A compliance officer at a tech firm is upgrading the vendor onboarding process. They want to ensure they avoid common pitfalls during third-party due diligence. Which of the following represents a significant pitfall to avoid?

Third-party due diligence is a critical component of any effective anti-corruption and compliance program, particularly under regulations like the U.S. Foreign Corrupt Practices Act and the UK Bribery Act. Regulators consistently emphasize that due diligence must be risk-based. One common pitfall in compliance programs is failing to scale the diligence to the risk level of the third party. The significant pitfall is applying a standardized, uniform due diligence questionnaire to all third parties regardless of their geographic location or risk profile. This rigid, 'one-size-fits-all' approach is a major pitfall because it leads to two serious problems: it wastes valuable compliance resources on low-risk vendors, like local office supply vendors, and, more dangerously, it often fails to identify complex, high-risk red flags associated with foreign intermediaries, customs agents, or joint venture partners. By contrast, utilizing a multidisciplinary team of legal, financial, and operational experts to review high-risk intermediaries is not a pitfall; it is a best practice, as it ensures that financial, legal, and operational risks are thoroughly analyzed. Tailoring the depth and intensity of the investigation to match the specific risk level of the third party is not a pitfall; it is the definition of a risk-based approach, which is the gold standard in compliance. Performing the preliminary risk assessment before signing the contract or starting the business relationship is not a pitfall; it is a fundamental requirement. Performing it post-contract is a major risk, not a best practice.