Method
Five steps, sources for every finding.
Our method is designed so that every rating can be traced back to evidence, every assumption is stated, and the result holds up when the board, an auditor or a counterparty asks how it was reached.
From first call to results session
The sequence is the same for every engagement. What changes is the scope: the countries, sectors, focus areas and modules you choose.
Step 1: Scoping callFree
We clarify the decision you are preparing and the scope that answers it.
- Countries, sectors, focus areas and modules: which combination does the decision actually require?
- Decision context: market entry, transaction, board reporting or annual risk assessment, and who will use the result.
- Competitors to include in the case research, if any.
- For the internal module: which data exists, in which form, and who owns it.
OutputA shared understanding of the scope and the questions the analysis must answer.Step 2: Proposal
A written proposal with fixed scope, timeline and price.
- The scope matrix: every country × sector combination and every focus area covered.
- Timeline with the research cut-off date and the date of the results session.
- Fixed price for the agreed scope. Changes are only made by agreement.
- For the internal module: the draft NDA and the list of data fields we need.
OutputA proposal you can approve internally, with no open-ended effort.Step 3: Research and data intake
Public sources for the external module; internal data only after the NDA is signed.
- Legislation, authority publications, decisions and court records per country and focus area.
- Sector and competitor cases from primary sources, supplemented by reputable press and NGO reports.
- Indicators collected with their publication date and methodology notes.
- Internal data received through the agreed encrypted channel, checked for completeness and minimised.
OutputA documented evidence base with a source for every data point.Step 4: Analysis and scoring
Likelihood × impact per focus area and country, with the reasoning written down.
- Each cell is rated on likelihood and impact on five-level scales, then combined into a five-level rating.
- Analyst judgement is documented: which evidence weighed most and why.
- Case patterns and red flags are extracted and linked to the ratings they support.
- A second analyst reviews ratings and sources before anything is finalised.
OutputReviewed ratings, case patterns and recommended measures.Step 5: Delivery and walkthrough
PDF report, XLSX annex and a results session with your team.
- PDF report: management summary, heatmap, a chapter per focus area, case patterns and red flags, recommended measures, source register.
- XLSX annex: case register, indicator tables and scoring sheet, ready for your own risk register.
- Results session with Legal and Compliance and, if needed, management.
- On request: deletion of internal data with written confirmation.
OutputA documented, source-backed basis for your decision.
The NDA process
The external module works from public sources and needs no NDA. As soon as internal data is involved, the following sequence applies, without exception.
1. NDA before data
We send the draft NDA with the proposal. No internal data is shared before it is signed by both sides.
2. Field list and minimisation
We specify which fields we need and why. Pseudonymised or aggregated data is the default.
3. Encrypted transfer
Data is exchanged only via the encrypted channel defined in the NDA. Access is limited to the engagement team.
4. Purpose limitation
Your data is used for your analysis only, never for other clients or benchmarks.
5. Deletion
On request we delete your data after delivery and confirm the deletion in writing, subject only to statutory retention duties.
More on the internal module: Internal analysis.
Source standards
A risk rating is only as good as the evidence behind it. We follow a fixed hierarchy of sources and reference every finding, so that you can check any statement in the report yourself.
Primary sources first
Legislation and official guidance, authority press releases and decisions, court records and official registers. Where a primary source exists, we cite it.
Secondary sources as supplement
Reputable press, specialist publications and NGO reports, used where primary sources are not public, and marked as such.
Indicators as context, not as verdict
Indices such as the Corruption Perceptions Index, the Basel AML Index and FATF listings are cited with their publication date. We state what they measure and where they fall short: perception-based, country-level only, and often a year or more behind events.
Every finding referenced, every source dated
The source register lists each source with its date and the date we accessed it. The report states its research cut-off date.
How we score: likelihood × impact
We rate each focus area per country and, where the scope includes sectors, per country × sector. Two questions drive every rating: how likely is it that the risk materialises for a company in this position, and how severe would the consequences be?
Both dimensions are assessed on five-level scales. The combination determines the rating shown in the heatmap. We do not hide judgement behind formulas: where evidence is thin or contradictory, we say so, and the reasoning for each rating is written down in the scoring sheet.
| Level | Rating | Description |
|---|---|---|
| 1 | Remote | No relevant cases or enforcement patterns; strong institutions and controls in the environment. |
| 2 | Unlikely | Isolated cases, not specific to the sector; enforcement predictable. |
| 3 | Possible | Recurring cases in the country or sector; known risk patterns in typical business processes. |
| 4 | Likely | Frequent cases in the sector, including at comparable companies; structural risk factors present. |
| 5 | Almost certain | Risk patterns are systemic and documented; exposure is difficult to avoid without specific controls. |
| Level | Rating | Description |
|---|---|---|
| 1 | Minor | Limited financial or legal consequences; no lasting effect on reputation or operations. |
| 2 | Moderate | Noticeable fines or remediation costs; contained reputational effect. |
| 3 | Significant | Substantial sanctions or costs, management attention, possible effects on business relationships. |
| 4 | Major | Severe sanctions, exclusion from tenders or markets, extraterritorial enforcement, lasting reputational damage. |
| 5 | Critical | Consequences that threaten the business line or the company, including personal liability of management. |
Rating
Likelihood and impact are combined into five rating levels. A high impact can lift a moderate likelihood into a higher band, and vice versa; the scoring sheet shows both values and the reasoning for each cell.
| Level | Rating | Description |
|---|---|---|
| 1 | Low | Standard controls are sufficient; monitor as part of routine compliance. |
| 2 | Moderate | Targeted attention in policies and training; periodic review. |
| 3 | Elevated | Specific controls recommended, for example enhanced third-party due diligence. |
| 4 | High | Priority measures and management attention required before or during the activity. |
| 5 | Very high | Proceed only with substantial safeguards, or reconsider the activity. |
Ratings express a documented risk assessment as of the research cut-off date. They are not a legal opinion and not a prediction of individual outcomes.
Quality assurance
- Four-eyes review: a second analyst checks every rating and its sources before delivery.
- Source register: every finding in the report is referenced, every source is dated.
- Reproducibility: the scoring sheet in the XLSX annex shows likelihood, impact and reasoning for every cell.
- Fact and assessment are kept apart: the report marks clearly what is documented and what is our judgement.
- Not legal advice: we assess risk; where a legal question arises, we flag it for your legal counsel.
Questions about the method
How long does an analysis take?
It depends on the scope: the number of countries, sectors and focus areas, and whether the internal module is included. The proposal states the timeline and the date of the results session.
Can we adapt the scales to our own risk methodology?
Yes. If your company uses its own likelihood and impact definitions, we can map our ratings to them, so that the results flow directly into your risk register. We agree this in the proposal.
Is the analysis legal advice?
No. It is a documented risk assessment. Where a finding raises a legal question, we flag it so that your legal counsel can address it.
Can the analysis be repeated?
Yes. Because ratings, reasoning and sources are documented cell by cell, a later update uses the same structure and shows what has changed since the previous cut-off date.
Start with a free scoping call.
Tell us your countries, sectors and the decision you are preparing.