Best Generalised Practices for Due Diligence

The Act and Rules require due diligence to be conducted at a product level. That means the information you gather must relate to the particular forestry inputs in the product you are actually importing or processing.

However, product-level due diligence is only part of the picture.

Great companies also have a robust supplier onboarding process, conducting broader due diligence to understand who they are doing business with and the potential legal, commercial and reputational risks that may come with that relationship.

There are a wide range of checks that may be relevant depending on your organisation, your suppliers and you specific circumstances.

The table below provides a practical overview of the key risk areas you may want to consider as part of your supplier-level due diligence.

Risk area	Check	Status
1. Genuine legal entity	Confirm exact legal name, registration number, registered address, incorporation date, status and permitted activities. Search the official corporate registry in the supplier’s country—not merely its website or certificate.	Good practice, supporting directors’ care and diligence duties: Corporations Act 2001 (Cth) ss 180–184. For an Australian presence, check ASIC and ABN Lookup. ASIC recommends checking regis tration and external-administration status: ASIC business checks
2. Authority to contract	Confirm the person negotiating and signing has the authority to do so. Check directors, authorised representatives and whether local law requires company seals, notarisation or board approval.	Good practice/contract enforceability. Relevant Australian principles of agency and execution; Corporations Act 2001 (ss 126-129) relevant where an Australian Company is involved
3. Ownership and control	Identify direct and ultimate beneficial owners, parent entities, controllers, nominees and any opaque trusts or shell companies. Understand why intermediaries are involved.	Mandatory for AML/CTF reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and Rules. Sanctions may apply to beneficial owners. AUSTRAC provides specific guidance on ownership and control.
4. Sanctions screening	Screen the supplier, directors, beneficial owners, banks, vessels, freight parties and relevant counterparties. Consider ownership or control by a sanctioned person—not only an exact name match. Examine country, goods, services and end-use restrictions.	Mandatory. Autonomous Sanctions Act 2011 (Cth); Autonomous Sanctions Regulations 2011. Use the DFAT Consolidated List and Sanctions Compliance Toolkit.
5. Money laundering and criminal proceeds	Investigate opaque ownership, inexplicable payment routes, unrelated third-party payees, tax havens, shell entities, cash or crypto requests, false invoices and transactions without commercial purpose.	Conditional mandatory AML/CTF obligations where the Australian company supplies a “designated service”: AML/CTF Act 2006. Ordinary purchasers are not automatically reporting entities merely because they pay an overseas supplier. However, dealing with criminal proceeds may breach the Criminal Code Act 1995 (Cth) div 400.
6. Politically exposed persons and state ownership	Identify foreign PEPs, relatives and close associates, state-owned enterprises and public officials connected with the supplier. Assess influence over permits, tenders or customs processes.	Mandatory for reporting entities in relevant circumstances under the AML/CTF regime. Otherwise strong anti-bribery and reputational practice. AUSTRAC’s enhanced CDD guidance covers PEPs, high-risk jurisdictions and source of funds.
7. Bank-account verification and payment fraud	Confirm the account is in the supplier’s legal name and in an expected jurisdiction. Independently verify bank details using a known phone number or registry-sourced contact. Never rely only on emailed instructions.	Good practice rather than a standalone statutory supplier check. It supports directors’ duties and fraud controls. The Australian Signals Directorate recommends calling on a known number to verify account changes: business email compromise guidance.
8. Bribery and corruption	Examine commissions, agents, consultants, gifts, facilitation payments, government touchpoints, unusual success fees and payments to personal or offshore accounts. Determine whether the supplier has adequate anti-bribery controls.	Mandatory. Foreign bribery offences and corporate failure-to-prevent provisions are in Criminal Code Act 1995 div 70, including s 70.5A. Australian companies should have “adequate procedures” and risk-based third-party controls. State secret-commission and corruption offences may also apply.
9. Modern slavery and forced labour	Risk-rate the country, product, industry and workforce. Investigate forced labour, child labour, debt bondage, recruitment fees, passport retention, migrant labour, dormitories, excessive overtime and subcontracting. Trace beyond the direct supplier where risk is elevated.	Mandatory reporting and due-diligence disclosure for reporting entities with annual consolidated revenue of at least $100 million: Modern Slavery Act 2018 (Cth), particularly ss 12–16. See Attorney-General’s Department guidance. Smaller businesses may be contractually required to provide information to their reporting-entity customers.
10. Human rights and labour conditions	Check lawful wages, working hours, freedom of association, discrimination, harassment, child labour, forced labour, occupational safety, worker accommodation and access to remedies. Consider local law and recognised international standards.	Principally reputational risk-based and contractual, but supports Modern Slavery Act reporting, directors’ duties and reputational protection. Overseas conduct may also expose the company under foreign laws or customer requirements.
11. Illegal logging and timber legality	For timber, pulp, paper and specified wood products, determine species, country and region of harvest, concession or harvest rights, supply-chain participants and legality. Assess and mitigate illegal-logging risk before importation.	Mandatory for regulated timber products. Illegal Logging Prohibition Act 2012 (Cth) and Illegal Logging Prohibition Rules 2024. Reformed requirements commenced 3 March 2025.
12. Customs and prohibited imports	Confirm tariff classification, origin, customs value, import permits, dumping duties, prohibited-import controls, country-of-origin claims and responsibility for customs declarations. Check whether goods contain restricted chemicals, weapons, asbestos or other prohibited material.	Mandatory where importing. Customs Act 1901 (Cth); Customs Tariff Act 1995; Customs (Prohibited Imports) Regulations 1956; anti-dumping legislation. General government guidance is available at Importing and your business.
13. Biosecurity	Check whether goods, packaging, pallets, timber, food, plant or animal material require permits, treatment, inspection or approved sourcing. Ensure packaging is clean and accurately declared.	Mandatory where applicable. Biosecurity Act 2015 (Cth) and subordinate legislation. Conditions should be checked in BICON before shipment
14. Product safety and Australian standards	Identify every mandatory safety and information standard, ban, electrical/gas registration, testing, labelling and recall obligation. Confirm whether overseas test reports and laboratories are acceptable in Australia.	Mandatory where applicable. Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010 (Cth), especially consumer guarantees, safety standards, bans, recalls and defective-goods liability. See ACCC product-safety responsibilities. Refer also to requirements of the NCC, deemed to satisfy provisions, testing requirements in mandatory Australian Standards.
15. Quality, composition and misleading claims	Verify specifications, composition, grade, performance, durability, origin and marketing claims. Independently substantiate “sustainable”, “recycled”, “carbon neutral”, certification and country-of-origin claims.	Mandatory. ACL ss 18, 29, 33 and relevant consumer guarantees. False environmental, origin, certification or performance claims can expose the Australian importer or seller even if the supplier provided the information.
16. Workplace health and safety	Assess risks created by imported plant, structures, equipment, chemicals and substances. Obtain information needed for safe installation, operation, maintenance and disposal. Assess the supplier’s safety record for onsite services.	Mandatory where applicable. State and territory WHS/OHS legislation. Model WHS laws impose specific duties on designers, manufacturers, importers and suppliers. Victoria instead applies the Occupational Health and Safety Act 2004(Vic). Safe Work Australia summarises importer and supplier duties for plant
17. Chemicals and hazardous materials	Check chemical inventory, classifications, Australian-compliant SDS and labels, poisons controls, asbestos/PFAS/heavy metals and environmental restrictions.	Conditional mandatory. WHS/OHS legislation; Industrial Chemicals Act 2019 (Cth); Therapeutic Goods Act 1989, agricultural/veterinary chemical, poisons, dangerous-goods and environmental laws where applicable.
18. Food, therapeutic goods and regulated products	Confirm facility approvals, ingredient legality, allergens, contamination controls, traceability, labelling, recalls and Australian registration or listing requirements.	Conditional mandatory. Food Standards Australia New Zealand Act 1991, Australia New Zealand Food Standards Code, state food laws, Therapeutic Goods Act 1989 and other product-specific schemes.
19. Environmental compliance	Examine licences, pollution, waste, water, biodiversity, hazardous materials, emissions and prior enforcement. Check CITES, ozone, hazardous-waste, product-stewardship and packaging obligations.	Conditional mandatory. Relevant Commonwealth, state and foreign laws, including the Environment Protection and Biodiversity Conservation Act 1999 (Cth), Hazardous Waste (Regulation of Exports and Imports) Act 1989, Ozone Protection and Synthetic Greenhouse Gas Management Act 1989 and Recycling and Waste Reduction Act 2020.
20. Privacy and offshore data access	Determine whether the supplier will receive or access personal information, where it will be stored, sub-processors used, government-access risk and breach response capability.	Mandatory for covered entities. Privacy Act 1988 (Cth), especially APPs 1, 6, 8 and 11 and s 16C. Before overseas disclosure, reasonable steps are generally required and the Australian entity can remain accountable: OAIC APP 8 guidance
21. Cybersecurity and operational resilience	Assess access privileges, authentication, encryption, vulnerability management, incident reporting, business continuity, data storage, backups and supply-chain dependencies. Avoid giving system access before clearance.	Usually risk-based, but may be mandatory under the Privacy Act, APRA prudential standards, Security of Critical Infrastructure Act 2018 (Cth), sector rules and directors’ duties.
22. Financial viability	Determine whether the supplier can perform for the contract term. Check insolvency, litigation, leverage, cash flow, customer concentration, commodity exposure, climate risk and insurance.	Usually good practice, supporting Corporations Act s 180 and business-continuity obligations. ASIC explains registration, financial-report and external-administration searches: ASIC business checks
23. Taxation and customs structure	Determine GST, customs, duties, withholding-tax exposure, permanent-establishment risk, royalties, interest, related-party pricing and whether treaty relief or tax residency evidence is required. Do not accept artificial invoice splitting or false origin/value declarations.	Conditional mandatory. Income Tax Assessment Acts 1936 and 1997, Taxation Administration Act 1953, A New Tax System (Goods and Services Tax) Act 1999, customs legislation and relevant tax treaties. Transfer-pricing rules are particularly relevant to related parties.
24. Competition law and conflicts	Identify common ownership with competitors, exclusivity, resale-price restrictions, bid coordination, information sharing and undisclosed personal relationships with employees.	Mandatory. Competition and Consumer Act 2010 (Cth), including cartel conduct, anti-competitive arrangements, misuse of market power and resale price maintenance.
25. Intellectual property and counterfeit goods	Confirm the supplier owns or is licensed to provide the goods, software, designs, trademarks and content. Investigate counterfeit or grey-market risk and ownership of newly created IP.	Mandatory/risk-based. Copyright Act 1968, Trade Marks Act 1995, Patents Act 1990, Designs Act 2003 and ACL misleading-conduct provisions.
26. Insurance and liability	Confirm suitable product liability, public liability, professional indemnity, workers’ compensation, marine cargo, cyber and recall cover, including territorial coverage for Australia.	Usually contractual good practice, but some insurance is legally or professionally compulsory. Confirm that the Australian buyer is not relying on an overseas policy that excludes Australian claims.
27. Subcontractors and supply-chain visibility	Identify manufacturing sites, subcontractors, labour recruiters, raw-material sources, logistics providers and any unauthorised outsourcing. Apply controls downstream.	Conditional, especially for modern slavery, sanctions, illegal logging, privacy and product safety. Direct-supplier certification alone may be insufficient where warning signs exist.
28. Litigation, enforcement and adverse media	Search for regulatory action, fraud, corruption, environmental damage, worker deaths, human-rights allegations, tax evasion, counterfeit goods, political controversy and major disputes.	Principally reputational and directors’ duty good practice. Searches should be proportionate, accurate and consistent with privacy, discrimination and defamation risks.
29. Country and geopolitical risk	Assess corruption, conflict, sanctions exposure, forced-labour prevalence, weak rule of law, currency controls, expropriation, logistics concentration and natural-disaster risk.	Risk-based, but feeds into sanctions, AML/CTF, bribery, modern slavery and directors’ duties. A country score should trigger further investigation as above.
30. Commercial and contract protection	Address specifications, inspection, acceptance, Incoterms, title and risk, warranties, indemnities, audit rights, records, notification, remediation, suspension, termination and cooperation with regulators or recalls.	Essential risk allocation. Contract terms cannot transfer all statutory liability of an Australian importer, manufacturer or seller. Ensure compliance rights are practical and enforceable in the supplier’s jurisdiction.

---

ILPA Services

Enquire Now

Services