as government touchpoints, unusual payment terms, or unexplained intermediaries.
• Signs of a shell or front company, and basic indicators of financial health.
• People exposure: the reputational and public exposure of the individuals running the business.
• The outcome: a clear risk rating, recommended mitigations, and what will trigger a re-review.

Where most programs stop too early

The most common gap is not depth but time. Most programs run diligence once, before signing, and file the report. A supplier that was clean at onboarding can change hands, pick up a sanctioned subsidiary, or land in adverse media a year into the contract, and nothing in a one-time process will notice. The second gap is people: databases cover the entity well, but the risk usually lives with the individuals who control it.

Where Prae fits

Prae works on both gaps. The same entity resolution that grades an individual's risk exposure applies to the humans behind a supplier, partner, or acquisition target: who actually controls the entity, and what their public exposure looks like across physical, cyber, and psychological domains. Prae then keeps monitoring the relationship after the deal closes and re-scores it as new public information appears, so a change in ownership or a new adverse media hit surfaces while the relationship is still active, not at the next scheduled review. See how Prae runs third-party due diligence.

Quick answers