Most investment teams do not need another heroic questionnaire. They need a quicker way to work out where integrity risk is likely to occur, what is worth probing, and what can wait.
That is especially true in impact investing. Teams are often small. Deals move quickly. Public information can be thin. Many investees are still building the systems that larger firms take for granted. In that setting, due diligence works best when it helps you prioritise, not when it dumps every possible risk into one folder and calls it thorough.
This checklist is a starting point. It is not a substitute for document review, interviews, or specialist support where the stakes are high. But it should help you decide where to focus.
1. What is changing if this investment happens?
Start with the decision in front of you, not the policy library.
Will the business enter new markets, hire quickly, deal with public officials, use distributors, handle more cash, build physical sites, or take on larger suppliers? Integrity risks often arise during precisely this change (a move into unfamiliar territory).
If the capital will accelerate complexity, your diligence should look forward as well as backward.
2. Where does money, discretion, or pressure concentrate?
You are looking for points where one person or a small group can approve, move, conceal, or justify important decisions.
That might include:
- founder approval of payments or hiring
- procurement controlled by one trusted insider
- sales teams under intense growth pressure
- distributors operating at arm’s length
- country managers handling permits, customs, or licensing
The point is not to assume wrongdoing. It is to identify where controls would need to work hardest if things started to drift.
3. How does the business actually win work?
Ask how revenue is generated in practice.
Does the business rely on public tenders, third-party introducers, politically exposed networks, informal agents, aggressive channel incentives, or markets where gifts and favours are treated as routine? A generic anti-bribery statement tells you very little on its own. You need to understand the route to market.
If the answer is vague, polished, or strangely frictionless, keep digging.
4. Which third parties matter most?
Most investees can produce a supplier list. Fewer can tell you which third parties create the biggest integrity exposure.
Focus on the relationships that can create leverage, opacity, or reputational harm:
- distributors
- local partners
- introducers
- customs or logistics intermediaries
- security providers
- EPC or O&M contractors
- high-dependency suppliers
Then ask what the business does before appointment, during onboarding, and after the contract is signed.
5. What evidence is there beyond declarations?
Declarations have a place. They create a record and give you something to test. But they are not the same as evidence.
If an investee says, “yes, we cover that,” ask what that looks like in practice. Which process? Which training? Which decision-maker? Which recent example? Which sites or teams does it not yet cover?
The aim is to move from having (policies, and ‘stuff’) to doing.
6. Can management explain the awkward bits plainly?
A useful interview is rarely about catching someone out. It is about seeing whether they can explain confusing areas directly and consistently.
Good signs include clear ownership, honest caveats, and a willingness to admit where systems are still catching up. Poorer signs include deflection, overconfidence, unexplained complexity, or a habit of treating every question as a challenge to authority.
You do not need theatrics here. A simple, direct follow-up often tells you more than another page of disclosure.
7. Is the speak-up and response side credible?
Many teams ask whether a whistleblowing channel exists. Fewer ask whether anyone trusts it.
If concerns arise, who handles them? Is there any route outside line management? Are third parties covered? Have past issues led to learning, or just embarrassment and silence?
This matters because many serious integrity problems are not discovered through policy reviews. They surface through complaints, awkward conversations, unusual data, or repeated low-level concerns that no one joined up early enough.
8. What would you need to believe for this risk to be acceptable?
That is the question many diligence processes skip.
Not every issue needs fixing before close. Some need explanation. Some need conditions. Some need post-investment support. Some should change the price or the structure. A few should stop the deal.
The point of integrity due diligence is not moral perfection. It is to make a better-informed decision about whether this business can carry the risk that comes with your capital.
A useful output
If this checklist works, it should leave you with three short lists:
- the issues that matter now
- the questions that still need answering
- the actions or conditions that would reduce the risk to something you can live with
That is more useful than a thick report full of unranked observations.
Impact investors often back businesses in difficult settings because the upside matters. Fair enough. But if you want the impact to last, integrity diligence has to do more than confirm that a few standard documents exist. It has to help you understand how the business really works, where pressure will rise, and which questions are worth asking before the money arrives.