Impact of Leniency Agreements on Supplier Due Diligence

Beatriz Carneiro Costa; Thaís Helena Zero de Oliveira Pereira

DOI: 10.22167/2675-6528-202602711

Article derived from a Course Conclusion Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by Instituto Pecege for textual synthesis and organization.

Summary

The complexity of the corporate liability regime under Law No. 12.846/2013 and the consolidation of Leniency Agreements as instruments of cooperation and remediation motivated the analysis of the influence of these agreements on the integrity risk assessment of suppliers. The study aimed to investigate how the existence of Leniency Agreements impacts the analysis and classification of supplier integrity risk in third-party due diligence processes, and what criteria can be considered for decision-making in contracting. A mixed, exploratory, and explanatory approach was adopted, combining case study, participant observation, documentary analysis, expert interviews, and the application of questionnaires to compliance professionals and related areas. The results revealed that, although most organizations consider Leniency Agreements in third-party assessment, unstructured practices and the absence of formalized criteria prevailed, with significant variation in the classification and treatment of these cases. It was found that the Agreements were predominantly treated as an element that required detailed analysis, considering the severity of the offenses, the involvement of senior management, and the effectiveness of remediation and governance measures. The findings indicated the need to structure objective criteria and integrate this information into risk matrices, aiming for greater consistency, traceability, and security in supplier contracting decisions.

Keywords: Risk assessment; Compliance; Corporate governance; Risk matrix; Integrity programs.

1. Introduction

Law No. 12.846/2013, known as the Anti-Corruption Law, establishes the strict liability regime for legal entities for acts harmful to public administration, both domestically and abroad. This legislation introduced instruments such as Leniency Agreements, which aim to encourage companies’ cooperation with authorities in exchange for legal benefits (Brazil, 2013).

In this context, Leniency Agreements are configured as mechanisms of a negotiable nature, through which legal entities acknowledge their participation in illicit acts and commit to collaborating with the investigation of facts. In return, they may obtain advantages such as the reduction of administrative sanctions and the continuity of their operations (Comptroller General of the Union [CGU], 2025). Such agreements not only assist in the investigation of irregularities but also promote the reparation of damages and the implementation of changes in corporate integrity standards, contributing to the prevention of recidivism (Pimenta, 2020). The regulation of these agreements was consolidated and updated by Decree No. 11.129/2022, which establishes legal parameters for their application, including the definition of objective criteria for the evaluation of Integrity Programs and the adoption of risk-based due diligence in third-party contracting (Brazil, 2022).

In parallel, due diligence is an essential component of Integrity Programs. It acts as a tool to identify, analyze, and mitigate risks associated with third parties, such as suppliers, service providers, and business partners. This practice is fundamental to assessing the history, reputation, and compliance of these agents, preventing illicit activities and promoting transparency in business relationships (Organisation for Economic Co-operation and Development [OECD], 2023).

The intersection between these themes lies in the need to understand how the history of involvement in illicit activities, formalized through Leniency Agreements, should be considered in third-party risk assessment. The analysis of this factor is crucial for decisions in the hiring and management of suppliers, especially in light of the strict liability regime that can extend to contracting companies (Barros, 2021).

Despite the growing literature on Leniency Agreements and due diligence processes, a significant gap persists in understanding how these agreements should be interpreted in the context of third-party risk assessment. This gap is evident in the duality of Leniency Agreements, which can be viewed both as indicators of risk and as evidence of remediation and commitment to integrity. Such ambiguity highlights the need for deeper analysis to improve risk assessment practices and decision-making in contracting.

Given this scenario, the present research is justified by the relevance of developing objective and consistent criteria for the interpretation of Leniency Agreements in the integrity risk assessment of suppliers, aiming to provide greater security and traceability to business decisions. Thus, the present work aims to analyze how the existence of Leniency Agreements influences the integrity risk assessment of suppliers in due diligence processes, proposing criteria for their analysis.

2. Material and Methods

This research was designed with the objective of analyzing the consideration of Leniency Agreements in supplier due diligence processes, focusing on the assessment of integrity risks. To this end, a mixed methodological approach was adopted, integrating qualitative and quantitative elements, seeking an in-depth understanding of the phenomenon. The nature of the study was characterized as exploratory and explanatory, according to the guidelines of Gil (2017).

In the exploratory phase, the aim was to deepen the understanding of the topic, which is still little systematized in the corporate context, and to refine the study’s objectives (Gil, 2017). This stage involved a literature review and theoretical analysis of Leniency Agreements, including their concept, legal nature, and regulatory evolution, as well as third-party due diligence as an instrument of risk management. The central question guiding this phase was how the celebration of Leniency Agreements should be incorporated into the integrity risk assessment of third parties.

Subsequently, the research assumed an explanatory character, seeking to identify the impact of Leniency Agreements on third-party risk assessment in practical situations and to understand the criteria adopted by organizations. This approach aimed to analyze the cause-and-effect relationships of the phenomenon, according to Gil’s (2017) perspective. The integration of qualitative and quantitative methods, characteristic of the mixed approach, was justified by the need to combine analytical depth and comparative capacity, allowing for data triangulation (Hernández Sampieri, Collado, and Lucio, 2013).

The qualitative stage was carried out through a case study in a large company, operating in the railway logistics sector, employing the participatory research modality. Data were collected through documentary analysis, participant observation, and a semi-structured interview. The interview was conducted with the Legal Director of the aforementioned company, aiming to capture perceptions about the interpretation of the Leniency Agreements. This qualitative approach allowed for an understanding of the practices and interpretations of those involved, given the contextual nature of the phenomenon (Hernández Sampieri, Collado, and Lucio, 2013).

The quantitative stage consisted of applying structured questionnaires to compliance professionals and related areas of companies from various sectors. The collection occurred between January and March 2026, totaling three months. The sample was selected by judgment, intentionally, including professionals from Legal, Risk Management, and Internal Controls, who work in third-party due diligence. The questionnaires were applied via the Google Forms platform, with the link distributed by messaging application in specific sector groups. The collected data were treated quantitatively for measurement and comparative analysis (Turrioni and Mello, 2012).

The data collection techniques encompassed three main strategies. The first was documentary research, which included the analysis of internal documents of the case study company, regarding due diligence flows. Additionally, external documents were examined, such as Leniency Agreements from the Comptroller General of the Union (CGU), Law No. 12.846/2013, and Decree No. 11.129/2022. The OECD Due Diligence Guide and CGU manuals were also consulted, in addition to the CGU Leniency Agreements Panel, as detailed in Appendix I.

The second collection strategy was participant observation, which allowed for direct monitoring of internal third-party evaluation processes in the studied company. This included verifying the mechanisms for identifying, classifying, and mitigating integrity risks. The third strategy consisted of applying structured questionnaires, as presented in Appendix II, which expanded data collection to include perceptions and practices from various organizations, complementing the case study.

The analysis of the collected data was carried out in an integrated manner, combining the depth of qualitative analysis with the comparative capacity of quantitative data, aiming for triangulation and robustness of the results (Hernández Sampieri, Collado, and Lucio, 2013). Throughout the entire collection process, ethical considerations were observed, ensuring the confidentiality of the participants’ responses to the questionnaires and the anonymity of the interviewee, whose personal information was not identified, in accordance with the institution’s guidelines.

3. Results and Discussion

The introduction of Leniency Agreements into the Brazilian legal system, formalized by Law No. 12.846/2013 and regulated by Decree No. 11.129/2022, established a strict liability regime for legal persons, encouraging cooperation with the State in exchange for legal benefits. This legal framework, according to Pimenta (2020), aims not only at punishment but also at reparation of damages and the implementation of changes in corporate integrity standards. The analysis of data and perceptions of compliance professionals revealed the complexity of integrating these agreements into supplier due diligence processes, given their ambiguous nature as indicators of risk and, simultaneously, of remediation.

Initially, it was observed that in the first years of the Anti-Corruption Law’s validity, between 2014 and 2016, no Leniency Agreements were celebrated by the Comptroller General’s Office of the Union (CGU), despite 24 requests being registered. The practical application of the instrument began to consolidate from 2017 onwards, with the establishment of internal procedures for negotiation and monitoring, driven by high-profile cases. This phase marked an institutional strengthening of the Leniency Agreement as a tool for accountability and promotion of ethical practices, as Mello (2025) points out.

The expansion in the use of Leniency Agreements became evident between 2022 and 2025, culminating in 2026 with a total of 103 proposals received and 36 agreements effectively celebrated. The agreed-upon values surpassed the mark of R$ 20 billion, of which approximately R$ 11.3 billion has already been paid. These numbers demonstrate that the instrument is no longer an emergency response to specific scandals, transforming into a structured public policy for compliance and combating economic offenses, encompassing companies from various sectors and sizes, which reinforces its relevance in the corporate integrity landscape.

The survey, through a questionnaire applied to compliance professionals and related areas, revealed that, although Leniency Agreements are considered in supplier evaluation by a significant portion of companies, the formalization of objective criteria for their analysis is still limited. More than half of the respondents stated they evaluate the agreements “always” (44.1%) or “frequently” (26.5%), indicating a widespread perception of their relevance. However, 23.5% of organizations do not even incorporate this factor into their processes, evidencing a gap in the standardization and governance of evaluations.

The formalization of criteria for classifying supplier risk with Leniency Agreements has proven to be a challenge. Only 20.6% of companies have fully formalized guidelines, while 35.3% have them partially formalized or in implementation. A percentage of 20.6% considers the agreements, but without formalization, and 23.5% does not consider them applicable or relevant. This low level of formalization reflects the absence of standardized treatment, which can compromise the consistency and traceability of contracting decisions, as highlighted in the literature on risk management (OECD, 2018).

Regarding the internal approach, most companies (41.2%) do not adopt standardized guidelines or treatment for Leniency Agreements, while 29.4% use case-by-case approaches, varying the treatment according to the measures implemented after the agreement. The interpretation of agreements as predominant indicators of risk or as signs of recovery and ethical commitment was less expressive, with 14.7% for each category. This scenario points to a lack of uniformity in how organizations interpret and manage the risks associated with suppliers who have entered into Leniency Agreements.

The risk classification for suppliers with Leniency Agreements also highlighted the lack of standardization. It was found that 35.3% of companies still do not have a formal categorization for these cases. Among those that do classify, the majority categorize these suppliers as “high risk” (35.3%) or “critical” (14.7%), while the “medium” and “low” risk categories showed residual incidence. This trend of high-risk perception, although intuitive, lacks uniform criteria that allow for a more objective and less discretionary assessment.

The existence of a Leniency Agreement predominantly impacts supplier hiring or retention decision-making processes by requiring a more detailed analysis, as indicated by 64.7% of respondents. However, 20.6% of organizations do not consider this factor in their decision-making processes. The perception that the agreement strengthens the decision to hire/retain (8.8%) or discourages it (5.9%) was less representative. This suggests a predominantly cautious and non-exclusive approach, but still marked by asymmetries in how the issue is addressed by companies.

The additional due diligence procedures applied to suppliers with a Leniency Agreement varied, with emphasis on requesting complementary information and documents (58.8%) and continuous compliance monitoring (55.9%). The review of contracts and compliance clauses (47.1%) and the request for third-party audit reports (29.4%) were also frequently mentioned. It is noteworthy that 23.5% of respondents indicated not applying any additional factors, which reinforces the inconsistency in market practices and the need for clearer guidelines for managing these risks.

The most relevant factors considered in the risk assessment of suppliers with a Leniency Agreement focused on the nature and impact of the offenses, as well as the effectiveness of corrective and governance measures. The severity and scope of the illicit acts (50%), the involvement of senior management (47.1%), and the implementation and effectiveness of post-agreement compliance measures (38.2%) were the most cited. Other factors such as a history of recidivism and the degree of compliance with the obligations assumed in the agreement were also relevant (26.5% each). This data indicates that companies seek a more consistent qualification of risk, going beyond the mere existence of the agreement.

The qualitative analysis, through a case study and interview with a Legal Director of a railway logistics company, complemented the quantitative findings. It was verified that, although the company has a structured third-party evaluation procedure and an integrity risk matrix, the Leniency Agreement is not formally contemplated as an explicit criterion. However, the automated background check tool used already identifies these agreements, and, in practice, the existence of a Leniency Agreement tends to be interpreted as a high-risk factor, classifying the supplier as high or critical risk.

The interviewed Legal Director emphasized the importance of distinguishing the legal person/ entity from its administrators and partners, arguing that the execution of an agreement should not, by itself, automatically compromise the company’s reputation. The analysis must focus on the measures effectively implemented to prevent recurrence, requiring specific proof of compliance with the obligations assumed in the agreement. This perspective reinforces the idea that the Leniency Agreement, although it indicates a history of illicit acts, can also be a sign of remediation and commitment to integrity, provided that corrective actions are verifiable.

Given the absence of standardization in the evaluation of suppliers with Leniency Agreements and the coexistence of divergent interpretations, this study proposed measures to improve the availability of information in public databases and the definition of internal mechanisms by companies. It is suggested to improve the Panel of Leniency Agreements of the Comptroller General of the Union (CGU) by incorporating four new informational dimensions, which are currently dispersed in the full texts of the agreements and which could enrich the analysis.

The proposed dimensions for the CGU Panel include: (i) types of irregularities, to standardize the identification of illicit conduct and allow comparative analyses; (ii) benefits granted, to detail penalty reductions and special conditions, evaluating the proportionality between sanction and cooperation; (iii) integrity and remediation measures, to verify the commitments of prevention, control, and supervision undertaken; and (iv) compliance status of agreements, to monitor the execution of obligations, including payments and assessments by an independent auditor. The inclusion of these variables would allow for a more robust analysis of the effectiveness of the agreements.

In the business context, as long as this information is not systematically made available in public databases, it is recommended that organizations adopt their own mechanisms for data collection and standardization. This can be done through specific questionnaires or formal requests for information from suppliers that include analytical dimensions such as the nature and severity of the offenses, the involvement of senior management, the remediation measures adopted, the compliance status of the agreement, the history of recidivism, and the level of transparency. The adoption of these criteria allows the existence of a Leniency Agreement, which is an ambiguous indicator in isolation, to be transformed into a structured set of variables.

The integration of this information into organizations’ risk matrices, with the prior definition of evaluation parameters and relative weights for each dimension, is crucial to confer greater robustness to third-party contracting decisions. By linking the risk level to previously defined institutional responses, companies can reduce the discretion identified in the research findings, promote greater traceability of decisions, and align their processes with best practices in risk management and integrity. This approach contributes to a deeper and more dynamic understanding of risk, based on the contextual assessment of circumstances and potential future impacts.

In summary, the research demonstrated that, although Leniency Agreements are already a factor considered in supplier due diligence processes by most companies, their use still lacks structure and standardization. Cautious approaches prevail, requiring detailed analysis, focusing on the severity of the offenses, the involvement of senior management, and the effectiveness of remediation and governance measures. The findings reinforce the need to develop objective criteria and integrate this information into risk matrices, aiming for greater consistency, traceability, and security in supplier contracting decisions, directly responding to the objective of proposing criteria for the analysis of these agreements.

4. Conclusion

The present study aimed to analyze how the existence of Leniency Agreements influences the integrity risk assessment of suppliers in due diligence processes, proposing criteria for their analysis. It was found that, although most organizations consider Leniency Agreements in third-party assessment, unstructured practices and the absence of formalized criteria prevailed. A significant variation was observed in the classification and treatment of these cases, with Agreements being predominantly treated as an element that required detailed analysis. The findings indicated that the most relevant factors considered by companies focused on the severity and scope of the offenses, the involvement of senior management, and the implementation and effectiveness of post-agreement remediation and governance measures. This predominantly cautious, but not exclusionary, approach highlighted the need to structure objective criteria and integrate this information into risk matrices, aiming for greater consistency, traceability, and security in supplier contracting decisions.

The main contribution of this work lies in the proposition of criteria for the analysis of Leniency Agreements, both for the improvement of public databases, such as the Panel of the Comptroller General of the Union, and for the definition of internal mechanisms by companies. The incorporation of informational dimensions such as types of irregularities, benefits granted, integrity and remediation measures, and compliance status of the agreements was suggested. For organizations, the adoption of specific questionnaires was recommended, which include the nature and severity of the offenses, the involvement of senior management, remediation measures, compliance status, history of recidivism, and the level of transparency, integrating them into risk matrices. However, the research presented limitations related to the size and nature of the quantitative sample, which does not allow for broad generalizations, and to the single case study, which reflects the reality of a specific organization. For future studies, it is recommended to expand the empirical sample, including companies of different sizes and sectors, and to conduct additional interviews with professionals from the CGU and from companies that already use structured risk classification models that incorporate variables related to Leniency Agreements.

Bibliographic References

Barros, Gisela Pires Foz de. A importância da due diligence nas relações comerciais, sob a luz da Lei Anticorrupção brasileira. Conteúdo Jurídico, 02 jun. 2021. Disponível em: https://www.conteudojuridico.com.br/consulta/artigos/56629/a-importncia-da-due-diligence-nas-relaes-comerciais-sob-a-luz-da-lei-anticorrupo-brasileira. Acesso em: 05 out. 2025.

BRASIL. Controladoria-Geral da União. Programa de integridade: Diretrizes para Empresas Privadas. Volume II. Brasília, DF: CGU, 2024. Disponível em:https://www.gov.br/cgu/pt-br/assuntos/integridade-privada/materiaisdeorientacao/manuais/programa-de-integridade-diretrizes-para-empresas-privadas-vol-ii-2024.pdf . Acesso em: 5 abr. 2026.

BRASIL. Decreto nº 11.129, de 11 de julho de 2022. Regulamenta a Lei nº 12.846, de 1º de agosto de 2013, que dispõe sobre a responsabilização administrativa e civil de pessoas jurídicas por atos contra a administração pública, nacional ou estrangeira. Diário Oficial da União: seção 1, Brasília, DF, 12 jul. 2022. Disponível em: https://www.planalto.gov.br/ccivil_03/_Ato2019-2022/2022/Decreto/D11129.htm. Acesso em: 05 out. 2025.

BRASIL. Lei nº 12.846, de 1º de agosto de 2013. Dispõe sobre a responsabilização administrativa e civil de pessoas jurídicas pela prática de atos contra a administração pública, nacional ou estrangeira, e dá outras providências. Diário Oficial da União: seção 1, Brasília, DF, 2 ago. 2013. Disponível em: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2013/lei/l12846.htm. Acesso em: 05 out. 2025.

GIL, Antonio Carlos. Como elaborar projetos de pesquisa. 6. ed. Rio de Janeiro: Atlas, 2017.

HERNÁNDEZ SAMPIERI, Roberto; COLLADO, Carlos Fernández; LUCIO, María del Pilar Baptista. Metodologia de pesquisa. 5. ed. Porto Alegre: Grupo A, 2013.

MELLO, Cecilia. Acordos de leniência em 2025: balanço de um instrumento em disputa. Consultor Jurídico (ConJur), São Paulo, 11 dez. 2025. Disponível em: https://www.conjur.com.br/2025-dez-11/acordos-de-leniencia-em-2025-balanco-de-um-instrumento-em-disputa/. Acesso em: 31 jan. 2026.

OCDE. Guia da OCDE de Devida Diligência para uma Conduta Empresarial Responsável. Paris: OCDE, 2018. Disponível em: https://doi.org/10.1787/de16420f-pt. Acesso em: 25 mar. 2026.

Pimenta, Raquel de Mattos. A construção dos acordos de leniência da Lei Anticorrupção. 1. ed. São Paulo: Blucher Open Access, 2020.

TURRIONI, João Batista; MELLO, Carlos Henrique Pereira. Metodologia de pesquisa em engenharia de produção: estratégias, métodos e técnicas para condução de pesquisas quantitativas e qualitativas. Itajubá: UNIFEI, 2012.

Article originating from the Final Course Work of the Specialization in Compliance and ESG of the MBA USP/Esalq

To learn more about the course, click here and access the MBX Academy platform