Module 2 · Internal analysis · optional, under NDA
Your integrity exposure as your own data shows it.
We analyse your internal cases, business partners, sponsorships, donations, memberships and hospitality, and set them against the external country × sector picture. The result shows where your own footprint concentrates risk. No data moves before the NDA is signed.
What the internal analysis adds
The external analysis tells you how risky a country and sector are. The internal analysis tells you how much of that risk you actually carry: which agents and distributors you pay, where your sponsorship and donation money goes, who receives your hospitality and which cases you have already seen. Combined, the two give a prioritised list of red flags instead of a general risk map. The module is optional and runs under NDA from the first data transfer.
What we analyse
We work with the records you already keep: registers, ERP exports, case logs and partner lists. We specify the fields we need in the proposal, so nobody has to build new reports for us.
Internal cases and investigations
Allegations, whistleblower reports, investigations and their outcomes, typically as a case log. We look for patterns by country, business unit, focus area and type of conduct, and compare them with the cases in your sector.
Business-partner exposure
Agents, distributors, consultants, joint-venture partners and suppliers, mapped to the countries and sectors in your scope. Intermediaries feature in a large share of enforced bribery cases, so we look at partner type, payment structure, volumes and proximity to public officials.
Sponsorships, donations and memberships
Who receives your money outside the ordinary supply chain: sponsorship partners, charitable recipients, associations and memberships. We check recipients and purposes against the risk of disguised benefits and conflicts of interest.
Gifts, hospitality and meals
Your gifts and hospitality register, analysed by recipient group, country, value and frequency. Concentrations on public officials or on a small number of customers become visible.
Internal data in the external context
Internal data on its own says little: a commission rate or a hospitality budget only becomes a red flag in a specific country and sector. We therefore read every internal finding against the external scores for the same country × sector cell and focus area.
The internal analysis is designed to be combined with the external analysis. If you already have a current external assessment, we discuss in the scoping call whether it can serve as the reference.
- A sales agent on success fees in a market where sector cases repeatedly involve intermediaries
- Donations to organisations close to a public authority that also licenses or buys from you
- Hospitality concentrated on a few public-sector customers in a high-exposure country
- A joint-venture partner with state ownership in a sector under active enforcement
Illustrative patterns, not findings about any company.
What we need from you
- A signed NDA and, where personal data is involved, the data-protection agreement your legal team requires
- One contact in Compliance or Legal who coordinates the data intake
- Exports of the agreed registers and lists, ideally pseudonymised
- Short clarification calls if a data set needs context
What you receive
Combined risk view
External and internal results in one picture: per focus area × country × sector, with your own exposure placed against the external risk level.
Prioritised red flags
The partners, payments, cases and spending patterns that need attention first, each with the reason and the underlying data point.
Recommendations
Concrete measures per red flag and per focus area, from additional due diligence on specific partners to changes in approval thresholds.
PDF report, XLSX annex and results session
The same report structure as the external analysis, extended by the internal chapters. Confidential details stay in the annex, so the management summary can go to the board.
Our analysis is a risk assessment based on documented data. It is not legal advice and not an internal investigation.
How we handle your data
Internal data is sensitive. The rules below apply to every internal analysis and are set out in the NDA and the proposal.
NDA before any data transfer
We sign a non-disclosure agreement before we receive a single file. You can use your own template.
Data minimisation
We ask only for the fields the analysis needs. Names of employees are rarely required; pseudonymised or aggregated data is usually enough.
Secure transfer
Data is exchanged through an encrypted channel agreed with you, never as an unencrypted e-mail attachment.
Restricted access
Access is limited to the engagement team working on your analysis.
Use for your analysis only
Your data is used solely for your analysis. It is not combined with other clients' data and not used for any other purpose.
Deletion after delivery
On request, we delete your data after delivery of the report and confirm the deletion in writing. We retain only what we are legally required to keep, and only for as long as required.
Details on data protection: privacy notice.
Questions about the internal analysis
Can we commission the internal analysis on its own?
It is designed as an extension of the external analysis, because internal data needs the external country × sector picture as its benchmark. If you already have a recent external assessment, we clarify in the scoping call whether it can be used instead.
Our registers are incomplete. Is that a problem?
No. Gaps in the data are a finding in themselves, and we document them as such. We work with the data you have and state in the report where coverage is limited.
Is the internal analysis an investigation?
No. We analyse patterns and exposure, not individual misconduct. If the analysis points to a matter that needs investigating, we say so, and you decide how to proceed with your legal advisers.
Can we use our own NDA?
Yes. We sign your template or provide ours. Either way, it is signed before any data is transferred.
See where your own footprint concentrates risk.
Tell us which countries, sectors and data sets you have in mind. We clarify scope and data requirements in a free scoping call, and the NDA comes before any data.