Due diligence

UCL's due diligence process aids the early identification of risks that may impact research or the good name and standing of UCL, ensuring that research is successfully undertaken.

What is due diligence?

Third-party due diligence refers to the process of gathering, and the review of, information on funders and partners to form a risk assessment of the ethical, legal, financial, and national security considerations before entering into a collaboration with that third party. 

UCL is required to carry out appropriate due diligence checks on third parties who undertake activities funded by a grant. Applying the due diligence framework will help with the early identification of any risks that may impact UCL's reputation, financial position, academic standards, and research integrity.

Once a collaboration has been agreed upon, due diligence involves ensuring compliance with the terms of the agreement and any other associated funder requirements and implementing the agreed risk management and mitigation actions during the lifetime of the research project. 

The scope and scale of due diligence can vary according to the particular collaboration and organisations concerned.

UCL due diligence process for sponsored research and innovation projects

The process outlined below aims to ensure that any potential risks of working with third-party organisations are identified and mitigated prior to initiating the research project. Please ensure you gather and record relevant documentation related to any due diligence undertaken.

All new industry organisations (UK and overseas), unless exempt, and new overseas organisations based in low- and middle-income countries (LMICs)* will undergo a standardised due diligence assessment. This assessment will be carried out by the Compliance and Assurance team upon request for a new organisation (funder or partner) to be added to Worktribe either at the point of a research grant application or contract request, as applicable.

A record will be created on Worktribe (within the organisational profile) for each new organisation set up on the system for the due diligence undertaken.

Worktribe Organisation Request Form

*For a list of LMICs visit the Organisation for Economic Co-operation and Development (OECD) Development Assistance Committee (DAC) list of official development assistance (ODA) website.

Due diligence checks for new third-party organisations

A due diligence assessment will be carried out by the Compliance and Assurance team upon request for a new organisation (funder or partner) to be added to Worktribe. 

Due diligence checks involve a review of the organisation’s entity structure, creditworthiness/financial stability, geographical and geopolitical risk, and reputational risk. Our Compliance and Assurance team can offer advice and support for researchers and academic departments for the mitigation and management of risks identified. 

Once the due diligence check is undertaken, the organisation will be set up on Worktribe. The completed due diligence reports, proposed risk mitigation, and approval will be stored on Worktribe under the documents section within the organisational profile.

Please allow up to 5 working days for the completion of the due diligence review and the organisation set up request. 

Please note:

• The process remit currently relates to new industry organisations (UK and overseas) and new overseas organisations based in LMICs. Other organisation types will not undergo a due diligence check
• Due diligence checks will be undertaken only for new organisations, i.e., organisations that are not set up on Worktribe. 
• If the organisation is already set up on Worktribe and there is no due diligence record within the organisational profile, due diligence will not be required. The only exception to this rule is if the organisation is based in a LMIC, in which case the due diligence process for overseas research partners based in LMICs outlined in the section below should be followed at the award stage
• The due diligence process is triggered automatically upon completion of the new organisation set up request form. Therefore, due diligence checks at bid submission stage cannot be requested separately.

Due diligence checks for overseas research partners based in LMICs

UK research funders are increasingly requiring UK universities to undertake a more thorough process of due diligence when it comes to sub-awarding funds overseas.

The aim is to demonstrate that Principal Investigators (PIs) and the university have the assurance that overseas research partners can demonstrate their ability to deliver the proposed research and have appropriate governance and financial controls. 

This process applies to projects where all of the criteria below are met:

• Sponsored research and innovation projects where UCL is the lead institution
• There are project partners which are based in LMICs (any country on the DAC list)
• There will be a financial transfer to overseas partners directly from UCL.

The process should be followed once the project is awarded. The due diligence review and approval should be finalised and approved before the collaboration agreement is signed. 

For new awards where UCL is the lead and with project partners based in LMICs who will receive funding directly from UCL, full due diligence should be undertaken once the project is awarded and prior to a collaboration agreement or sub-contract being signed.

Principal Investigators (PIs) are asked to send a copy of the relevant due diligence questionnaire to their overseas partner to complete. Once completed, the PI will need to send the completed questionnaire for assessment and approval to ris.duediligenceteam@ucl.ac.uk.

There are two versions of the due diligence questionnaire:

1. Short due diligence questionnaire (under £30,000): this questionnaire is to be completed for projects where the total amount of funding to be sent overseas to the partner for the duration of the project is under £30,000. This version of the questionnaire is shorter than the full questionnaire.
   Download the UCL due diligence questionnaire - under £30k (docx)
2. Full due diligence questionnaire (over £30,000): this questionnaire is to be completed for projects where the total amount of funding to be sent overseas to the partner for the duration of the project is over £30,000.
   Download the UCL due diligence questionnaire (docx)

Due diligence renewal 

If due diligence has been undertaken by UCL within the last 3 years, there is no need to follow the due diligence process. Check the organisational profile on Worktribe to find out when the last due diligence review was undertaken or email ris.duediligenceteam@ucl.ac.uk for details. 

If the due diligence renewal is due, i.e., more than 3 years have passed since the last review, it will need to be renewed once the project is awarded and before the collaboration agreement is signed. The PI/department will need to inform the Compliance and Assurance team that a due diligence renewal is required to initiate the process by emailing ris.duediligenceteam@ucl.ac.uk. 

Risk mitigation and management

When planning research activities that involve working with a new or existing third-party organisation, PIs should consider potential risks, if identified, and review these in line with the project activities.

It is recognised that some projects may give rise to greater risks than others (e.g., working in conflict-affected areas, working with vulnerable populations, conducting clinical trials, and animal experiments). It is therefore important to consider any potential risks resulting from the nature of the project.

PIs are responsible for ensuring that a risk mitigation plan is put in place for the project with advice from their department, our Compliance and Assurance team, and Contract Services team, as needed. 

PIs are required to:

• Check the Worktribe organisational profile for each organisation and consider any potential risks when planning research with third-party organisations and review these in line with the project activities
• Establish appropriate risk mitigation measures and third-party monitoring processes as required. Implement mitigating actions as early as possible and before the contract is signed. 
• Notify Contract Services where risk mitigation needs to be embedded in the contract
• Ensure that LMIC partners receiving a financial transfer from UCL have completed the UCL DD questionnaire before entering into an agreement with the partner. Provide copies of completed and authorised due diligence questionnaires to our Compliance and Assurance team by emailing ris.duediligenceteam@ucl.ac.uk
• Inform our Compliance and Assurance team of any changes to the status of the third party during the lifetime of the project where further due diligence checks or subcontract agreement may be required

For help, support, advice, and guidance on due diligence, email ris.duediligenceteam@ucl.ac.uk.

Exempt organisations

Third-party due diligence checks will not apply to any of the following:

• When the third party is an individual
• When the third party is on the Higher Education Statistics Agency (HESA ) list of UK higher education providers
• When the third party is a UK Government department, agency, or public body, or local authority in England and Wales, and Scotland.

Further guidance

• National Protective Security Authority (NPSA) Trusted Research Guidance for Academia
• UKRI Trusted Research and Innovation
• Universities UK (UUK) Guidance on Managing Risks in Internationalisation: Security-Related Issues

Third-party due diligence training

Our third-party due diligence training provides further information about our new Third Party Due Diligence Framework and process implementation. Watch the training video below to help you:

• Understand the due diligence process for new third-party organisations, why it is needed, and when it should be carried out together with the risks associated with not conducting due diligence
• Your role and responsibilities in relation to the due diligence process.

MediaCentral Widget Placeholderhttps://mediacentral.ucl.ac.uk/Player/9FHceFcj