A questionnaire for the supplier, agent or partner to complete and for you to assess, covering bribery, fraud, tax evasion and modern slavery in one set of questions, with a scoring page so a red flag goes somewhere.
“The global leaders in whistleblowing software”
As seen in:
Fulham F.C.
Three UK failure to prevent offences (bribery, facilitation of tax evasion and, for large organizations, fraud) each treat due diligence as a prevention procedure, and a Modern Slavery Act statement may report on the due diligence you do. This questionnaire asks about all four once, so the supplier answers one document and you keep one record.
Section 1 says what counts as a red flag and where it goes. Section 14 turns the answers into a risk tier, a decision, conditions and a review date. A questionnaire that is filed unread is evidence against you, not for you.
Sections 2 to 13 are written for the supplier to complete, with the evidence to attach beside each question. Section 14 is for you. The same document is the request, the answer and the decision.
[Procurement or the compliance team] sends this questionnaire to a supplier, agent, distributor or partner before we contract, before we renew, and on a trigger event: a change of ownership, a new country, adverse media, or a concern raised by one of our people. The third party completes sections 2 to 13 and attaches the evidence named beside each question. [The compliance team] completes section 14.
The depth is proportionate to the risk. Principle 4 of the Ministry of Justice guidance on the Bribery Act 2010 asks for a proportionate and risk-based approach to the people who perform services on the organization's behalf, and section 3.4 of the Home Office guidance on the failure to prevent fraud offence, which applies to large organizations, asks for the same for fraud. A UK stationery supplier may answer sections 2, 4, 9 and 13 only; an agent dealing with a government for us answers everything.
Scoring: each question is answered yes, no or not applicable, with evidence. A no to a control question, a yes to an investigation, sanctions or politically exposed person question, a refusal to answer, or evidence that contradicts the answer is a red flag. One red flag means review by [the head of compliance] before signature. Two or more, or any in sections 4 or 5, means the decision goes to [the risk committee].
The signatory confirms that they are authorized to sign, that the answers are complete and accurate to the best of their knowledge, that they will tell us within [10 working days] of any change that would alter an answer, and that we may verify and rely on the answers.
Privacy: sections 4 to 6 ask about convictions, charges and investigations involving individuals. That is criminal offence data, which UK data protection law allows us to process only with a lawful basis under Article 6 of the UK GDPR and a condition under Schedule 1 to the Data Protection Act 2018 [for example, the conditions for preventing or detecting unlawful acts, or regulatory requirements relating to unlawful acts and dishonesty], backed by [an appropriate policy document]. We ask for it only to assess bribery, fraud and financial crime risk, keep it to [the compliance team], hold it securely and delete it [period] after the relationship ends unless a legal requirement means we must keep it longer. Give only what the question needs, and tell the individuals concerned that you are sharing it. Our [privacy notice] has the details. [Confirm the basis and condition with your data protection officer, or remove the questions about individuals.]
Completed by [the compliance team], kept with the evidence, and not shared with the third party.
A starting point to adapt to your organization, not legal advice.
A completed questionnaire is a pile of claims. These six steps turn it into a decision you can defend.
Book a demoDecide the inherent risk first: the country, the sector, whether the third party will meet officials for you, the contract value, and whether they are an intermediary. Low risk gets the short set; high risk gets the full questionnaire and a verification plan. Record the tier and the reason.
Every question says what to attach. Send the questionnaire with a deadline, a named contact and the message that a missing attachment counts as an unanswered question.
Check the registry extract against the names given. Screen every owner and director against sanctions and politically exposed person lists. Run an adverse media search. For high risk, take references or visit. The questionnaire tells you what they say; verification tells you whether it is true.
Go through it section by section. Mark each red flag, record what the evidence showed and whether it was resolved. One red flag goes to the head of compliance; two or more, or any in sanctions or bribery, goes to the committee. The route is in section 1; follow it even when the deal is urgent.
Approve, approve with conditions, decline or escalate, with a name and a date. Conditions are specific: an audit right, a bar on subcontracting, a named owner on our side who meets them quarterly. Put the conditions in the contract, not in an email.
Refresh on a schedule by tier and on any trigger: a change of ownership, a new country, a news story, a concern raised by one of your people. Keep the questionnaire, the evidence, the screening results and the decision in one record, so the next reviewer starts from what you knew.