• Section 1 - Purpose
• Section 2 - Authority
• Section 3 - Scope
• Section 4 - Context
• Section 5 - Instruction
• Step 1 – CSR Active Screening
• Step 2 – RMIT Risk and Compliance Obligations
• Step 3 – Desktop Due Diligence
• Step 4 – Category Risk, Exposure and Opportunity Ratings
• Section 6 - Responsibilities
• Section 7 - Compliance

Section 1 - Purpose

(1) To provide a due diligence screening methodology which identifies individuals, businesses or organisations that have the potential to create an ethical or reputational risk to the University, so that RMIT can implement appropriate decision making, governance and risk mitigation ensuring Corporate Social Responsibility (CSR) obligations are met under the Sustainability Policy.

Section 2 - Authority

(2) Authority for this document is established by the Sustainability Policy.

Section 3 - Scope

(3) This instruction has been developed to assess all third-party engagements at RMIT (including through Controlled Entities) and forms part of a wider RMIT due diligence process.

(4) Areas of applicability for this framework may include:

1. philanthropic donations/funding sources
2. research partnerships
3. education partnerships
4. industry partnerships
5. suppliers of goods and services
6. promotional and event partners
7. commercial ventures
8. investments

Section 4 - Context

(5) Due diligence is the process of investigating the background of a sector, organisation and/or individual you are considering engagement with to assess and mitigate any potential risks associated with the proposed activity.  

(6) The aim of due diligence is to ensure risks are identified, determine whether these risks are within RMIT’s Council approved risk appetite and whether risks can be mitigated, and enable RMIT to make an informed decision about whether to commence engaging with the organisation and/or individuals, and whether to continue discussions and/or enter contract negotiations. 

(7) RMIT is a signatory to the Ten Principles of the UN Global Compact - this means operating in ways that, at a minimum, meet fundamental responsibilities in the areas of human rights, labour, environment and anti-corruption. In addition to these obligations, RMIT actively seeks opportunities to create a positive social, environmental, and community impact.  

(8) When we partner with a third party, our values and reputation become intertwined with theirs. Accepting donations, partnerships, goods or services from a third party indicates that we’re ‘happy to do business’ with them. We have a regulatory and ethical obligation to our stakeholders and wider community to be accountable for our actions and the conduct of the third parties we work with.  

(9) When undertaking due diligence on third parties, the potential risks to be considered are commercial, financial, information security, foreign interference, health & safety, ethical and reputational risks.

Section 5 - Instruction

Step 1 – CSR Active Screening

(10) An RMIT staff member engaging or managing a third party should assess if the individual, business or organisation is involved in activities that may expose RMIT to ethical or reputational risks. This may result from the nature of their business, their related parties or the activities that we may be undertaking with the partner. 

(11) The following table provides a list of activities that should prompt you to seek further information about the business, the parent company, any subsidiaries, directors and their involvement with RMIT. This list is not definitive or exhaustive but is indicative of activities that could cause ethical or reputational risks to RMIT, which will require further due diligence, and potentially, an escalated approvals process.  

Step 2 – RMIT Risk and Compliance Obligations

(12) Risk - Any due diligence process should be underpinned by the RMIT Risk Management Framework. The Enterprise Risk Management Team have developed the RMIT Risk Hub to support and assist you in understanding, assessing, managing and reporting on risks.  

(13) The RMIT Group Risk Appetite Statement sets the tone within which the RMIT Group conducts its activities. Risk appetite applies to the management of existing activities, as well as seeking out new opportunities or changes in and to its existing operations.  This should be a core step in desktop due diligence to see if the proposed activity and/or partner aligns with risk appetite. 

(14) Compliance - At RMIT our values drive our commitment to compliance as an ethical and sustainable baseline from which we conduct our operations. Compliance is everyone’s responsibility. RMIT is subject to a wide range of compliance obligations including compliance requirements under applicable laws, regulations, standards, and codes of practice.  Our approach to compliance seeks to embed and align compliance requirements across our learning and teaching, research, corporate and entity-wide operations. For more information visit Service Connect - Central Compliance.  

(15) Associated Due Diligence Processes – in order to meet compliance obligations and ensure there are rigorous processes in place to mitigate risk, RMIT has the following third-party due diligence process: 

1. Global Partnership Approval Process (GPAP)
2. Privacy Impact Assessment
3. Managing Foreign Interference Risks
4. ITS TPRA (Third-Party Risk Assessment) – covering technology, cyber, resilience & AI
5. Procurement Processes - Tenders, Supplier Registration and Vendor Management.

(16)   Modern Slavery – Under the Modern Slavery Act (Cth), RMIT is required to report annually on the steps taken to identify, risk assess and mitigate the risks of modern slavery across the RMIT Group and supply chains. For more information on assessing modern slavery risks see ‘Associated Information - Modern Slavery Risk Exposure’ (PDF). 

(17) Modern Slavery training modules are available to staff via the Workday Learning Platform and for more information on RMIT’s response to the Modern Slavery Act visit the website. 

Step 3 – Desktop Due Diligence

(18) There are several sources that can be utilised to undertake desktop-level due diligence on third parties to assess if the individual, business or organisation is involved in activities that may expose RMIT to ethical or reputational risks. These resources include:  

1. Database Scan - The RMIT Library can be used to access a range of databases with company/media insights (login with your RMIT staff or student before clicking the links) including:

   Database	Description	Usage
   	Global Databases
   MarketLine	Database of company reports, SWOT analysis and media scans.	Company structure, sectors, locations & subsidiaries.
   Factiva	Company reports for those listed on the New York stock exchange. Factiva is the major source for global newspapers, including the Australian Financial Review.	Company information and media scans to assess if there is adverse media.
   	Australian Databases
   IBIS World	Analyses 2,000 largest Australian and New Zealand companies; listed & non-listed public, private, foreign owned, trusts & government. There is an Environmental, Social and Governance (ESG) module available providing score breakdowns, customisable charts and supply chain information. The platform also contains market/industry trends, statistics and analysis.	Checking ESG issues and broader risks and insights in sectors/industries. Allows for deep dives on large ANZ companies.
   Media Sources in ProQuest Central	Major journals, databases and newspapers including the Australian Financial Review.	Company insights and media scans.
   Connect 4 (Thomson Reuters)	A collection of specialised databases providing documents and customised reports relating to companies listed on the Australian Securities Exchange (ASX). Annual Report Collection, Company Prospectuses, Bidder & Target Statements.	ASX company research and published reports, inc shareholder resolutions.
   DatAnalysis Premium	Comprehensive data on all companies listed on ASX as well as companies delisted since 1990. The database is updated daily from announcements lodged at the ASX and includes corporate details, full dividend history, operational history, financial and annual reports.	Use to understand ASX list company information and structures.
   	Other Databases
   Walk Free Global Slavery Index	Walk Free’s Global Slavery Index (GSI) provides national estimates of modern slavery for 160 countries, providing an assessment of national-level vulnerability.	Utilise to assess modern slavery risk for partners operating overseas.
   Modern Slavery Statement Register	Database of all AU Modern Slavery Reports provided by entities reporting under the Act.	Compliance and maturity of MS reporting.
   RepRisk	An environmental, social, and corporate governance (ESG) online due diligence database that allows clients to monitor and assess the risk exposure of global companies, infrastructure projects, sectors, and countries.	To request a report email csr.enquiry@rmit.edu.au
   OneTrust	OneTrust enables business users within RMIT to initiate the Third-Party Risk Assessment (TPRA) process to ensure any third-party arrangements, protects RMIT data, meets minimum security requirements, resilience and complies with RMIT security framework.	TPRA Request Form Login

(19) The Sustainability, Enterprise Risk Management, ITS and Procurement teams have a range of due diligence sources available should you need further assistance in screening third parties. Should a desktop due diligence process provide insufficient information to make a considered determination about the risk the third party may pose to RMIT, it may be necessary to engage with an external due diligence provider and have a detailed assessment undertaken.

Step 4 – Category Risk, Exposure and Opportunity Ratings

(20) Risks in RMIT’s supply chain and partnerships have been assessed and rated by industry category on the following factors:

1. Supply chain/partner risk: Each category has been rated based on severity and frequency of incidents in the relevant industry, both in Australia and in countries from which goods and materials are likely to be sourced. This rating looks at what risks and impacts are inherent in the lifecycle, including raw material extraction, processing, manufacturing, transport and packaging, use and disposal of any goods, and in the delivery of a service. It covers environmental, health and safety, human rights (including modern slavery) and corruption issues.  
2. Business exposure: Each category has been rated for the potential for RMIT’s own business, ethics or reputation being impacted by issues occurring in the supply chain. This includes:
   1. Is the risk within RMIT’s direct influence, i.e. tier 1, or further down the supply chain? 
   2. Is the purchase visible to the public or associated with RMIT’s brand? 
   3. Is the risk the focus of an activism campaign or otherwise likely to receive particular attention? 

(21) The above factors are combined to provide an overall screening risk. Please refer to the Category risk, exposure and opportunity ratings screening table in ‘Associated Information - CSR Priority Risk Categories’ (PDF).  

(22) Considering these aspects together allows us to prioritise categories that are highest in all three for attention in future engagements and current contracts. For a full explanation of the priority risk areas, see ‘Associated Information - Modern Slavery Risk Exposure’ (PDF).

Section 6 - Responsibilities

(23) The RMIT Sustainability Committee is responsible for the oversight and implementation of this Instruction. 

(24) The Sustainability Team is responsible for monitoring compliance. 

(25) All staff are required to be familiar with this instruction and utilise it as part of their third-party due engagement and monitoring processes. 

Section 7 - Compliance

(26) If a potential issue is identified through this process, the Enterprise Risk Team should be consulted to assist before proceeding. 

(27) Breaches of this Instruction are reportable via the Organisational Breach Reporting Form  and are managed in accordance with the Compliance Breach Management Procedure.  

(28) The Central Complaints and Investigations (CCI) unit has oversight of all complaints across the RMIT Group. RMIT is committed to the values of integrity, inclusion and courage and a key focus on continuous improvement to all aspects of the university’s services and operations. If you have a complaint, concern, or feedback about RMIT’s services, conduct, or operations, you can lodge it via the Complaints Portal.