Somewhere, an investment director is sitting across from a founder. She’s not reading a policy document. She’s watching his body language.
She already knows the policies exist. She read them last week. What she’s doing now is different: she’s testing whether the person in front of her actually runs the company the way those documents describe. Whether the incentives are right. Whether the team trusts each other. Whether there’s something in the room that the data room didn’t show her.
The data-plus-behaviour approach is what proper integrity due diligence looks like. It has been refined over decades and hundreds of deals. It produces results that are measurably better than the alternative.
Yet, almost nobody else does it.
Mind the behavioural gap.
Here’s a number that should bother us: 67%.
That’s the share of integrity failures caused by behavioural factors (implementation failures), not policy gaps. The anti-bribery policy exists. The conflicts-of-interest register exists. The speak-up mechanism exists. The problem is that none of them works. Not because they were poorly designed, but because nobody checked whether they were being used, trusted, or even understood by the people they were meant to protect.
Standard due diligence catches the 33%. A document review tells you whether the policies are there. An SOP tells you if the structure for implementation exists (on paper). Neither tells you whether anyone crosses the threshold of the CEO’s door, which is “always open”. It doesn’t tell you that the COO spent a day in a cell for refusing to pay a bribe, and didn’t think it worth mentioning (true story). It doesn’t surface the side businesses that the management team “automatically” know about, but, “because we’re all family here,” have never formally disclosed (another true story on a $100m deal).
These aren’t outliers. There is always a hidden story. Not necessarily a “gotcha,” but something which, if left unchecked, could crater impact and implode value. These issues are not unique to “emerging markets” either. They ring true across 80 countries and 30 sectors, over 25 years. To use AI’s favourite word, the “signals” are there, but we lack the listening skills or equipment.
So why don’t more people do this?
Document review is easy to justify. You can show someone a 50-page report and say: We checked. It’s auditable. It follows a recognisable process. If something goes wrong later, you weren’t negligent. As the old cliché goes, “No one gets fired for hiring IBM.” A ‘Big 4’ gap analysis and action plan is a common CYA (cover your ass/arse) move.
The problem is that the standard scope was designed for a different problem. It catches retrospective risks: things that have already happened, been recorded, and been filed. It misses things that look clean on paper, and we act surprised when issues surface 18 months after close. Frequently, in impact investment, the injection of capital is the very thing that creates risk. Think of a startup or growth-stage business as a bicycle or a moped. Strap on a rocket or hand the rider a bag of bullion, what could go wrong...?
There’s also a subtler issue. Document review is, at its core, a trust exercise. You’re reading what the company has written about itself (best case) and deciding whether to believe it. Every founder who has ever been through an investment process knows what investors want to see. They’ve prepared for it. In this context, you frequently see nonsense (like a reforestation project with a risk control framework built on money laundering, because a multilateral development bank required that in the first investment round).
What they haven’t prepared for is someone who knows what implementation actually looks like — who can tell the difference between a governance framework and governance, between a whistleblowing mechanism and a working one, between a team that trusts each other and a team that says it does. That is not said in judgment. I run a business. In the first years, our marketing and sales were hopeless, because that’s not my background, and I’d built the framework that “trusted advisors” told me would work, because it had for them.
What the Nordic standard actually involves
Wait, what? Nordic? Yes. I forgot to mention: the investors I see deploy the behavioural and forward-looking risk assessment are frequently from the Nordics (or a select group of family offices, often also with Northern European roots).
It starts with context, not documents. Before the deluge in the data room, you map the terrain: the country, the sector, the business model, the specific ways that risk manifests. More simply, we ask what, where, how, who, when, and why questions (in that order). A circular economy company operating near municipal contracts in a high-corruption environment with systemic human rights issues has a different risk profile from a fintech or healthcare disruptor in the same country. Generic due diligence treats them the same. It shouldn’t.
Then you look at how the business actually runs. Not what the org chart says; how authority really flows, where discretion sits, what the unwritten rules are. You talk to people across the organisation. You listen for what isn’t said as much as what is (my go-to here is Abraham Wald’s US bomber thesis, covered in a previous post). You notice when a question gets answered too quickly, or too lengthily, or with a slight change of subject.
Then you test the implementation. Not “does the framework exist?” but “show me the output.” Not “do you have a speak-up mechanism?” but “when was the last report, what was it about, and how was it resolved?”
Finally, you produce findings that are decision-ready. Not a 60-page report that maps every possible risk and proposes 47 actions. A short, honest assessment, rightsizing and prioritising risk, identifying what can be fixed and how, and what needs to be in place before close; something an investment committee can use.
The result is an implementation rate above 90% (i.e., the investee ‘gets it’). The industry average is under 25%. To get here, you need to make the time for brevity; as Mark Twain put it, “I didn’t have time to write a short letter, so I wrote a long one instead.” Making the time for staggered, concise prioritisation at the start saves aeons of time (and vaults of money) through the portfolio lifecycle, and especially at exit.
Ask yourself one uncomfortable question
Most integrity failures in impact investing are not cases of investors backing obviously bad actors. They’re cases of investors backing companies that looked fine, had clean policies, passed standard checks, and then had a human problem, or a governance collapse, or a culture that failed to grow (less beautiful tree, more biohazard). Looking at it from my prior perspective (as an investigator), most integrity failures are not people choosing to be ‘baddies,’ it’s a succession of poor decisions and rationalisations made under pressure.
The question isn’t whether your current due diligence process is better than nothing. It almost certainly is. The question is whether it’s good enough to catch the things that might actually happen.
The Nordic standardbearers learned the hard way, so now we don’t have to. So why aren’t more investors using this methodology? Well, I told you I’m not great at marketing, and the investors have little incentive to share this competitive advantage! If you do want to learn more, have a read here, or click the image below.
