AI Third-Party Due Diligence Writing Guide 2026: A Structured Framework for Risk Tiering, Investigation Process, and Compliance Review

A third-party due diligence policy is not a vague requirement to "conduct background checks on suppliers" — it is a risk control document that determines which third parties require due diligence, what to investigate, and how to handle identified risks. The problem with most third-party due diligence policies is that risk tiering is written vaguely ("high-risk suppliers require due diligence" — what counts as high-risk? large amounts? sensitive industries?) and investigation content is fuzzy ("investigate compliance status" — investigate what? how? what to do when problems are found?). The biggest trap when using AI to write a third-party due diligence policy is asking it to "write a standard due diligence template" — different third-party types (suppliers/agents/distributors/partners) have significantly different risks. What's useful is quantifying your actual third-party types, risk scenarios, and due diligence resources.

I. The Five-Element Structure of Third-Party Due Diligence

An enforceable third-party due diligence policy contains five elements: Third-Party Definition and Classification (what counts as a third party — suppliers/agents/distributors/partners/outsourcers/joint venture partners; classification standards), Risk Tiering (which third parties require due diligence — risk tiering standards: amount/industry/geography/business nature), Due Diligence Content (what to investigate — entity qualifications/financial status/compliance records/business reputation/affiliation relationships), Due Diligence Process (how to investigate — self-assessment questionnaires/document review/on-site investigation/third-party reports/continuous monitoring), and Risk Handling (what to do when problems are found — risk acceptance/risk mitigation/refuse cooperation/terminate cooperation). The five elements are sequential: without defining third parties you don't know who to investigate, without tiering resources are misallocated, without content the investigation is superficial, without process it can't be executed, without risk handling due diligence is wasted.

"I need to write a third-party due diligence policy for [company type/industry/third-party types]. Here are the third-party types and known risk cases: [paste]. Please organize by five elements: 1.Third-Party Definition and Classification (suppliers (raw materials/equipment/services)/agents (sales agents/channel agents)/distributors/partners (technology cooperation/market cooperation)/outsourcers (IT outsourcing/labor outsourcing)/joint venture partners) 2.Risk Tiering (high-risk: annual transaction amount ≥5M RMB/anti-corruption high-risk industries (construction/pharmaceuticals/government relations)/high-risk geography (corruption-prone countries)/new business areas; medium-risk: annual transaction amount 1-5M RMB/general industries/general geography; low-risk: annual transaction amount <1M RMB/standardized products/low-risk geography) 3.Due Diligence Content (entity qualifications: business license/operating permits/industry qualifications; financial status: last 3 years financial statements/credit ratings/litigation records; compliance records: anti-corruption/AML/data protection/labor law violation records; business reputation: industry reputation/client reviews/media reports; affiliation relationships: whether they have kinship/investment relationships with company employees) 4.Due Diligence Process (high-risk: self-assessment questionnaire + document review + on-site investigation + third-party background investigation report; medium-risk: self-assessment questionnaire + document review; low-risk: self-assessment questionnaire) 5.Risk Handling (risk acceptance: risk controllable with mitigation measures; risk mitigation: require third-party rectification + add contract clauses +加强 monitoring; refuse cooperation: risk uncontrollable (bribery records/major violations); terminate cooperation: major violations discovered during cooperation). Tiering standards must be quantified."

II. Risk Tiering: Four-Dimension Assessment

Risk tiering is the basis for allocating due diligence resources — without tiering, high-risk slips through and low-risk wastes resources. Four-dimension assessment: Transaction Amount (high-risk: annual transaction amount ≥5M RMB; medium-risk: 1-5M RMB; low-risk: <1M RMB), Industry Risk (high-risk: anti-corruption high-risk industries (construction/pharmaceuticals/medical devices/government relations/energy); medium-risk: general manufacturing/services; low-risk: standardized products/office supplies), Geography Risk (high-risk: corruption-prone countries/sanctioned countries/offshore financial centers; medium-risk: general countries; low-risk: local/low-risk countries), Business Nature (high-risk: involving government approvals/licenses/sensitive data/critical infrastructure; medium-risk: general business cooperation; low-risk: pure commodity transactions). Composite rating = highest tier across four dimensions — any dimension high = composite high. High-risk third parties require comprehensive due diligence, medium-risk simplified due diligence, low-risk self-assessment questionnaire.

"Here are the third-party list and business distribution: [paste]. Please detail by four dimensions + rating: 1.Transaction Amount (①high-risk: annual transaction amount ≥5M RMB (accounts for ≥10% of company procurement/sales) ②medium-risk: annual transaction amount 1-5M RMB (accounts for 1-10%) ③low-risk: annual transaction amount <1M RMB (accounts for <1%) ④data: export annual transaction amounts from financial system) 2.Industry Risk (①high-risk: construction (bribery-prone)/pharmaceuticals/medical devices (kickback-prone)/government relations (corruption-prone)/energy (license corruption) ②medium-risk: general manufacturing/services/trade ③low-risk: standardized products/office supplies/low-risk services ④basis: industry corruption index (e.g., Transparency International industry reports)) 3.Geography Risk (①high-risk: corruption-prone countries (Transparency International CPI <50)/sanctioned countries/offshore financial centers ②medium-risk: general countries ③low-risk: local/low-risk countries (CPI ≥50) ④basis: Transparency International CPI/sanctions lists) 4.Business Nature (①high-risk: involving government approvals/licenses/sensitive data/critical infrastructure/monopoly resources ②medium-risk: general business cooperation/technical support/market cooperation ③low-risk: pure commodity transactions/standardized services ④basis: whether business involves public power/sensitive resources) 5.Composite Rating (highest tier across four dimensions: any dimension high = composite high/any medium = composite medium/all low = low). Generate rating matrix: third party|amount|industry|geography|business nature|composite rating|due diligence requirement."

III. Due Diligence Content and Process: Tiered Investigation

Due diligence content is the key to discovering risks — what you investigate determines whether you can find problems. Five content areas: Entity Qualifications (business license/operating permits/industry qualifications — verify authenticity and validity), Financial Status (last 3 years financial statements/credit ratings/litigation records/bankruptcy records — assess履约 capability), Compliance Records (anti-corruption/AML/data protection/labor law/environmental/tax violation records — assess compliance risk), Business Reputation (industry reputation/client reviews/media reports/administrative penalties — assess reputation risk), Affiliation Relationships (whether they have kinship/investment/other interest relationships with company employees — assess conflict of interest risk). Due diligence process tiered: High-Risk (self-assessment questionnaire (third party fills out) + document review (business license/financial statements/compliance certificates) + on-site investigation (field visit to office premises/production facilities/interviews with management) + third-party background investigation report (engage professional firms (e.g., Dun & Bradstreet/Experian) to issue background investigation reports)), Medium-Risk (self-assessment questionnaire + document review), Low-Risk (self-assessment questionnaire).

"Here are the third-party list and due diligence resources: [paste]. Please detail by tiered investigation: 1.High-Risk Due Diligence (①self-assessment questionnaire: third party fills out enterprise information/equity structure/compliance records/affiliation relationships — questionnaire回收率100% ②document review: business license/operating permits/last 3 years financial statements/compliance certificates (anti-corruption/data protection)/litigation records — verify document authenticity ③on-site investigation: field visit to office premises/production facilities/interviews with management — assess actual operational status ④third-party background investigation: engage professional firms (Dun & Bradstreet/Experian) to issue background investigation reports — including credit ratings/compliance records/litigation records/media reports ⑤timeline: high-risk due diligence completed within 30 days ⑥approval: due diligence report requires compliance director approval) 2.Medium-Risk Due Diligence (①self-assessment questionnaire: same as high-risk ②document review: business license/operating permits/compliance certificates ③timeline: completed within 15 days ④approval: due diligence report requires compliance department approval) 3.Low-Risk Due Diligence (①self-assessment questionnaire: simplified questionnaire (basic enterprise information/compliance declaration) ②timeline: completed within 7 days ③approval: business department approval) 4.Continuous Monitoring (①annual review: high-risk third parties annual review (update questionnaires + documents) ②triggered review: negative news/litigation/compliance violations discovered → immediate review ③monitoring channels: media reports/regulatory announcements/litigation databases/internal whistleblowing) 5.Risk Handling (①risk acceptance: risk controllable (minor violations rectified/litigation amounts small) with mitigation measures (add contract clauses/加强 monitoring) ②risk mitigation: require third-party rectification (rectify compliance issues within deadline) + add contract clauses (anti-corruption clauses/audit rights/termination rights) + 加强 monitoring (increase review frequency) ③refuse cooperation: risk uncontrollable (bribery records/major violations/unable to provide necessary documents) ④terminate cooperation: major violations discovered during cooperation (bribery/data breaches/major litigation) — immediate termination + loss recovery + legal action). Generate due diligence workflow: tier → questionnaire → documents → on-site (high-risk) → third-party report (high-risk) → assess → approve → cooperate/refuse → continuous monitoring."

IV. Common Mistakes Checklist

• Risk tiering written as "high-risk suppliers require due diligence": not executable. Fix: four-dimension quantified standards (amount ≥5M/high-risk industry/high-risk geography/sensitive business)
• Due diligence content written as "investigate compliance status": too vague. Fix: five specific content areas (entity qualifications/financial/compliance/reputation/affiliation relationships)
• Only self-assessment questionnaire, no document review: self-assessment not credible. Fix: high-risk requires document review + on-site investigation + third-party report
• No risk handling after due diligence: problems found but still cooperate. Fix: four risk handling methods (acceptance/mitigation/refusal/termination)
• No continuous monitoring: due diligence done once and forgotten. Fix: annual review + triggered review
• No conflict of interest review: employee relatives as suppliers not checked. Fix: affiliation relationship review (kinship/investment relationships with company employees)
• Due diligence records not retained: can't trace. Fix: questionnaires + documents + reports + approval records all retained ≥7 years

V. Complete Example

Company: Manufacturing enterprise third-party due diligence policy (excerpts tiering + content + process).
Tiering: ①High-risk — annual transaction amount ≥5M RMB or construction/pharmaceutical industry or corruption-prone country or involving government approvals — comprehensive due diligence ②Medium-risk — annual transaction amount 1-5M RMB or general industry — simplified due diligence ③Low-risk — annual transaction amount <1M RMB or standardized products — self-assessment questionnaire.
Content: Entity qualifications (business license/permits/qualifications verification), financial (last 3 years statements/credit ratings/litigation), compliance (anti-corruption/data protection/labor law violations), reputation (industry reputation/client reviews/media), affiliation relationships (kinship/investment relationships with company employees).
Process: High-risk — self-assessment questionnaire + document review + on-site investigation + third-party background investigation report (Dun & Bradstreet), completed within 30 days, compliance director approval; Medium-risk — questionnaire + documents, 15 days, compliance department approval; Low-risk — simplified questionnaire, 7 days, business department approval.
Continuous Monitoring: High-risk annual review + triggered review (negative news/litigation/violations).
Risk Handling: Risk acceptance (controllable + mitigation measures)/risk mitigation (rectification + contract clauses + 加强 monitoring)/refuse cooperation (bribery records/major violations)/terminate cooperation (major violations discovered during cooperation — immediate termination + loss recovery + legal action).

This article focuses on third-party due diligence policy writing. When building a complete compliance system, also see AI Vendor Management Agreement Writing Guide (contract clause design), AI Due Diligence Report Writing Guide (due diligence report writing), and AI Anti-Corruption Policy Writing Guide (third-party anti-corruption clauses).

Frequently Asked Questions

Q1: Do small suppliers (annual transaction amount 100K RMB) also need due diligence?

It depends on risk, not just amount. Although annual transaction amount <1M RMB is typically rated low-risk (only self-assessment questionnaire required), the following situations require upgrading the risk level even for small amounts: ①High-risk industry — construction/pharmaceutical industries require medium-risk due diligence even for small amounts (bribery-prone industries) ②Sensitive business — involving government approvals/sensitive data requires high-risk due diligence even for small amounts ③High-risk geography — corruption-prone countries require upgraded rating even for small amounts ④Affiliation relationships — if the small supplier is owned by an employee's relative, requires medium-risk due diligence even for small amounts (conflict of interest risk). Conversely, if the amount is large but risk is low (e.g., standardized office supplies procurement, annual transaction amount 2M RMB), can be rated medium-risk (simplified due diligence) rather than high-risk. Key: amount is only one of four dimensions, not the only criterion. Composite rating = highest tier across four dimensions — any dimension high = composite high.

Q2: Must third-party background investigation reports be from professional firms?

High-risk third parties must engage professional firms (e.g., Dun & Bradstreet/Experian); medium and low-risk can be investigated internally. Reasons: ①Professionalism — professional firms have databases (credit ratings/litigation records/compliance records/media reports) that internal investigation cannot access ②Independence — professional firms are independent of both the company and the third party, making investigation conclusions more objective ③Efficiency — professional firms issue reports quickly (7-15 days), internal investigation is slow ④Cost — high-risk third parties have large transaction amounts (≥5M RMB), due diligence costs (third-party reports ~10-30K RMB) are a small percentage (<1%), worth the investment. Medium-risk third parties (1-5M RMB) can be investigated internally (questionnaire + document review); if internal investigation reveals concerns, then engage professional firms. Low-risk third parties (<1M RMB) internal simplified questionnaire suffices. Key: don't skip professional investigation for high-risk third parties to save costs — internal investigation cannot access credit ratings/litigation records/global compliance records, potentially missing major risks.

Q3: Due diligence found the third party has bribery records but has rectified — can we still cooperate?

Case by case: ①Timing of bribery records — if bribery records are from 5+ years ago and rectified (established compliance system/punished responsible persons/no new violations), can consider cooperation but require risk mitigation measures ②Rectification evidence — require third party to provide rectification evidence (compliance policies/training records/audit reports/penalty decisions), not just verbal promises ③Risk mitigation — if deciding to cooperate: add contract anti-corruption clauses (prohibit bribery/audit rights/termination rights) + 加强 monitoring (increase review frequency from annual to semi-annual) + require third party to provide annual compliance reports ④Approval — such high-risk cooperation requires compliance director approval, consult external legal counsel if necessary ⑤Alternative options — assess whether other third parties without bribery records are available; if yes, prefer risk-free third parties ⑥Records — due diligence findings + rectification evidence + risk mitigation measures + approval records all archived. Key: third parties with bribery records even after rectification still have higher risk than those without records — must risk mitigate + 加强 monitor, cannot treat as risk-free third parties. If bribery records are within the last 2 years or rectification evidence is insufficient — refuse cooperation.

Author: UseAIWriter Editorial | Updated: 2026-10-27 | Written by UseAIWriter Editorial. Please cite the source when reposting.