I Learned The Hard Way That Due Diligence Has A Trust Problem. (Part 2)
Get Kirk Wallace’s stories in your inbox
Join Medium for free to get updates from this writer.
Part 2
Once I applied this to third-party risk due diligence, the real requirements became obvious.
In vendor due diligence, the goal isn’t just to produce an answer faster. It’s to make sure the process is consistent, auditable, and usable by compliance teams.
That changed how I thought about the architecture.
I stopped asking, “How do I make the model smarter?” and start asked, “How do I make the workflow harder to break?”
I ended up splitting the process into distinct stages. One part resolves the entity. Others handle sanctions, adverse media, jurisdiction, etc. Then the results come back together for review. That structure made the system feel less like a black-box and more like something a compliance team could trust.
What surprised me most was how much better the design got once I focused on control instead of cleverness.
A few things became non-negotiable:
-The workflow had to behave consistently.
-Private context had to stay separate from public research.
-Every meaningful step had to be traceable back to a source.
-Partial failures had to be recoverable without throwing away the whole run.
That last one mattered more than I expected. In compliance work, you don’t always get perfect data, perfect uptime, or perfect signals. So the system had to keep working without losing integrity.
That’s really what I learned building this due diligence workflow: in regulated environments, the model is only part of the story.
I’m still early in this, but it’s already changed how I think about AI in compliance.
Curious how others think about the balance between flexibility and audit-ability in third-party risk workflows.
