In anti-corruption and anti-bribery compliance, what does the process of 'due diligence' primarily entail?

In anti-corruption compliance, under laws like the U.S. Foreign Corrupt Practices Act and the UK Bribery Act, due diligence is the investigative process used to assess the risk profile of third parties before and during a business relationship. The correct approach is conducting background checks, risk assessments, and monitoring of third parties to ensure they do not engage in corrupt practices, because organizations can be held liable for bribes paid by third parties acting on their behalf. Due diligence requires gathering information, assessing risk, and monitoring third-party activities to prevent corruption. This process should be risk-based, meaning higher-risk regions or business structures require more extensive scrutiny. Due diligence typically involves background checks, questionnaires, reference checks, and financial monitoring. The approach that calls for a strict policy forbidding any international trade or foreign business partnerships is incorrect because anti-corruption laws do not prohibit international business, but rather require that it be conducted ethically and legally; avoiding all international trade is an extreme measure that is unnecessary for compliance. The approach that calls for expediting transactions by automatically paying all minor facilitation fees requested by foreign officials is incorrect because paying facilitation payments without questioning is a major compliance risk and is illegal under many anti-corruption regimes, such as the UK Bribery Act, and highly discouraged under the U.S. Foreign Corrupt Practices Act. These payments, often called 'grease payments,' must be strictly controlled and phased out. The approach that calls for relying entirely on a third party's general reputation and self-certifications without independent verification is incorrect because self-certification and reputation are insufficient; due diligence requires independent, risk-based verification to show that the company took reasonable steps to prevent corruption, and relying on reputation alone does not meet regulatory expectations. A thorough due diligence workflow is not a one-time event; it is an ongoing process. Throughout the lifecycle of the business relationship, compliance teams must periodically refresh their checks, monitor transaction records for red flags, and ensure that the third party continues to adhere to the company's code of conduct. This proactive monitoring provides the company with a strong defense if a third party engages in corrupt behavior.