What Is Due Diligence? Vetting Companies and Candidates with OSINT

Due diligence means checking whether the other side’s claims are true before you do business with a company, make an investment or hire someone. Open source intelligence is the fastest and cheapest first step of that check. This guide covers company vetting and pre-employment screening.

When is due diligence done?

• Choosing suppliers and partners: Especially when an advance payment is requested.
• Investments and acquisitions: The company’s real history, owners and risks.
• Compliance and anti-money laundering: Whether a customer or partner appears on sanctions lists.
• Hiring: Checking a candidate’s claims and suitability, especially for positions of trust.

Company vetting: claims versus records

The core idea of due diligence is simple: write what the company says about itself in one column, what others have put on record in another, and compare.

1. Company register: Date of incorporation, directors, registered address, number of employees and filed accounts. If a company says “we have been operating for 10 years” but the register shows it was set up last year, there is a serious problem.
2. Domain name: When was the website’s domain registered? Can an established company’s website be a few months old?
3. Web archive: What do past copies of the site show? Was there an empty template a few months ago?
4. Address: Is the registered address a real office, or a virtual office shared by hundreds of companies?
5. References: Contact the referee independently, using contact details you found yourself; do not call the number on the document.
6. Sanctions and adverse media screening: Do the company or its directors appear on sanctions lists or in fraud reports?

Red flags

• A claimed founding year that does not match the register
• A claimed headcount very different from the figure in the accounts
• A very new domain and a template website
• A virtual office address and a single-director company
• A large advance payment and time pressure (“pay this month and we will reserve capacity”)
• References that cannot be verified or can only be reached through numbers the company supplied

Pre-employment screening

The aim of screening a candidate is not to investigate them “from every angle” but to verify their claims and their suitability for the role. Degrees, licences and references usually check out; the most valuable finding is often a trace that reveals a job-relevant risk in a candidate who looks flawless on paper. For example, posts by a care worker candidate belittling the people they would care for.

Legal framework

• Information and consent: The candidate should be told which data will be examined and why, and the scope of the screening should be clearly defined.
• Proportionality: Only role-relevant information is researched and reported.
• Special categories of personal data: Under data protection law (KVKK in Türkiye, GDPR in the EU), data such as health, religion, political opinion and union membership are special categories; they should not be used in assessing a candidate.
• Non-discrimination: Türkiye’s Labour Law prohibits employers from treating people differently on grounds such as language, race, sex, political opinion or religion, and on grounds of pregnancy.

How to write the report

For each finding, the report states the source, the date and how the finding relates to the job. When linking an account to a person, do not settle for a single clue: look for several independent matches, such as e-mail address, username, profile picture, location and posting dates. Findings should be assessed while giving the candidate the right to respond.

Try company and candidate vetting in our due diligence missions: compare the documents in the case file and find the contradiction.