Methodology

A method you can audit, from scope to signature.

How a question becomes a defensible answer: six stages, a written risk framework, explicit information types, and limitations stated rather than buried.

See the framework applied

01Investigation journey

Six stages, each with a safeguard.

Select a stage to see what happens, what you receive, and the control built into it.

Step 01

Define scope and targets

Agree the decision being supported, which entities and individuals are in scope, and the jurisdictions and look-back periods that apply.

What happens

Confirm the decision and the client's risk appetite
Identify targets: entity, directors, key personnel, associated parties
Set look-back periods, for example 5 years for litigation and 10 for media
Agree the risk framework and reporting format

You receive

Scope note and target list

Anything excluded from scope is recorded, so it can later be shown as “not assessed” rather than “no risk”.

Step 02

Gather available information

Collect records from corporate registries, financial filings, courts, regulators, screening sources, media archives and the client.

What happens

Registry extracts, filings and charges
Court, tribunal and regulatory records
Sanctions, watchlist and PEP screening
Media and online sources across name variants

You receive

Source log with retrieval dates

Every source is logged with its own date, separate from the date we reviewed it.

Step 03

Verify identities, relationships and records

Disambiguate names, confirm identifiers, and map ownership, directorships and associations across sources.

What happens

Match identifiers, not just names
Corroborate self-declared information
Map shareholding, directorships and related entities
Discount false positives, with reasons

You receive

Verified entity and relationship map

We record associations as context. An association is never treated as evidence of wrongdoing on its own.

Step 04

Assess and contextualise risks

Rate each criterion for each target against written thresholds, weighing recency, materiality and how reliable the source is.

What happens

Apply the 6-module, 18-criterion framework
Distinguish facts, allegations, outcomes and analysis
Calibrate ratings across targets
Identify mitigations and follow-up questions

You receive

Risk matrix with rationale for every cell

Each rating carries a written rationale and an analyst note. None are left unexplained.

Step 05

Document findings and evidence

Link every finding to evidence with stable IDs, source dates and review dates, then have a second analyst review it.

What happens

Assign stable IDs to findings and evidence
Record verification status for every item
Log open items and limitations
Second-analyst quality review

You receive

Evidence register

Items that cannot be verified are marked as such, rather than being quietly left out.

Step 06

Deliver a structured report

An executive summary, detailed findings and appendices, delivered as a navigable digital report and a print-ready document.

What happens

Executive summary written for decision-makers
Detailed findings by subject
Appendices: scope, sources, legend and limitations
Walkthrough of findings and open items

You receive

Report and digital dossier

The information cut-off date is stated, as are any changes after it that the report does not reflect.

Step 01
Define scope and targets
Agree the decision being supported, which entities and individuals are in scope, and the jurisdictions and look-back periods that apply.
What happens
- Confirm the decision and the client's risk appetite
- Identify targets: entity, directors, key personnel, associated parties
- Set look-back periods, for example 5 years for litigation and 10 for media
- Agree the risk framework and reporting format
You receive
Scope note and target list
Anything excluded from scope is recorded, so it can later be shown as “not assessed” rather than “no risk”.

02Risk framework

Six modules. Eighteen written criteria.

Every target is assessed against the same criteria, so ratings are comparable and every gap is visible.

Reputational & Ethical Conduct

Integrity, delivery record, workplace conduct and internal controls.

RE-1Bribery and corruption. Proven involvement in, or allegations of, bribery or corruption involving the entity or its key personnel.
RE-2Service delivery failures. Sub-standard delivery or delayed completion leading to adverse coverage, contract termination or client bans.
RE-3Workplace conduct. Workplace harassment complaints, or adverse public reports about the treatment of employees.
RE-4Controls and integrity. Data or security breaches, publicly reported internal scandals, improper payments or intellectual-property infringement.

Sanctions & PEP Exposure

Political exposure, state touchpoints, sanctions and debarment.

SP-1Senior political exposure. Current or former senior political office holder, or a family member or close associate of one.
SP-2Political affiliation or proximity. A junior political role, or attendance at events alongside political figures, in the last five years.
SP-3Political contributions. Donations or contributions to political parties.
SP-4State-owned touchpoints. Management roles with, services to, or liaison with state-owned entities or government bodies.
SP-5Sanctions and debarment. Listing on sanctions lists or watchlists, or debarment, suspension or blacklisting by government or multilateral bodies.

Financial Soundness

Financial crime, financial health indicators, defaults and insolvency.

FS-1Financial crime. Fraud, misappropriation of funds or assets, money laundering, terrorist financing or cybercrime.
FS-2Financial health indicators. Auditor qualifications, recurring losses, rating downgrades, contingent liabilities or unpaid statutory dues in the last two financial years.
FS-3Defaults and insolvency. Insolvency proceedings, material credit defaults or wilful-defaulter listings, directly or as guarantor.

Legal Exposure

Civil and criminal proceedings within the look-back period.

LE-1Adverse or ongoing litigation. Civil or criminal proceedings that are ongoing, or were decided against the target, in the last five years.
LE-2Favourably disposed litigation. Proceedings decided in the target's favour, or dismissed, in the last five years.

Regulatory & Compliance Exposure

Enforcement actions and statutory compliance.

RC-1Enforcement actions. Investigations, warnings or penalties by securities, banking, investigative or other enforcement authorities.
RC-2Compliance lapses. Statutory filing defaults, provident fund or social-security defaults, or other reported non-compliance.

Other Risks

Industry-specific, consumer, employee and privacy concerns.

OR-1Industry and conduct concerns. Industry-specific concerns, consumer complaints, employee reviews, labour unrest or unsavoury conduct.
OR-2Privacy and consumer law. Inadequate compliance with privacy, consumer-protection or prudential requirements.

Risk legend
Level	Meaning	Typical examples
No risk	No unfavourable or adverse information was identified within the agreed research scope.	· Searches completed with no relevant results · Name matches investigated and discounted
Low risk	Matters to be aware of that do not, on their own, indicate misconduct or material weakness.	· Unproven allegations or consumer and employee complaints · Ongoing or favourably disposed civil proceedings · Minor, regularised compliance lapses · Commercial or employment touchpoints with state-owned bodies · Contingent liabilities or auditor emphasis without qualification
Moderate risk	Matters that warrant attention and, usually, a mitigation or monitoring step.	· Civil proceedings decided against the target · Junior political roles or proximity to political figures · Older or limited regulatory penalties · Workplace conduct or data-handling concerns in the public domain
High risk	Material concerns that typically require escalation before a decision is made.	· Sanctions, watchlist or debarment listings · Confirmed bribery, fraud or financial crime · Senior political office, or close family ties to it · Criminal proceedings decided against the target · Significant recent regulatory penalties
Not assessed	Outside the agreed scope, or not determinable from available sources. This is never equivalent to “no risk”.	· Criterion excluded for this target type · Required records not publicly available

03Information types

Fact, allegation, outcome, analysis.

Every finding says what kind of information it is, so a reader never mistakes a claim for a conclusion.

Verified fact
Confirmed against a primary or authoritative record.
Allegation
Claimed by a third party and not established or adjudicated.
Legal outcome
A decision, order or award issued by a court, tribunal or authority.
Analytical interpretation
The analyst's assessment, drawn from the evidence cited.

04Quality controls

Controls built into the work, not added at the end.

Second-analyst review
Every rating and finding is reviewed by a second analyst before release.
Calibrated ratings
Ratings are compared across targets and modules so the same facts earn the same level.
Dated evidence
Source dates, review dates and the information cut-off are recorded for every record.
Open items logged
Unresolved matches and pending documents are tracked and reported, not dropped.

05Research limitations

What due diligence can't tell you, stated plainly.

Limitations are part of the finding. Each report lists the ones that apply to it, and the platform marks every affected cell.

Not an audit
The work is not an audit, review or attestation engagement, and expresses no assurance opinion.
Not legal advice
Findings describe what records show. Questions of legal interpretation should go to counsel.
Point-in-time
Findings reflect information available up to the stated cut-off date. Later events are not reflected.
Consent-based checks
Some checks, such as personal credit records, need the subject's consent and are reported as not assessed without it.
Access limits
Site visits may be limited to external observation. Any limits are recorded alongside the observations.
Public and provided sources
Information from public sources or the client is not independently verified unless stated.

Start a conversation

Bring us the counterparty.
We'll bring the evidence.

Tell us who you're dealing with and what's at stake. We'll propose a scope, from a desktop review to a full investigation.

Build a scope first

A method you can audit, from scope to signature.

Six stages, each with a safeguard.

Define scope and targets

Gather available information

Verify identities, relationships and records

Assess and contextualise risks

Document findings and evidence

Deliver a structured report

Define scope and targets

Six modules. Eighteen written criteria.

Reputational & Ethical Conduct

Sanctions & PEP Exposure

Financial Soundness

Legal Exposure

Regulatory & Compliance Exposure

Other Risks

Fact, allegation, outcome, analysis.

Controls built into the work, not added at the end.

What due diligence can't tell you, stated plainly.

Bring us the counterparty.We'll bring the evidence.

Bring us the counterparty.
We'll bring the evidence.