Third-Party Risk and Due Diligence Portal

The Problem

Due diligence on third parties was being run without a process: no coordination of tasks between teams, no timelines for onboarding or renewal, no reliable translation for users across regions, and a history of custom builds that had grown around the gaps. Every implementation for a new client started from scratch.

What We Built

A business sponsor opens a third-party account and completes a business questionnaire whose sections and questions are configured by an administrator. On submission a relationship record is created and configured rules generate red flags, a risk matrix with a low, medium or high rating against a configurable threshold, and inquiry records, each assigned to the right internal user and shown on that user's dashboard. Reviewers can override a rating, which itself needs approval.

Once every generated item is approved, a supervisor approves the questionnaire and the third-party contact is invited to complete their own questionnaire, bringing colleagues in to help if they need to. A supervisor and a chief officer then make the final assessments. Emails go out after every action, translated by the same engine that translates the application. Rejected entities go onto a watchlist, and any relationship can be exported as a PDF with a configurable structure.

Each relationship page carries a timeline showing the pending action, who holds it and how long it has been waiting. An optional training task, with media, documents and a quiz, gates any new user's first action.

One Codebase, Five Clients

Everything a client changes is configuration: questionnaire content, task and action types, dashboard layout, table filters, translations, PDF structure. The compliance company onboards three to four of its own clients a year, each in a new org, and changes that are not specific to one client go into the product rather than the org. Salesforce governor limits ruled out several standard features at this volume, so custom implementations were built where the platform would not hold.

Results

• Support tickets under 10% of the volume seen on the legacy systems
• Due diligence cycles 40 to 50% shorter, from clear task segregation
• Renewals no longer a manual chase; translations reliable across regions

All case studies