More haste less speed will get better results when managing third party risk

The National Audit Office investigation into Covid 19 procurements (report issued on 16th November) is instructive and critically important. Reading between the lines I get a sense of utter panic at the heart of government with impaired thinking taking control and cool heads hard to find.

The report itself is ruthlessly focused upon process. Its steers as far as it can away from any findings that may be too contentious. But the dirty washing is all there nevertheless, whether by design or chance.

Its statements on risk talk about the potential for unequal treatment of suppliers ; a lack of transparency ; and poor documentation processes. These are indeed failings, but the real underlying risk (which is never mentioned in so many words) is that because the procurement process is not always based upon merit, the tax payer could get screwed – as has clearly happened in one or two instances. The biggest risk of all, though, is that trust in government gets another hole below the waterline. And we all know the properties of leaking hulks.

As has already been noted by some commentators, understanding the logic giving life to some processes (introduced to meet the exigencies of Covid 19), requires a headstand. The “high priority” lane is the hardest to comprehend.

Firstly, why was it needed at all ? Of the over 15,000 direct offers to supply PPE (and other Covid essentials), only 493 went through the high priority lane, and the remaining 14,892 went through the normal lane. Given this dynamic you might be forgiven for thinking the normal lane was perfectly able to handle another five hundred (500) odd cases between April and October 2020 !

But the big head spinner is the high priority lane inversion of risk controls – which made higher risk offers easiest to push through. The high priority lane was specifically for recommendations from Ministers, MPs, members of the House of Lords, and other Senior officials, especially health officials. In other words the highest risk category from a corruption and conflict of interest perspective had the lowest level of scrutiny (and even lower if they kept the contract to below GBP 5 million). What’s more the approval ratio was 10% for this high priority channel compared to 1% of offers in the normal channel. Little wonder some questionable deals were done.

Even where processes and controls were (at least on paper) akin to what most risk managers would recognise, few bear even limited scrutiny. “Due diligence” (whatever that was) was performed only after it was decided whether (i) the source was credible (in most cases this was an intermediary), (ii) whether the supplier or suppliers were credible and, (iii) whether there was any reason to suspect fraud or being out-bid.

The report didn’t say how these conclusions were reached in most cases – though it did say in many cases documentation was too thin to know. Whatever the case, such decisions preceded due diligence, and due diligence would only be performed if these questions were satisfactorily answered (or not as appears).

So what was the scope of due diligence ? It looks to have included the suppliers’ directors, and the supplier itself. It is not clear from the report whether it included beneficial owners as well, but there are grounds for believing it did not. If that is correct, it is hard to see how conflicts of interest were properly assessed.

One of the most telling indicators of inadequacy is the speed with which due diligence was being completed. The report mentions due diligence was being turned around within four hours. I’m assuming too that they were dealing with a host of local languages, especially Chinese (the ultimate source of much PPE). If this information is correct perhaps the UK government could tutor the world how to perform research so efficiently.

Maybe due diligence was no more than a tick box checklist based on a few public domain searches in English. If so they forgot to scrutinise what was in front of them, and assess that too. A company called Ayanda Capital Ltd. was introduced by a Senior Advisor to the Board of Trade. In addition to the introduction, the Senior Advisor dealt directly on behalf of Ayanda with various government departments on matters of payment and publicity. Even when the advisor declined publicity offered by the Press office of the Department of International Trade (a red flag surely !), nothing registered in due diligence.

As it was, Ayanda sailed through the high priority lane without any mention of a conflict of interest overshadowing its GPB 253 million PPE contract. Indeed one of the reasons Ayanda was considered suitable was because it “had access to international banking channels” ! I think that means it had a bank account.

Another illustration of the same point was a contract with Data Science Limited. The Minister of State at the Cabinet Office who owned a stake in this company had registered his interest in the House of Lords register of members’ interests. Yet this GBP 3 million contract sailed (according to the report) through the high priority channel without a hint that there might be a conflict of interest.

Incidentally, the same minister updated the register in August to show he no longer had an interest in the said company. I wonder if his conscience had got the better of him.

Hopefully many of the lessons set out in the report’s recommendations (plus a few that are not in the report) will be heeded by Number Ten. But there needs to be a deeper philosophical shift in the heart of government. The idea that in a crisis speed is everything is largely responsible for this mess. What is needed is the right outcome when managing third party / supplier risk, not speed for its own sake. The expression, more haste less speed comes to mind.

The author leads TSG’s Advisory Services. He has spent many years in law enforcement and banking – specializing in financial crime risk and compliance. TSG is a Research (including due diligence) specialist, also offering Ethics Compliance and Advisory services to its clients. TSG offers expertise in Eastern Europe, as well as East Asia.