Companies rarely pay bribes directly. They pay a distributor a margin that is slightly too generous, a consultant a success fee that is slightly too large, a customs broker an "expediting" charge nobody asked about. Most reported FCPA enforcement actions involve an intermediary somewhere in the chain.
That is not a US peculiarity. Under section 7 of the UK Bribery Act, a company is liable for bribes paid by anyone performing services on its behalf unless it had adequate procedures to prevent them. The UK's failure to prevent fraud offence applies the same logic to agents and subsidiaries. The EU Directive extends corporate liability to offences that result from a lack of supervision or control. Three regimes, one message: what your intermediaries do, you answer for.
Why the risk concentrates there
Intermediaries exist to get things done in markets where the company has no presence of its own. That is precisely the value they sell, and precisely the risk. They know the officials and the procurement managers. They are paid on results. Their costs are rarely itemised. And they are usually managed by a commercial team measured on the revenue they bring in.
None of that makes an intermediary corrupt. It makes the relationship one where a corrupt payment would be easy to disguise and hard to detect, which is what a risk assessment is supposed to identify.
The four controls that do the most work
Tiering before engagement. Not every third party deserves the same scrutiny. A distributor in a high-risk market that interacts with state-owned customers is not a stationery supplier. A documented tiering model, applied before anyone signs, decides where due-diligence effort goes. Without one, effort is spread evenly, which means it is spread thin where it matters.
Ownership, verified. An intermediary owned by, or related to, an official is the classic route for a disguised payment. Asking the third party to declare its owners is a start. Checking the answer against independent sources is the control.
Contract rights you can use. An anti-corruption clause with no audit right leaves you unable to find out what happened. One with no termination right leaves you unable to act on what you find. Both need to be in every higher-risk intermediary contract, including the old ones.
Payment matched to work. Commissions above market rate, round-sum success fees, requests to pay a different entity or an account in a third country: these are how improper payments move. Requiring evidence of services delivered before payment is the control most likely to catch one in transit, and the one most often skipped because it slows down finance.
Due diligence tells you who you are dealing with. Payment controls tell you what you are paying for. Most programmes do the first and skip the second.
The legacy problem
The hardest intermediaries to deal with are the ones already in place. Relationships that predate the current programme were often onboarded with a handshake and a sanctions screen. They also tend to be the longest-standing, the most commercially important and the least willing to answer new questions.
A proportionate approach is to tier the existing population first, then refresh due diligence on the highest tier over a defined period, renegotiating contract terms at renewal. It is slower than a clean sweep, but it is defensible, and it can be documented as it happens.