Skip to content


Harry Cassin
Publisher and Editor

Andy Spalding
Senior Editor

Jessica Tillipman
Senior Editor

Bill Steinman
Senior Editor

Richard L. Cassin
Editor at Large

Elizabeth K. Spahn
Editor Emeritus

Cody Worthington
Contributing Editor

Julie DiMauro
Contributing Editor

Thomas Fox
Contributing Editor

Marc Alain Bohn
Contributing Editor

Bill Waite
Contributing Editor

Shruti J. Shah
Contributing Editor

Russell A. Stamets
Contributing Editor

Richard Bistrong
Contributing Editor

Eric Carlson
Contributing Editor

Bill Waite on Unaoil: Certification versus Investigation

I have not had sight of the TRACE reports into Unaoil but no doubt in time they will become public. I am confident that TRACE did what it was contracted to do and exercised skill and care in so doing. It is a professional organization.

Unfortunately, however, its certification process is not and could not be expected to identify what appears to have been inherent corruption within Unaoil. Checking public records, receiving “helpful” responses from the company’s officers and employees and taking up references which the target organisation provides is not particularly penetrating or incisive. It is meant to check details provided by the target and confirm their accuracy or otherwise.

Such a process may have a place in a risk management program particularly in environments which are data rich and where the data is inherently reliable, and where the third party with whom the client is intending to contract is low risk. That cannot be said of Unaoil and nor can it be said of the environments in which it operated.    

What is apparent from the media reports into Unaoil is not a failure of TRACE, but a failure of the risk management process which identified a certification process as the right risk mitigation tool to deploy. Unaoil was after all an intermediary used to secure contracts, was paid on a commission, and operated in war-torn States with either weak or non existent governance processes. It is somewhat difficult to conceive of a relationship which required more vigorous attention.

Last year Hui Chen was appointed by the Department of Justice to assist its prosecutors review and opine on the effectiveness, or otherwise, of corporate compliance programs. Unaoil is a poster child for her mandate. 

But it is not, with respect to TRACE, right to suggest that in order to identify significant regulatory risk one has to have access to the internal communications of the target  organisation.

For those that had the mandate — and, critically, the appropriate resources to look — there was much that could be found about Unaoil from human intelligence sources and other materials which would cause any discerning corporation to decline what Unaoil had to offer.


Bill Waite is a contributing editor of the FCPA Blog. He’s one of the founders of The Risk Advisory Group, established in 1997 with the objective of building Europe’s leading independent risk management consultancy. He serves as the group’s CEO and general counsel. He formerly practiced as a criminal barrister before joining the U.K. Serious Fraud Office in 1991 as a prosecutor. He can be contacted here.

Share this post



  1. This raises some great points. The expose on Unaoil referred to persistent industry rumors about their corrupt activity. If a proper investigative process was followed, i.e. interviewing human sources other than Unaoil themselves, or persons put forward by Unaoil as references, these allegations may have come to light in a due diligence review.

  2. Bill makes some excellent points about the context of due diligence. TRACE, like many due diligence organizations, typically has no insight into the deal specifics or how a particular third party will be used and indeed that can evolve over time. There are third parties that provide both very routine, low-risk services to one company, which don’t justify an expensive on-the-ground investigation, while also providing much higher-risk services for others, which do. Each requires its own analysis.

  3. I thought Alexandra Wrage's post in this forum yesterday mentioned that Unaoil had been investigated not once but twice by one of the "boots on the ground" investigations firms, and by external legal counsel with expertise in anti-corruption, and by a Big 4 accounting firm – and none of them caught on.

  4. I'm not sure your premise holds, i.e., that the risk management process failed by selecting the wrong "tool." TRACE is sophisticated enough to realize that certification is insufficient, given UNAOIL's business model and the regions in which it operated. Third party diligence firms don't operate with blinders on. They have a duty to apprise the client of the compliance measures that should be taken to reasonably mitigate the risk.

Comments are closed for this article!