Distributors, Agents and Vendors: You Have Outsourced the Work, Not the Risk

A large share of an Indian company's revenue may flow through distributors it has never audited, and a large share of its spend through vendors and consultants it onboarded with a form. Each of those relationships is a place where the company's controls stop and someone else's incentives take over.

That is where money is lost, through inflated claims, fictitious services and kickbacks. It is also where liability is acquired, because the law increasingly treats a third party acting for a company as the company itself.

Why third parties are different

Inside the company, a fraudster has to defeat controls. Outside it, there may be none to defeat. A distributor's secondary sales, a consultant's "liaison" work or an agent's dealings with a licensing office are largely invisible unless the company chooses to look.

The legal exposure is real. Under s. 9 of the Prevention of Corruption Act 1988 as amended in 2018, a commercial organisation commits an offence if a person associated with it bribes a public servant to obtain or retain business or an advantage for it. Section 10 can make consenting or conniving directors and officers personally liable. The only defence is adequate procedures, and the Central Government has not notified guidelines on what those are. For companies with UK or US links, the UK Bribery Act and the FCPA add their own third-party exposure.

The ACFE's Occupational Fraud 2026 report found corruption in 45% of cases, with a median loss of USD 150,000. Many such schemes run through third parties that a proper check would have flagged.

What good looks like

1. Know who your third parties are

Start with a single register of distributors, agents, consultants, contractors and significant vendors, held in one place, with owner, spend or revenue, and the business purpose of each relationship. Many companies cannot produce this list quickly. If you cannot, that is the first finding.

2. Tier them

Spend effort where risk is highest. Typical risk factors:

• deals with government, regulators or state-owned customers on your behalf;
• paid by commission, success fee or retainer rather than for defined deliverables;
• introduced or championed by a senior employee, a director or a public official;
• operates in a sector or region where your own presence is thin;
• payments large relative to the visible work, or requested to unusual accounts.

3. Check independently, in proportion

For low-risk vendors, sanctions and basic registry checks may suffice. For high-risk third parties, integrity due diligence should establish beneficial ownership, links to employees or public officials, litigation and regulatory history, reputation in the market and the real capability to deliver what is being paid for. Our guide to business partner due diligence in India sets out the sources.

4. Contract for oversight

Contracts with high-risk third parties should include anti-bribery representations, a right to audit books and records relating to the company's business, a duty to cooperate with investigations, and termination rights for breach. A right to audit that has never been exercised is worth little; schedule some audits.

5. Monitor with the data you already hold

Distributors generate claims, credit notes, scheme payouts, returns and pricing exceptions. Vendors generate invoices, payment patterns and master data changes. Compare like with like: which distributors' claims grow faster than their purchases, which agents' fees spike before a licence is granted, which vendors share an address or a bank account with an employee?

6. Refresh

Re-screen high-risk third parties periodically and on trigger events such as a change of ownership, an allegation or a sudden change in volumes.

Decision points for management

• Who owns the relationship and who owns the risk? Usually the business owns the relationship. Compliance or risk should own the tiering and the checks, so that the person who wants the deal is not the one clearing it.
• What happens when checks find a problem? Decide in advance which findings are disqualifying, which need mitigation and who can approve an exception.
• How much is enough for a distributor network of thousands? Tier ruthlessly and rely on data for the long tail.

Common mistakes

• Onboarding only. Most problems develop after onboarding, when volumes and relationships change.
• Self-declaration as due diligence. Questionnaires record what the third party chose to say.
• Exemptions for strategic partners. The partners most important to the business often carry the most risk.
• Unused audit rights. If the third party knows audits never happen, the clause deters nothing.
• Treating distributors as customers. Distributors are customers in the ledger, but schemes, claims and credit make them a channel through which value can leave.

Where we can help

We carry out integrity due diligence on high-risk third parties, design proportionate programmes as part of anti-bribery and corruption work, and run distributor and vendor analytics and audits through our forensic accounting team. Speak to us in confidence.