Due Diligence and the risk we don’t talk about

In many NGOs and social good organizations, due diligence is a familiar and recurring part of working with donors. Each new funder brings a new due diligence requirement, often in the form of lengthy questionnaires, 50, 80, sometimes more than 100 questions, covering much of the same ground in slightly different ways. With limited opportunity to reuse what has already been shared, organizsations gradually build up layers of assessments, each reflecting a particular funder’s approach to risk.

Most of these tools are built around international standards that many partners, especially smaller or under-resourced organizations, have never had the chance, or the resources, to fully meet.

Funders will rightly say: “We have fiduciary duties. We have legal and compliance obligations. We are accountable for public or philanthropic money.”

All of that is true, and nothing in what follows argues against it.

The question is a different one:

• Are current due diligence practices the best way to meet those obligations or have they become, over time, a blunt instrument that protects institutions while narrowing who can participate?

That raises two more challenging questions:

• At what point does due diligence stop being about accountability and start being about control?
• When due diligence systematically filters out certain types of organizations, are funders managing risk or simply protecting themselves while reinforcing existing power dynamics?

Over time, due diligence can become a powerful gatekeeping exercise, one that keeps funding flowing to the same types of organizsations, in the same ways, and with the same patterns of risk and exclusion. This article explores whether it is possible to redesign due diligence so that it continues to meet legal and fiduciary obligations, while also supporting a more diverse ecosystem of partners.

In the rest of this piece, I’ll suggest a few shifts that may not sit comfortably in every compliance or risk team. They are not perfect solutions, but they are offered as food for thought and as an invitation to think differently about what due diligence could look like.

The Problem: When Due Diligence Becomes Border Control

On paper, due diligence exists to answer reasonable questions:

• Can this partner manage funds responsibly?
• Do they have basic controls in place?
• Are people, data, and resources protected from harm?
• Are we complying with relevant laws and regulations?

In practice, due diligence can become an activity which functions more like a border checkpoint than a bridge to funding:

• Multiple tools and forms, each donor or intermediary using their own template, even when the questions are almost identical.
• Standardized questionnaires designed around large international organizations and applied to smaller entities with no adjustment for size, context, or operating model.
• Binary pass/fail decisions, where identified gaps automatically mean ‘no’ instead of how do we manage this risk safely?

Some of this is driven by legal and fiduciary requirements. Funders have to account for anti-fraud controls, anti-money laundering and counter-terrorism financing obligations, sanctions regimes, data protection rules, safeguarding standards, and charity and public finance laws. These requirements are non-negotiable. But not all of what we see in due diligence is dictated by law. Over time, practices are also shaped by habit, institutional risk aversion, and an unspoken assumption that good looks like a highly formalised, well-resourced, audit-ready organization.

The intention behind this is rarely malicious, but the effect is significant. Many organizsations remain stuck in the pre-qualified stage, never quite ready to progress, regardless of their relevance, reach, or potential impact.

Rethinking due diligence doesn’t mean relaxing legal or fiduciary standards. However, if we want a more diverse, and resilient partner ecosystem with relevant solutions to complex problems, we need to redesign some aspects of how due diligence works in practice.

 

Solution 1: Simplify the Tools

Due diligence tools have a tendency to grow over time. Questionnaires get longer, new sections are added, and processes become increasingly complex. In some cases, partners are asked to complete several different tools for a single funding relationship. This complexity can create a risk of its own, as necessary information gets buried, duplicated, or lost altogether.

Rather than relying on long, complicated tools, or multiple overlapping ones, imagine:

• One consolidated due diligence framework per funder or intermediary, used consistently across programs and departments.
• Well-designed core questions, covering the full range of mandatory areas:
  • legal status and governance
  • financial management and internal controls
  • fraud, corruption and AML/CTF
  • sanctions and counter-terrorism checks
  • safeguarding and protection
  • data protection and information security
  • ethics and conflicts of interest
• Within that single framework, there is a clear distinction between:
  • Non-negotiable requirements directly linked to applicable law, regulation, and fiduciary duty; and
  • Good practice/developmental or aspirational areas, where gaps can be addressed through risk mitigation and capacity support.

This does three things:

1. Makes compliance transparent. Partners can clearly see what is non-negotiable versus what capacities can be worked on during the relationship.
2. Removes duplication, ensuring that every question has a clear legal or risk rationale.
3. Makes it easier to demonstrate a systematic and proportionate approach to auditors and regulators.

 

Solution 2: Make Capacity Accompaniment a Core Risk Mitigation Strategy

Right now, due diligence often works like this:

1. Assess partner.
2. Find gaps.
3. Decide they are too risky.
4. Move on to someone safer.

This pattern is understandable, but it is closer to risk avoidance than risk management, and it locks many organizsations into a permanent not-ready category.

From a legal and fiduciary perspective, there is a more defensible route:

• Use due diligence to identify specific risks, then
• Combine proportionate controls with funded capacity strengthening as explicit risk mitigation.

For example:

• Where financial controls are basic but functional, funders might:
  • keep grant amounts lower initially,
  • require additional approvals or joint signatories, and
  • allocate budget to strengthen finance systems and staff capacity over an agreed period.
• Where safeguarding policies are emerging rather than fully developed, they might:
  • require immediate implementation of specific minimum measures,
  • provide technical and financial support to draft policies, and
  • agree on milestones for training and reporting mechanisms.

In this approach, the funder documents the risk, sets precise interim controls, and invests in the systems that reduce those risks over time. Capacity strengthening is used as a primary risk mitigation strategy, not a nice-to-have. Each significant gap identified in the due diligence process is linked to a specific mitigation measure and a capacity accompaniment offer.

In practice, this means:

• Including budget lines for capacity strengthening as standard practice to cover gaps uncovered in the due diligence process.
• Using the due diligence process to co-design an institutional strengthening plan with the partner, rather than sending a list of deficiencies.
• Framing investment in capacity as exactly what it is: an investment in risk mitigation, not an extra burden on program budgets.

From a governance and legal perspective, this approach, demonstrates that the funder took risks seriously, applied proportionate controls, and actively worked to reduce the likelihood and impact of risks.

 

Solution 3: From Pass/Fail to Proportionate, Tiered Engagement

A one-size-fits-all due diligence standard is almost guaranteed to privilege large, established organizations while penalising smaller, emerging, or specializsed ones. It flattens very different risk profiles into a single benchmark and ignores how risk is actually distributed across a portfolio. It’s like saying someone wants the best value for their money, but only shopping at the two stores closest to their house. This may seem efficient, but it has already limited the options before even comparing prices.

A more defensible model is a tiered or step-based due diligence model, where organizations are assessed and engaged at different levels depending on their current capacity and the size/complexity of funding.

This includes:

• Having minimum baseline requirements that apply to all partners linked to applicable law, regulation, and fiduciary duty.
• Additional requirements that scale with the size, complexity, and inherent risk of the funding and activities.

Practically, this looks like stepping stones:

• Tier 1 focuses on grants with smaller or emerging organizsations. It involves simpler documentation, straightforward reporting, and more intensive capacity accompaniment.
• Tier 2 applies to mid-level funding or more complex interventions, with stronger expectations and more formal controls.
• Tier 3 covers high-value or strategic partnerships, where organizations are expected to meet more advanced good-practice standards and are granted greater autonomy as a result.

Tiering starts from the recognition that organizations are not static. A partner may begin at Tier 1 and, over time, move through higher tiers as it strengthens its systems and receives capacity accompaniment. This progression allows organizations to manage greater levels of responsibility and, ultimately, to have more impact.

At its core, tiering is about matching the intensity of due diligence, oversight, and capacity accompaniment to the level of risk and exposure involved. It treats partners as organizations in development, rather than as entities that either pass or fail once and for all.

For a tiered approach to be compliance- and governance-sound, a few safeguards are essential:

• Clear, objective criteria for assigning tiers, such as the size of the grant, the complexity of activities, the inherent risk of the context or sector, and the organization’s existing systems.
• Defined pathways for progression, setting out what partners need to strengthen over time in order to move between tiers.
• A non-negotiable baseline that every partner must meet, regardless of tier, anchored in applicable law, regulation, and fiduciary duty.

 

Solution 4: Harmonized Due Diligence and Passporting

As mentioned earlier, many NGOs and social good organizsations navigate multiple due diligence processes. Ten different funders often mean ten different tools, each asking broadly similar questions in slightly different ways.

Two ideas are frequently proposed as solutions to this issue: harmonized due diligence and the passporting of assessments. Both approaches aim to minimize duplication, standardize the due diligence process, and lessen the compliance burden. While they are related concepts, they are not synonymous.

Harmonizsed due diligence means a group of funders and intermediaries agree on a common set of core questions and risk domains while each organizsation still:

• runs its own assessment,
• applies its own risk appetite, and
• makes its own decisions.

Done well, it’s simply better practice:

• For partners, it reduces the compliance burden and makes it easier to prepare once and respond many times.
• For funders, it creates a common language (when we say internal controls, we mean this), simplifies staff training, and makes quality assurance more consistent.
• For auditors and regulators, it demonstrates that organizsations are working from a clear, structured, and sector-aligned framework, rather than an ad hoc mix of legacy tools.

Harmonization replaces a fragmented due diligence system with a shared baseline without requiring organizations to give up their legal or fiduciary responsibilities.

Passporting or recognition of existing assessments goes a step further. Here, an assessment conducted by one funder or a trusted third party is recognizsed and reused by others, so a partner does not have to start from zero each time. This offers:

• A reduction in duplication for partners; and
• A data once, reused many times approach for core risk information.

But passporting cannot mean outsourcing the duty of care. A more defensible model is recognition plus professional judgment:

• Treat another organization’s assessment as one source of evidence, not a complete substitute for your own decision-making.
• Carry out top-up checks on areas specific to your mandate and legal context.
• Put in place clear arrangements on:
  • data protection and confidentiality;
  • partner consent for information-sharing; and
  • the standard of care applied by any third-party certifier.

It is essential to consider the power dynamics involved. If harmonization or passporting depends on a single benchmark, particularly one that reflects Northern norms, it can inadvertently reinforce a specific worldview of what is considered “good enough.” This approach may make it more challenging for different organizational models to be recognized as legitimate, serving as an effective means of gatekeeping that perpetuates existing power structures.

To counter this, consider the following approaches:

1. When establishing and validating the standard, engage a diverse range of organizations, taking into account differences in size, geography, and type.
2. Implement tiered recognition levels so that the passporting process reflects varying degrees of maturity, rather than being an all-or-nothing approach.
3. Base recognition on contextualized good practices, rather than solely relying on templates from a single region or sector.
4. Explore the option of independent or third-party certification that maintains accountability to both funders and partners.

 

Solution 5: Due Diligence as an Ongoing Relationship, Not a One-Off Event

Most due diligence processes happen once, at the start of a partnership, and then vanish into a file. Risk is not static, and neither are organizations.

A more effective approach:

• Treat due diligence as continuous engagement over the lifecycle of the partnership.
• Perform regular, scheduled check-ins focused on key risk areas and agreed capacity plans.
• Update the risk profile where there are material changes (growth, new sectors, changes in leadership, context shocks).

One practical shift is to create partner-facing risk support roles, for example, Partner Risk Management Leads/Coordinators whose job is to sit in the space between compliance and accompaniment.

Their role would be to:

• Spend time with partners to understand their systems and the pressures they face.
• Co-design practical, proportionate mitigation plans.
• Translate internal risk terminology into language and actions that make sense for partners.
• Advocate internally for appropriate controls, rather than defaulting to over-engineered solutions.
• Help ensure that funds and support are directed to the areas where partners need help to manage and mitigate identified risks and gaps.

This is not an audit or policing function. It is a role that translates funder risk requirements, blends safeguarding of funds and reputation with genuine investment in partner strength, and supports true risk-sharing over the life of the relationship, moving from ‘you filled in the form, we’re done’ to ‘we are managing this together.’

To stay on the right side of liability boundaries:

• These roles should be clearly framed as support, not operational management of the partner.
• Partnership agreements should confirm that the partner remains legally responsible for its own operations and compliance.
• Internal procedures should define when and how issues are escalated, and what triggers additional controls or suspension of funds.

Done this way, ongoing engagement reduces legal and reputational risk: issues are more likely to be spotted early, addressed collaboratively, and resolved before they become crises.

 

Solution 6: Supportive Accountability

Accountability is non-negotiable, but how we do accountability is a choice.

Supportive accountability means:

• Partners are held to clear standards,
• There is transparent communication about where a partner currently stands; and
• They have access to the resources and support needed to meet those standards over time.

This requires:

• Honest recognition that many local and smaller organizations in the NGO and social goodimpact space operate under a starvation cycle, chronically underfunded overheads, fragile systems, and short-term projects that never pay for core capacity.
• Willingness to fund core systems, finance, HR, safeguarding, internal audit, IT, through fair cost recovery and dedicated support lines.
• Using findings from due diligence to justify more capacity enhancement support, not less funding.

Supportive accountability does not excuse non-compliance with legal requirements. Areas like sanctions, AML/CTF, serious safeguarding concerns, or evidence of fraud must always trigger immediate action. In those domains, there is no flexible pathway, only remediation or exit.

Supportive accountability is about everything around those red lines: the systems, processes, and capacities that can legitimately be built and improved over time.

 

Solution 7: Integrating Impact Focused Risk Management

Most due diligence tools are heavily weighted toward financial, fraud, and compliance risk. That focus is understandable. Misused funds and legal breaches are serious. But risk to impact, relevance, and legitimacy also deserve attention.

A portfolio that looks clean on paper, yet remains concentrated in a narrow set of familiar actors, may still carry significant risks, including:

1. Strategic risk: limited reach and weak sustainability.
2. Reputational risk: perceptions that the funder is disconnected from lived realities, local knowledge, or the communities it claims to serve.
3. Systemic risk: over-reliance on a small group of organizations, creating fragility if those actors fail, withdraw, or become overstretched.
4. Innovation risk: reduced experimentation and learning when newer or less conventional organizations are consistently filtered out.
5. Equity and legitimacy risk: reinforcing patterns where only certain organizational models are seen as credible, undermining trust and claims of fairness or inclusion.

Seen together, these risks highlight a blind spot in many due diligence frameworks. By focusing narrowly on compliance and financial controls, it can unintentionally increase other forms of risk that are harder to quantify but no less real.

A more balanced approach asks:

• What is the risk of not working with this partner, for communities, for sustainability, for legitimacy?
• What developmental or justice risks do we create if we consistently bypass certain actors because they don’t fit imported standards?
• Where is the line between legitimate fiduciary caution and risk aversion that undermines impact and equity?

Answering these questions requires bringing fiduciary risk and impact-focused risk management together. Legal and regulatory obligations continue to set the outer boundary of what is acceptable. Within that boundary, when multiple options are legally and financially sound, risk decisions can also be informed by considerations such as:

• Which partners increase the diversity and resilience of the ecosystem?
• Where does investment in capacity have the greatest long-term payoff?
• What is the strategic and ethical risk of always choosing the safest-looking option on paper?
• This moves the risk management lens from avoidance to a more deliberate practice of stewardship.

This moves the risk management lens from avoidance to a more deliberate practice of stewardship.