After reading more about the risk from third parties, it occurred to me that we aren't thoroughly reviewing our own processes and procedures. We put much time and effort into pre-hiring and ongoing employee vetting but are not spending equal time on the companies we are paying.

Vendor screening is just as important as employee backgrounds; if you are using contractors that have been identified as a risk (such as on a federal watch list), the liability is yours.

To mitigate some of the risk associated with using suppliers, we began performing automated sanction checks against all new suppliers prior to signing a contract and then again quarterly thereafter. The number of red flags that we uncover from these background checks is shocking. How often does everyone else review their list of suppliers?