1. Third-Party Due Diligence Integrating In-house Technology and Outside Services Providers

2. Agenda  Brief Introduction of Speakers  Evolving Third-Party Risk Management Standards  Engaging Third-Party Providers  Q&A

3. Today’s Evolving Standards  Companies are integrating basic to advanced technology platforms to monitor third-party relationships  Creates a repository of key, auditable data  Maintains approval limits and accountability  Back-end risk methodology to assign risk ratings  Contract database that maintains integrity of document versions showing of risk analysis  Integration of guidance when to engage an outside due diligence provider

4. Sample Technology Workflow

5. Engaging Third-Party Providers Providers:  Build upon work already completed by in-house systems to avoid inefficient duplication of work  Enhance in-house due diligence by extending its reach to hard-to-find records and human intelligence  Communicate findings clearly with a defined scope of work to help you internalize our work

6. Cost-Effective Scope of Work  Level 1: Public Records / Database Research  Suitable for low- to medium-level risk targets  Verification of bona fides disclosed in the Questionnaire  Thorough review of publicly available documents such as corporate records, court records and local media  Tailored scope to suit in-house pricing needs and avoid duplicative work  Level 2: Human Source Inquiries  Suitable for medium- to high-risk targets  Ongoing Role  In-house teams need to refresh due diligence periodically  Costs can be kept down by going to the same outside provider every two years rather than engaging someone new each time

7. When Intelligence Matters Significant questions are unanswered in the public. Examples:  Is the ongoing investigation/litigation involving our potential agent likely to lead to any risk-relevant actions or sanctions?  A tabloid described our agent as a corrupt arms dealer, but he says that it’s not true and he’s never been convicted of wrongdoing.  Is the John Smith cited on the OFAC list the same John Smith we’re engaging? It’s a common name and there’s limited public information.  Is our agent going to fall out of favor with when the government changes after the election, and what would that mean for our business?

8. Human Sources Thorough Level 2 due diligence includes speaking with knowledgeable sources from three broad angles:  Government sources with knowledge of past or current investigations and official actions  Industry sources that are familiar with subject’s reputation within the field  Professional sources such as business consultants, lawyers and journalists that have researched the subject before or can provide broader context

9. Questions? Michael HarringtonGreg Shultz, Managing Director www.thecompliancetable.com gshultz@thecompliancetable.com mintzgroup.com mharrington@mintzgroup.com