Supply chain risk management programmes need to be updated as the risks presented by suppliers have drastically changed in recent years. Risk areas that have not previously been considered now need to be high on the agenda for compliance and procurement professionals.
Every supplier poses a unique set of risks depending on the nature of their business, their location and their industry. With awareness of the connection between a supplier’s issues and their impact on the business, a risk-based approach is the best way to manage a supply chain.
In a poll conducted during the webinar, the majority of respondents (52 percent) voted for antitrust and corruption risks as having the greatest potential to cause reputational operational damage. While these risk areas have traditionally led to serious consequences, in terms of government fines and penalties, the webinar participants contended that these results would change if a more holistic view of supply chain risk management was taken. Additionally, the compliance department has historically focused on the operational risks of suppliers while other departments, such as procurement, view risks around business continuity as being a higher priority.
It is essential that suppliers are involved from the beginning of the risk management process and that communication lines are open and frequently used.
After the initial assessment, the next step is to use questionnaires, reports, surveys and polls to gather information from your suppliers. This is a great opportunity time to learn whether or not compliance is visible or of importance to your suppliers. The right questions must be asked and these must be applicable to each third party in your supply chain.
After data is collected, it must be expertly examined and processed if companies are to mitigate the identified risks.
Once the data has been compiled, the compliance team must analyse and aggregate the information. It is important to remember the mantra ‘trust but verify’. Information and responses should not be taken at face value; they need to be validated and substantiated.
Given the information obtained, it is then the duty of companies to formulate corrective measures to minimise liabilities that could potentially lead to enforcement action or reputational damage. It is vital that these are understood by the supplier and communicated to them so that the necessary actions can be carried out.
Communication is essential during the whole process and should be fostered early on in the risk management of supply chains. Companies are likely to get more useful and thorough data if they use a collaborative approach with suppliers where their intentions are clear. If companies try to force or threaten suppliers, it can often lead to greater push-back and less forthcoming information. Documentation and creating an audit trail should also be taken into account during the entire process to anticipate possible investigations that regulatory authorities may conduct.
An effective risk management programme typically involves many different groups within a company including Procurement, Corporate Social Responsibility, Compliance, Corporate Affair, Audit and Legal. There are typically two models of risk management – centralised and decentralised – and each has its own strengths and weaknesses.
In a centralised model, the risk management programme is run and owned within a single group. This promotes consistent messaging with suppliers and allows for other departments to focus on other tasks. However, some drawbacks to this approach include internal strife over relationship ownership and suppliers feeling disconnected from the company.
With a decentralised approach, elements of the risk management programme are owned by different stakeholders within the organisation. This model promotes collaboration and benefits from the unique strengths of different functions within the company. However, suppliers can sometimes feel that they are being pulled in different directions if the messaging is not consistent, and it requires all of the relationship owners to coordinate in order to stay up-to-date on the status of the programme.
In addition, having technology support the risk management programme is essential to ensuring that procedures are being properly implemented. This is because it allows for activities to be automatically monitored and coordinated between the company and supplier.
While 47 percent of webinar participants said that they did not yet have a technological solution in place to support their supply chain risk management efforts, many confirmed that they are currently reconsidering this.
Software is just one part of the supplier risk management programme. A company team with the right capabilities must use technology in a way that complements the human element of the programme – for example via communication, on-the-ground audits, or regular interactions with suppliers. Specialists need to analyse the potential impact of risks and determine the necessary mitigating actions. Technology can remove some of the more tedious tasks of supplier risk management and allow staff to focus on the more critical elements of the programme.
It is vital that processes are proactive and predictive, so that issues do not fall through the cracks and red flags are spotted as soon as possible. The assessment of supplier risks should also not be a one-time occurrence but an ongoing process throughout the lifecycle of a supplier relationship. Companies have to evaluate suppliers against a wider scope of risks over a long period of time, and adapt to changing business processes and legal and compliance environments.
By enlisting the different skillsets of multiple departments within an organisation, a company can more effectively manage supplier risks. The risk universe is rapidly expanding and companies need to take a modern and holistic approach to supply chain risk management in order to effectively mitigate reputational risk.