Every third-party screening program produces the same artifact at the end of the process: A rating of low, medium or high. What that rating almost never comes with is an instruction. A "High" result tells a reviewer that something is worth a second look, but not what kind of look, how deep it should go, or who should be doing it. For compliance and risk teams, the gap between *flagged* and *escalated* is where defensibility is won or lost.
Regulators have been consistent on one point: there is no single due-diligence standard that applies to every third party. The DOJ's 2020 guidance to prosecutors on evaluating corporate compliance programs ties program credibility directly to whether risk-based analysis is actually integrated into the business process, not just documented on paper.
In practice, that means every third party needs to land in a risk tier before anyone decides how hard to look at it, and that tier should drive the scope of diligence, not the other way around.
The tiering itself follows a short set of consistent questions:
A low-risk vendor might clear with a global database check. A high-risk reseller representing your brand in an unfamiliar market needs a materially different level of scrutiny, and that difference is the escalation decision.
Once a file crosses into "high-risk," the work changes in kind, not just in volume. Investigative due diligence looks at the nature of the services being delivered, shareholder and management identification, relationships with government officials, the third party's own use of intermediaries, historical compliance issues, conflicts of interest, and internal control structures.
It also means going beyond self-reported information: On-site visits, criminal and litigation record checks, local-language media review and verification of beneficial ownership, because Politically Exposed Persons rarely surface in a standard database check or a company's own website.
Effective escalation depends on disciplined sequencing. High-risk files should be investigated first, with the bulk of the budget; lower-risk files can wait. Regulators have indicated this allocation, not blanket deep-dives, is what they view favorably.
Finishing the investigation is only one step. The escalation remains open until the red flag has been addressed and the outcome documented. Sometimes that means walking away. More often, it means remediation: additional contract terms, audit rights, certifications, or targeted training.
Regulators expect that resolution to be auditable, with a consistent, documented process that can be traced beyond an individual’s inbox. Equally important is tracking red flags over time, so a vendor that was declined or terminated for cause doesn't quietly reappear under a different engagement.
Risk profiles aren't static. A vendor onboarded as low-risk can become high-risk as the relationship, geography, or ownership changes, which means the escalation framework has to run on an ongoing cycle, not just at intake.
The 2020 FCPA Resource Guide and DOJ guidance both frame this the same way: a credible program is judged on how it responds to new information, not just how it screens on day one.
Applying this framework consistently is often harder than defining it. Even with clear DOJ and SEC guidance, teams still have to triage large numbers of vendors without allowing capacity or competing priorities to shape escalation decisions.
Automated screening can make that process more manageable by showing reviewers which risk factors contributed to a rating. Files requiring further judgement can then be routed to analyst-led investigation, with the findings returned to the vendor record to create a complete, auditable trail.
A strong escalation program directs investigators to the files that genuinely require their expertise. For each of those files, the organization needs a defensible record showing what was known, when it became known and how the issue was addressed.
Not sure whether your current process is making that call consistently? Diligent's Due Diligence Services pair analyst-led investigation with the same risk framework outlined above, so escalation decisions hold up under regulator and board scrutiny alike.
