In light of our recent partnership with Ground Truth Intelligence (GTI) and their integration into the Aravo platform, we held a LinkedIn live with Aravo’s Loren Johnson, and GTI’s Matthew Hunt, to discuss the recent collaboration and the importance of due diligence in TPRM.
Loren Johnson: Hello, I am the Senior Director of Product Marketing at Aravo, the leading third-party risk management software and solutions provider, and I am joined today by Matthew Hunt of Ground Truth Intelligence.
Matthew Hunt: Ground Truth Intelligence is the global due diligence platform, designed for changing the world. Our CEO, Stewart Kelly, our CISO, Patrick Carter, and I founded Ground Truth Intelligence about four and a half years ago. Stewart and I come from investigative due diligence, specifically EDD (Enhanced Due Diligence), backgrounds as investigators. Patrick comes from an application security and software development background.
We felt that the investigations domain expertise would really benefit from a greater application of technology. So, it’s that hybrid combination, which is quite unique with GTI. The best of human expertise and the best of technology and digitization.
We leverage that to serve third-party risk professionals, and we have a platform that’s an engine within the Aravo context to serve Aravo clients seamlessly through the API, and that’s quite unique in our space.
Loren: You offer due diligence solutions services for companies that work through Aravo and some of your other partnerships. The DOJ in the US has published some recommendations about how to best use due diligence in a third-party risk program. One thing they say is to use a reasonable, risk-based approach to dive into additional information about a third party.
Matthew: I think that’s a fair average, I’d agree with you there. The devil’s in the detail, right? We see within that there’s a great variation, and you eventually get to that average. But depending on, I’d say the three main areas: the sector that the company operates in, how politicized it is, and the nature of those third-party relationships.
Are they very close relationships, or strategic? Are they sales agents or are they at the other end of the spectrum, like virtual relationships that are not that close? The jurisdictions that you operate in as well can make it vary greatly. Those that are on the transparency international lists, say for example.
There are more measures, those are more corrupt, less transparent, subject to sanctions, more regulations, and you’re going to want to do a lot more due diligence than those in mature, domestic markets that you understand better. Based on that, it could be as low as 2-5% or as high as 70-80% perhaps.
For example, if you’re in aerospace and defense and you’re working closely with sales agents in parts of the world that we know are more challenging from that perspective. So, there’s some heavy caveats there but that’s a fair overall average.
Loren: I think that’s spot on. It really depends. 20% is maybe fair, but there’s a bell curve for what really works. With Aravo, you’re offering four different scales of analysis and due diligence you can deliver for our customers.
Matthew: So, there are four different offerings, and within that there are just three different levels of reports, with two different types of desktop. One covers one entity and the other is a combination of the entity itself and its subjects and it’s a bit of a package.
The main differences are where we are getting our data from. As stated before, our signature strength is the hybrid combination of the best of human expertise in our global network of 2000+ researchers around the world who can get multilingual information, access the right records, ethically and legally, and the digitized data and information we leverage to produce our reporting.
So, with the desktop, you’re really getting everything that a well-trained, experienced person can access through public records, open-source web domain, etc., but you don’t necessarily have to leave that terminal to access the information. So that’s pretty quick, lower cost reporting.
Then you go one level in and you’re into the in-country. That’s everything in that desktop scope. So, it covers all the main bases, like sanctions, adverse media, online corporate records, beneficial ownership, litigation, bankruptcy, positive media search, etc. But with that in-country report, you’re also going into the offline corporate registries that you can only access through having a person on the ground or somebody who’s in that country who has the right access.
Matthew: Yes, finally, with that enhanced due diligence report, which is the approach for your highest risk entities you cover, it includes everything above with the in-country, plus an in-person site visit to the main business operation and discrete, human source inquiries with people on the ground. Obviously, that’s also part of the DOJ Comprehensive Guidance.
Loren: This is a very dynamic market. TPRM has been evolving quickly recently, and there’s a lot of new risks and people are understanding that their third parties represent the risks of the organization.
What we call 21st century risks are things like cybersecurity, InfoSec, ESG, sustainable supply chains, and AI, which are creating new challenges for companies who are trying to assess their third parties. Due diligence is needed to determine where the risk is to their organization and where they need to do due diligence to discover what these companies are doing in these spaces.
Matthew: Yes, and it’s expanding all the time. The great thing about GTI is we can customize your reports. We are seeing this in all the areas you mentioned. At the moment, this is being done on a proactive, voluntary basis since the regulation isn’t necessarily as clear in the same way the DOJ is.
But we’re getting clients that realize these gaps, and it makes sense for a diligence company to be gathering this information too and looking at their risk exposure. We’re seeing the regulation start to really bite in some of these areas such as supply chain and human rights, with Norwegian Supply Chain Act, and German and EU equivalents coming in. So, you’ve got both that proactive element where clients are looking to do this, and on the other side, it’s starting to become obligatory too.
Loren: Not only legislation, but you have a lot of pressure from activists, stakeholders, shareholders, and others who are looking for more transparency and more reporting.
Matthew: We really enjoy our partnership with Aravo and are looking forward to deepening it and supporting you and your clients.
This interview has been edited for length and clarity.
Share with Your Friends:
