Dr. Ritu Insan Dahiya (rituinsa@gmail.com) has worked as Head of Department and faculty of the Shah Satnam Ji Institute of Technology and Management at Chaudhary Devi Lal University in Sirsa, Haryana, India.

The aftermath of the frauds and bankruptcies at Enron and WorldCom led to a rapid increase in regulatory requirements for businesses. In response, companies began to embrace an approach called enterprise risk management (ERM), which assesses risk in a comprehensive, company-wide manner. ERM gathers together information on risk to create a larger picture, which allows organizations to uncover risks that affect multiple departments and address them together. Furthermore, consolidating risk reporting enables companies to create standards and more efficient processes for recognizing and mitigating risk. This is a departure from the less cost-effective “silo” approach used by businesses, which leaves separate departments and business segments to deal individually with their own specific tasks.

Performing risk-based due diligence on intermediaries has become a critical practice for companies to confidently mitigate third-party risks. Assigning the appropriate level of due diligence for the company’s third parties requires assessing risks objectively and systematically. In order to build a credible and practical risk model, company executives must understand how the company operates across its business units, regions, and subsidiaries.

While debate remains around how much due diligence to conduct and how often, there is no debate as to the necessity of conducting risk-based third-party due diligence. That leaves compliance professionals in a precarious position. Despite the fact that there is consensus in the market that a risk-based approach represents a best practice, there is clearly confusion as to what constitutes a risk-based approach.