Enhanced due diligence is essential to mitigating risk and managing uncertainty in new environments
The use of local business partners is as old as global commerce itself. European merchants leveraged middle men across the ancient Silk Road, while the first multinational corporations relied on local resources and manpower for their global operations.
Today, requirements set up by foreign governments often mandate business relationships with native firms in order to guarantee the benefits of resource extraction or technology transfer. In other cases, complex business environments all but necessitate local know-how in order to get things done. But as firms move into emerging and frontier markets, they face increasing challenges on their home turf, especially in areas of compliance and reputation management.
While companies can never remove all doubt when making important decisions across borders, techniques drawn from the intelligence community can help.
The broad challenge
Regulatory risk is the primary concern of general counsels and other corporate officers managing a firm’s risk profile. These concerns center around the clear-cut legal ramifications of breaching anti-corruption legislation, export controls, or sanctions. Due diligence can provide some level of clarity as to the types of risks a firm may expose itself to in certain environments, from the existence of embedded patronage networks to problematic individuals with a history of fraud, money laundering, or bribery.
The increased use of sanctions also introduces new risks for western firms. While this can to some extent be mitigated by cross referencing board members, senior managers, and shareholders of a target company with publicly available watchlists, the threat of future sanctions is an ever-present risk given the long-time horizons associated with joint ventures and direct investments. Often, these are susceptible to unpredictable geopolitical headwinds, with Russia and Iran the major case studies over the last year. Direct, indirect, and potential future sanctions exposure – to which due diligence provides necessary insight – should all form a major part of a company’s risk calculus.
Reputational risk, for its part, is far more difficult to assess and quantify. While it takes years to build a strong reputation, one bad action or casual oversight can destroy it, as multiple firms spanning garment manufacturers to investment banks have discovered over the last decade. Analyzing and making judgements about reputational risk is perhaps the greatest value add of enhanced due diligence, providing firms with a clearer line of sight into the localized reputation of individuals and companies around the world.
Western entities must take advantage of all available tools in their decision-making process to ensure the associated regulatory and reputational risks of every business relationship align with a company’s goals, ethics, and broader risk calculus.
Tools of the trade
Despite the Foreign Corrupt Practices Act being decades old, and in spite of the costs associated with major reputational hits, companies continue to fall short on risk oversight for international business transactions and partnerships. Therefore, a proper understanding of the toolsets and third-party resources available is vital to employing due diligence effectively as part of a broader risk management framework.
Enhanced due diligence can be broken down into three distinct tiers, beginning with open source intelligence (OSINT), colloquially understood as the collection of publicly available information. OSINT is perhaps the most naturally transferable technique to the corporate world, where teams of analysts can create threat assessments, conduct public record searches, and compile basic media profiles and social media linkages all from a seat at their desk. This is not however, most private sector organizations’ core business, often requiring the outsourcing of these investigations to third-party providers.
Next is the breadth of information tapped on the deep/dark web. While sometimes used for nefarious purposes like the sale of illegal products, it also serves as an important tool for dissidents living in countries that heavily restrict online freedom. For skilled investigators, all this can prove a goldmine. Using a number of tools, they can scour the far reaches of the deep/dark web through custom data streams and filters, translating local languages, and analyzing the sentiment behind what people say in secret. This can lift the veil, providing a clearer view of individuals or companies in hard to access areas, well beyond what local media outlets are able to report. The dark web carries risks and requires years of expertise to navigate, making third-party outsourcing a common practice for this type of intelligence collection.
Lastly, today’s world still requires human intelligence (HUMINT) to conduct local source verifications. This sometimes substantiates findings discovered on the Internet, but often uncovers new facts not available publicly, especially in countries with a low watermark for public disclosure. HUMINT, the staple of intelligence agencies like the CIA, leverages elements of tradecraft largely employable in the corporate world, within the bounds of obvious legal parameters like intellectual property theft. HUMINT can also provide a level of context to web findings, creating a narrative as to the person or corporation in question, inclusive of their reputation and political exposure. These elements are much more difficult to find, analyze, and disseminate, making HUMINT the intelligence tool of last resort.
Enhanced due diligence often operates behind the scenes in order to maintain access and protect sources and methods. Despite this, there is a clear need in the marketplace for these techniques, perhaps more so in the information age than at any point in history. As long as companies venture abroad seeking new market opportunities, favorable demographics for consumer goods, or access to resources, they will continue to link with firms falling under different flags, customs, and legal regimes. Mistakes and ill-conceived ventures can prove costly. Leveraging the unique toolsets of the intelligence world can help.
Brogan Ingstad is a Senior Analyst in the Chertoff Group's Strategic Advisory Services practice, where he specializes in threat assessments and investigative due diligence.