Supplier integrity due diligence as a mechanism for mitigating reputational risks

doi:10.22167/2675-6528-202602848

Compliance And Esg

October 02, 2026

Supplier integrity due diligence as a mechanism for mitigating reputational risks

Supplier Integrity Due Diligence as a Mechanism for Mitigating Reputational Risks

Edson Douglas Mizael de Menezes; Eliza Remédio Alecrim

DOI: 10.22167/2675-6528-202602848

Article derived from a Course Conclusion Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege for textual synthesis and organization.

Summary

The growing materialization of reputational risks in poorly structured commercial relationships has highlighted the relevance of supplier integrity due diligence. The study aimed to demonstrate that integrity due diligence is an essential mechanism for mitigating such risks. To this end, a single case study methodology was adopted, analyzing a winery in Rio Grande do Sul that was involved in an episode of slavery-like labor in 2023. Official documents, internal policies, and the company’s sustainability report, published between 2023 and 2025, were analyzed, and the winery’s compliance program was compared with the guidelines of the Comptroller General’s Office of the Union. The results revealed that the absence of structured due diligence procedures contributed to the hiring of a supplier with serious labor violations. However, after the reputational crisis, the winery implemented more robust governance practices, such as the creation of a Whistleblowing Channel and an Integrity Committee, although it still presented gaps, such as the lack of a specific internal policy for third-party management. The research also proposed a due diligence questionnaire for supplier evaluation. It was concluded that supplier integrity due diligence is an indispensable tool for preventing reputational damage and strengthening the integrity culture in organizations.

Keywords: Compliance; Due diligence; Third-party management; Reputational risk.

1. Introduction

The growing complexity of the business environment and the interconnection of value chains have exposed organizations to a variety of risks, among which reputational risks stand out due to their capacity to generate significant impacts. Poorly structured commercial relationships, especially with third parties, can result in media scandals, such as those involving degrading working conditions, which severely compromise the image and credibility of companies. Faced with this scenario, the implementation of effective preventive procedures becomes imperative to identify irregularities before they materialize into crises.

In this context, the compliance program constitutes an essential corporate governance instrument, designed for the prevention, detection, and remediation of risks that can affect a company’s business and strategic objectives. Corporate governance, broadly speaking, organizes and structures the company, defining values and commands for its various social actors (Block, 2021). Risk, according to Assi (2021), is an uncertain event that is independent of the company’s intentions and can generate some type of damage.

As an operational pillar of compliance programs, supplier integrity due diligence is a fundamental procedure. Its purpose is to investigate the history of business partners and the existence of fraud or irregularities in their field of activity. Silveira et al. (2020) highlight that this procedure not only facilitates the decision-making process in choosing partner companies but is also a crucial element in mitigating the occurrence of risks associated with these relationships.

Despite the relevance, it is common for many companies not to dedicate due diligence when transacting with third parties. The lack of clear investigation processes, scarcity of resources, and insufficient involvement of senior management are factors that hinder adequate supplier verification. This deficiency exposes organizations to integrity risks that are often difficult to address, threatening business continuity and negatively impacting the effectiveness of already established compliance programs.

The biggest challenge for organizations is to avoid the materialization of reputational risk, especially when they enter into contracts with suppliers involved in ethical misconduct. Reputation, according to Coimbra et al. (2021), is the result of the images and perceptions that the community has of the company, influenced by both internal and social positioning. The materialization of this risk can seriously harm the credibility and trust of stakeholders, affecting the company’s ability to attract investments or benefit from social responsibility initiatives, such as access to green credit.

The present research is motivated by the occurrence of cases that demonstrate how the absence of a robust integrity due diligence process can result in serious damage to the image of contracting companies. The analysis of concrete situations reveals the urgency of adopting preventive mechanisms that guarantee compliance and ethics throughout the value chain, reinforcing the culture of organizational integrity.

In this sense, this work aims to demonstrate that conducting supplier integrity due diligence is fundamental for organizations to avoid the materialization of reputational risks. Specifically, it seeks to discuss that the opaque and weak integrity due diligence procedure of the analyzed company potentiated the occurrence of an image crisis; compare the supplier due diligence procedure of the analyzed company, implemented after the materialization of reputational risk, with the guidelines of the publication “Integrity Program: Guidelines for Private Companies”, prepared by the Comptroller General of the Union; and show that applying an integrity due diligence questionnaire to the supplier, prior to signing the service provision contract, is a fundamental strategy in collecting information about the interested third party.

2. Material and Methods

The present study was characterized as a research of an applied nature, explored through a single case study. The methodological approach adopted was descriptive, seeking to detail the procedures and practices related to supplier integrity due diligence. The empirical object of the research focused on a Brazilian winery, located in the state of Rio Grande do Sul, which was involved in a media scandal in the year 2023.

The case analyzed concerned an episode in which the company hired by the winery to supply labor for its plantations kept workers in a situation analogous to slavery. This event served as a starting point for the investigation into the effectiveness of integrity due diligence mechanisms and their impacts on organizational reputation, in line with the general objective of demonstrating the fundamental role of due diligence in avoiding reputational risks.

Data collection was carried out through documentary research, using the winery’s Code of Conduct (2023), Human Rights Policy (2023), and Sustainability Report 2024/2025 (2025) as primary sources. All these documents were accessed on the organization’s official website, specifically in the section related to the integrity and compliance program, during the period between January and April 2026.

For the organization of the data, key terms such as “due diligence”, “third-party management”, “suppliers”, “risks”, and “human rights” were sought in the company’s documentation. The analysis of the located data was conducted by reading the established patterns in these documents, with the aim of identifying supplier integrity due diligence procedures and the elements of sustainability culture present in the winery.

In line with one of the specific objectives, a comparison was made between the supplier due diligence procedure of the analyzed company, implemented after the materialization of reputational risk, and the guidelines of the publication “Integrity Program: Guidelines for Private Companies”, prepared by the Comptroller General of the Union (CGU). This comparison verified the equivalence between the recommendations of the CGU guide and the information contained in the Winery’s Sustainability Report 2024/2025.

The elements considered in the comparison included consulting public databases with relevant information, verifying the third party’s involvement with corruption and human rights violations, the existence of an integrity program in the supplier, presence in positive registries, and the inclusion of compliance clauses in service provision contracts. This procedure allowed for an assessment of the winery’s practices’ alignment with national integrity guidelines.

Additionally, to meet another specific objective, an integrity due diligence questionnaire for suppliers was proposed, to be applied before the service provision contract is signed. The questionnaire was structured into four main axes: company data, relationship with public agents, legal situation, and integrity program. This instrument aimed at the systematic collection of information about the interested third party.

The risk assessment methodology associated with the questionnaire involved assigning a score from 1 to 5 for each item, where lower scores indicated lower risk. Based on the total points, the risk level was classified into low, medium, and high tiers, according to limits to be established by the contracting company’s internal due diligence policy. After documentary analysis and data search, risk measurement was performed based on these parameters.

The proposed due diligence process also included the use of data mining platforms to consult public databases, such as the National Register of Punished Companies (CNEP) and the Register of Unfit and Suspended Companies (CEIS), in addition to the list of slave labor from the Ministry of Labor and Employment. Searches for adverse media and checks of relevant judicial proceedings, such as public civil and criminal actions, were also carried out to identify possible irregularities.

For the registration and archiving of all collected and gathered material, a proprietary system or spreadsheet was used, ensuring information traceability. It is important to emphasize that the researcher acted as an external observer, with no professional ties to the company under study, which conferred independence to the analysis. No documents detailing the third-party due diligence process before 2023 were found.

3. Results and Discussion

The research revealed that the absence of structured integrity due diligence procedures significantly contributed to the materialization of a serious reputational risk at the analyzed winery. The incident of labor analogous to slavery, involving a labor supplier, exposed the vulnerability of the company’s value chain. However, the study also identified that, after the crisis, the organization implemented a series of more robust governance practices, although it still presented important gaps, such as the lack of a specific internal policy for third-party management. The findings demonstrate the indispensability of prior diligence for preventing damage to the image and strengthening the culture of integrity.

Definition of Compliance and Due Diligence

Corporate governance, according to Block (2021), encompasses a set of decisions that organize and structure the company, defining values and commands for its various social actors. In this context, the compliance program acts as an essential governance instrument, focused on the prevention, detection, and remediation of risks that can affect a business and an organization’s strategic objectives. Risk, in turn, is an uncertain event that is independent of the company’s intentions and can generate some type of damage, as pointed out by Assi (2021). The view of compliance has evolved beyond mere regulatory compliance, encompassing integrity culture and risk management.

Integrity due diligence, an operational pillar of compliance, constitutes a fundamental procedure for verifying the history of business partners and identifying the existence of fraud or irregularities in their field of activity. Silveira et al. (2020) emphasize that this process not only facilitates decision-making in choosing partner companies but is also crucial for mitigating the occurrence of risks. Almeida et al. (2021) add that the objective of due diligence is to gather information about the risks involved in third-party transactions, supporting the best decisions regarding the company’s relationship with the other party.

The Winery Case and Reputational Risk

The case study analyzed a winery in Rio Grande do Sul that, in 2023, became involved in a media scandal of work analogous to slavery. The company had hired a labor supplier who recruited 210 workers from Bahia, subjecting them to precarious working conditions. After the escape of three workers and the denunciation to the Federal Highway Police, several authorities, including the Public Ministry of Labor and the Federal Police, investigated the case, revealing extortion, assaults, exhaustive workdays, inadequate food, and private detention.

The wineries involved, including the one analyzed, stated they were unaware of the situation, but the Ministry of Labor and Employment found that the supplier had been operating in the region for about ten years, recruiting workers for various activities. The supplier committed to paying R$ 500.00 for the return of each worker, in addition to signing a Conduct Adjustment Agreement (TAC) before the MPT. The wineries, in turn, signed a TAC to compensate R$ 7,000,000.00 for moral damages, of which R$ 2,000,000.00 were for the rescued workers and R$ 5,000,000.00 for damage repair projects.

The materialization of this risk severely impacted the winery’s reputation, damaging its market credibility. According to Coimbra et al. (2021), reputation is built by the images and perceptions of the collective, reflecting the company’s internal and social positioning. The materialization of reputational risk compromises stakeholder trust, potentially affecting the company’s ability to attract investments or access benefits such as “green credit,” a credit line for sustainable practices. Senior management must therefore act to reverse the situation, organizing processes for risk mitigation and treatment.

Analysis of the Winery’s Compliance Documents

The creation of the winery’s Integrity and Compliance Program in 2023 can be seen as a direct response to the reputational crisis. The organization participated in the Cooperativism Compliance Training and Assisted Practice Program, conducted by the Business School of the Pontifical Catholic University of Paraná, in partnership with the National Cooperative Apprenticeship Service (SESCOOP). In 2024, the Whistleblowing Channel and the Integrity Committee were created, with the function of issuing guidelines and recommending disciplinary measures related to ethics and integrity.

Still in 2024, the winery hired a specialized consultancy to structure and implement its compliance program. This partnership resulted in the first ESG and compliance risk analysis in contracts and commercial relationships, serving as the basis for the future General Policy for Purchasing and Third-Party Management. However, as of April 2026, this internal regulation, crucial for supplier due diligence, had not yet been published on the winery’s official channels, making an in-depth analysis of specific integrity verification procedures unfeasible.

The winery’s 2024/2025 Sustainability Report forecasts, for 2026, the completion of corporate risk analysis, the definition of a commercial policy aligned with integrity, the review of contracts with compliance clauses, and the restructuring of the procurement sector. This indicates that the organization’s compliance program is in the consolidation phase. The compliance program’s documentary framework, according to the company’s website, is referenced through the Code of Conduct, policies and documents, Whistleblowing Channel, Salary Equality Report, and sustainability.

The absence of disclosure of the General Policy for Procurement and Third-Party Management hinders the transparency of the supplier due diligence process, a fundamental aspect for a company seeking to demonstrate alignment with market best practices and appreciation for societal relationships. The winery’s governance structure, according to the report, highlights the independence of the compliance area, which is consistent with best practices for integrity programs. However, the document available on the winery’s official website did not disclose the names and profiles of the professionals responsible for the area.

The verification macro-process for hiring with potential environmental, social, labor, human rights, or corporate integrity risks includes due diligence, which verifies the third party’s fiscal, legal, labor, and regulatory regularity. There is also verification by the Specialized Service in Occupational Safety Engineering and Medicine (SESMT), responsible for monitoring the supplier’s documentary compliance with items such as the Risk Management Plan (PGR), Medical Control Program for Occupational Health (PCMSO), and Occupational Health Certificate (ASO).

The reputational verification of the company and its managing partners is another crucial step, involving checks in public databases such as the National Register of Punished Companies (CNEP) and the Register of Unfit and Suspended Companies (CEIS). Furthermore, the list of slave labor, maintained by the Ministry of Labor and Employment (MTE), is consulted, and judicial and administrative certificates are viewed. Although the winery prioritizes documentary and reputational checks, the Sustainability Report does not clarify whether the verification of adverse media is carried out through data mining platforms or the internet.

The non-disclosure of a detailed third-party management policy, three years after the start of the compliance program implementation and after the incident, represents a significant gap. It was expected that one of the first actions of the compliance program would be the creation of an internal regulation that established the specific and detailed flow for checking current and future suppliers. Pinheiro et al. (2024) suggest additional criteria for supplier evaluation, such as the identification of the referral source, the adequacy of the contract value, the relationship with public agents, and the identification of the ultimate beneficiary.

Code of Conduct

The winery’s Code of Conduct, in item 2.3, titled “Suppliers, Service Providers and Business Partners”, establishes the adoption of objective, ethical, and transparent criteria for the selection, hiring, and supervision of suppliers. The document states that the company manages third parties through rigorous analysis, control, and risk prevention, verifying integrity performance in human rights, labor, and environmental compliance. The basis for this procedure by the third-party and supplier management policy is also cited, however, this document is not yet available for public consultation.

The Code of Conduct also mentions that this procedure is based on a policy for managing third parties and suppliers, although this specific document was not available for public consultation. The winery explicitly declares that it does not tolerate illegality, corruption, degrading work, actions that harm the environment, public authorities, or individual and collective rights in its business chain. The company demonstrates concern in textually establishing an express prohibition of work analogous to slavery and other degrading conditions of service execution.

Internal Human Rights Policy

The winery’s Human Rights Policy addresses, in items 3.2 and 3.3, the importance of fair labor relations and the prevention of slave-like and child labor. The organization prioritizes equality in labor relations, both internal and with suppliers, observing respect for labor rights, including remuneration, vacations, and rest periods. Salary equalization between men and women in equivalent roles is also highlighted, promoting balance between the professional and personal lives of each employee.

In topic 3.3, the policy expressly prohibits any manifestation of forced, compulsory, or slavery-like labor in its operations and those of third-party contractors. There is also a prohibition of child labor, with the ban on hiring minors under 16 years of age, except as apprentices from the age of 14, according to legislation. The policy also prohibits situations that disrespect the life and physical integrity of workers, such as long working hours, undue remuneration, degrading conditions, physical and psychological threats, human trafficking, and forced migration of people.

Sustainability Report

The 2024/2025 Sustainability Report, in item 5.2, “Good Agricultural Practices, Compliance and ESG”, signals the implementation of practices that promote productive excellence and decent work in family farming, aligned with the standards of the International Labour Organization. The winery’s compliance program was formalized starting in May 2023, and in 2024, a specialized consultancy carried out the first ESG and compliance risk analysis in commercial contracts, from which the elements for the creation of the General Policy for Purchasing and Third-Party Management will be formed.

The winery’s ESG agenda was established from the definition of “materiality”, a structured process to identify the most relevant environmental, social, human rights, governance, and corporate integrity themes. This process involved five stages, from understanding the company’s context to impact assessment, with consultation of various stakeholders, including employees, cooperative members, industry associations, consumers, communities, business partners, competitors, public bodies, and suppliers. The result was a list of thirteen material themes, graded by impact on business and social/environmental aspects in low, medium, high, and very high risk degrees.

The “Supplier Value and Assessment Chain” was identified as a material social theme, according to the Sustainability Report. The company states it has approximately 1,300 registered third parties as service providers or suppliers of raw materials, goods, and products. Of this total, almost 10% of relationships with these providers required greater control in legal and socio-environmental aspects. In the 2024-2025 cycle, the winery began the process of developing its General Policy for Purchasing and Third-Party Management, however, this internal regulation was not available on the organization’s official website during the period of the preparation of this case study.

Comparison with the Guidelines of the General Comptroller’s Office of the Union

The Comptroller General of the Union (CGU) published, in 2015, the guide “Integrity Program: guidelines for private companies”, updated in 2024, offering guidance to improve compliance programs. Sub-item 3.8 of the guide, “Third Parties”, is dedicated to conducting due diligence. The comparison between the CGU’s recommendations and the winery’s compliance program, according to the 2024/2025 Sustainability Report, reveals points of convergence and gaps, evidencing the consolidation stage of the company’s program.

The analysis demonstrated that the winery’s compliance program, at the stage it was in April 2026, included consulting public databases with relevant information, such as the Register of Unsuitable and Suspended Companies (CEIS) and the National Register of Punished Companies (CNEP). It also included verifying the third party’s involvement with corruption practices and disrespect for human rights. Furthermore, the inclusion of compliance clauses in service provision contracts was also foreseen, aligning with three of the five verification criteria suggestions set forth by the CGU.

However, the winery’s program did not provide for verification of the existence of an integrity program within the supplier itself, nor for checking the presence of the third party in positive registries, such as Pró-Ética. The absence of verification of the supplier’s integrity program is a critical factor, as a partner that does not prioritize compliance with the law and best practices can compromise the reliability of service provision and, consequently, the reputation of the contracting company. This point represents a significant gap that can potentiate the materialization of reputational risks.

Due Diligence Questionnaire Proposal for Suppliers

The absence of a structured integrity verification flow at the winery before the 2023 incident prevented the identification of irregularities with the labor supplier. To mitigate such failures, the application of an integrity due diligence questionnaire, filled out by the supplier’s legal representative or compliance professional, is proposed. This questionnaire is divided into three axes: general company information, relationship with public agents and party affiliation, and integrity and human rights, seeking a comprehensive data collection.

After completing the questionnaire, the supplier must send documents and evidence that prove the declared information. Based on this data, the contracting company will have minimum conditions to assess the partner’s integrity. It is essential that organizations managing third parties have a dedicated team or, at least, a qualified professional to conduct this analysis, ensuring the depth and expertise necessary for the verification process.

The due diligence process continues with the registration of the supplier’s basic information in an internal system, followed by the verification of the questionnaire and evidence. This includes the analysis of documents such as the registration with the Federal Revenue Service, articles of association, accounting documents, data of the managing partners, and evidence of integrity programs, if implemented. The contracting company can then use data mining platforms to locate strategic information about the diligenced company and its administrators.

Data mining platforms are effective tools for querying public databases, such as the National Registry of Punished Companies (CNEP), the Registry of Unfit and Suspended Companies (CEIS), and the “dirty list” of slave labor, maintained by the Ministry of Labor and Employment. Furthermore, it is crucial to conduct searches for adverse media on the internet, verifying news and records that indicate the third party or its partners’ involvement in fraud, corruption, misconduct, or relevant judicial proceedings, such as public civil actions, criminal actions, and administrative impropriety actions.

The identification of unfavorable issues in these searches allows for the assessment of the impact and probability of reputational risk occurrence for the contracting party, should the contract be signed. Risk measurement is carried out through previously established parameters, assigning a score from 1 to 5 for each item in the due diligence questionnaire. The lower the score, the lower the associated risk, allowing the risk level to be classified into tiers such as low (up to 30 points), medium (31 to 60 points), and high (above 61 points), with limits defined by the company’s internal policy.

The completion of due diligence involves the registration and archiving of all collected material. If a relevant risk is identified, it is advisable to request clarification from the supplier, whose response may reduce the degree of risk. It is crucial that the entire procedure preferably occurs before the contract is signed, as diligence during the contractual relationship may expose the company to risks not previously measured. Continuous monitoring of the contractor’s situation through periodic evaluations may justify the continuation or not of the relationship.

For a structured due diligence, essential search sources include registration data and corporate structure (Federal Revenue’s CNPJ Registry), sanctions and impediments (CEIS, CNEP, Registry of Private Non-profit Organizations with Impediments – CEPIM, certificates of disqualified bidders provided by the Federal Court of Accounts, and registry of employers on the “dirty list” of forced labor). Negative media (search engines and reliable press outlets) and judicial proceedings (websites of state, federal, and superior courts of justice, and data mining platforms) are also indispensable references for a comprehensive assessment.

In summary, the research demonstrated that the absence of a robust integrity due diligence procedure potentiated the materialization of reputational risk in the analyzed winery. After the incident, the company implemented significant advancements in its compliance program, such as the creation of whistleblowing channels and integrity committees, and initiated the analysis of ESG risks. However, the delay in publishing a specific third-party management policy represents a gap that still needs to be addressed to ensure the full transparency and effectiveness of the program. The proposed due diligence questionnaire and the detailing of verification steps offer a structured path to prevent future reputational damage and strengthen the culture of integrity in organizations.