Month: June 2021

The following is a modified excerpt from the Interos book, “The Resilience Operations Center: A New Framework for Supply Chain Risk Management,” which explores modern methods of acquiring supplier risk information and completing the supplier evaluation process. Download the ebook or request a print copy here.

Operational Resilience & The Supplier Evaluation

Having identified risks and assets, and with a clear understanding of the challenges and success factors involved in creating a Resilience Operations Center (ROC), the next important phase is completing a supplier inventory. As part of this, you’ll need to make sure you have full insight into supplier risk information, which requires a formal, rigorous supplier evaluation process.

Here are some important questions to answer as you build the supplier inventory:

• What is the scope of your supply chain risk management (SCRM) program? Organization-wide, including all affiliate companies? Limited to a specific business unit? Something else?
• Do you have an inventory, and if so, how do you know that it is complete and includes your extended supply chain?
• Do you know who your critical suppliers are and who their critical suppliers are?
• Is there a database where supplier risk information is stored and managed? Or are there multiple databases where this information resides? Is the database automated or manual (like an Excel spreadsheet)?
• What information do you collect as part of the new supplier evaluation process?
• Do you categorize your suppliers into risk domains based on the products or services they are providing to your organization or, alternatively, on the functionality provided or information that you shared with them? What role does your information classification scheme play in this process?
• Which lines of business in your organization have been granted exclusions from your standard procurement process (and may not have been included in the overall supplier inventory)? Does documentation exist for any exceptions that have been made?
• How is the supply chain inventory kept up-to-date to maintain the confidentiality, integrity, and availability of your organization’s key products or services, business processes, and information?
• How can you use the available information to achieve quick wins and build program momentum with management and your board of directors?

If you do not know the services or products that are provided by your existing suppliers, then you’ll need to review the supplier evaluation process, and determine what supplier risk information is captured up-front. 

Supplier Risk Information: Automated Discovery Versus Manual Survey

Manual survey methods for building your organization’s inventory likely have gaps or inaccuracies, given that they are based on reporting of supplier relationships by individuals. What if there was a more objective way to discover, evaluate, build, and continuously verify supplier risk information?

This “more objective way” exists — in the form of emerging automated tools and platforms, ones that leverage multi-tier, multi-factor, and continuous inventory discovery processes. These tools can use a variety of artificial intelligence technologies and include machine learning and natural language processing. This makes it possible to fill in important gaps, remove overlaps, and resolve conflicts in supplier and subcontractor inventory tiers, while continuously validating and adding to your existing supplier inventory.

As part of supplier evaluation, these tools provide actionable insights into and alerts of the risks introduced to your supply chain. They continuously monitor changes in supplier relationships and associated risk factors. Machine learning can be used to discern relationships from public, commercial, and private sources of data that are not obvious in investor/ownership, board membership, and subcontractor relationships, to name a few. Machine learning can also be used to build out more robust supplier risk information; for example, identifying ripple effects of geographic events. Natural language processing can immediately identify and alert you to negative information about suppliers in public news feeds, allowing for a proactive response before the news negatively impacts your organization.

Automated tools now exist with the ability to create and maintain a single source of truth for supplier risk information, covering financial, operations, geographic, cyber, regulatory, geopolitical, and environmental/social/governance (ESG) risks. Such tools allow centralization of your organization’s aggregated supplier risk posture and can drive key operational risk mitigation and trends in your organization’s risk reporting.

What Supplier Evaluation Data Do I Need to Get Started?

In order to leverage this opportunity effectively and efficiently, your organization would need a minimum amount of information for supplier evaluation. Otherwise, the high volume of data returned by these automated tools could overwhelm you. This baseline information includes:

• Supplier name
• Location of product or service being provided
• Relevant URLs and internet hosting details
• Critical software development organizations involved
• Names of commercial products being used or deployed
• Additional specific data, depending on defined individual use cases

Spending time upfront to carefully define use cases (for example, starting with new supplier onboarding) can help you discover supplier risk information that you were unaware of and that may need to be addressed prior to contract signing. Being aware of the constant, rapidly evolving nature of SCRM through increased use of these automated tools, along with a clear understanding of and plan for integrating these tools into your organization’s existing operating processes, are important success criteria for SCRM risk management. Their contribution to maintaining operational resilience is a game-changer in the rapidly evolving SCRM landscape, and essential for staying up-to-date on supplier risk information.

Lay the Groundwork for a Resilience Operations Center

The Resilience Operations Center book goes into more detail on supplier evaluation and other topics, including aligning a business operating model with strategic risk management objectives, identifying your risk management program’s maturity level, and defining key ROC governance processes. Get a copy of the book here and put your organization on the road to operational resilience. Then, to learn more about Interos, visit interos.ai. 

The following is an excerpt from “The Resilience Operations Center: A New Framework for Supply Chain Risk Management.” Download the ebook or request a print copy here.

With the goal of reaching and maintaining operational resilience, organizations are looking for a modern approach to supply chain risk management (SCRM) and third-party risk management (TPRM). One way organizations are working to improve their preparedness—and overcoming the deficiencies of SCRM and TPRM approaches—is adopting Resilience Operations Centers (ROC).

The ROC framework can drive better outcomes because it is based on three simple but vital principles: 1) aligning risk management and organizational goals, 2) breaking down silos, and 3) modernizing threat detection and mitigation with technologies like automation, artificial intelligence, and natural language processing. Plus, it provides the insight and agility needed to capitalize on never-before-seen opportunities.

Challenges to Operational Resilience

Of course, aligning around a new risk management approach is not always a smooth journey. There are several areas where operational resilience breakdowns can occur. The following issues and pitfalls can occur across the extended supply chain and within your own organization:

• Weak, ineffective operational risk management governance processes at the board, senior management, business unit line management, and independent enterprise risk management levels.
• Incomplete business continuity management for critical operations functions, including monitoring, scenario analysis, periodic testing and tabletop exercises, staff training, and availability.
• Lack of scenario planning and analysis to anticipate potential disruptions in supply chains. Scenario planning should be combined with forecasting to assign probabilities of occurrence of scenarios to further refine plans.
• Insecure information systems, including inadequate protections for sensitive information in transit and in storage at all locations.
• Ineffective operations monitoring, log review, and follow-up actions and reporting.

Any one of these inefficiencies could result in the loss of significant financial resources and pose additional operational risk to your organization.

ROC Success Factors

Making a ROC successful involves many factors. But following these five fundamental principles will help any organization lay the groundwork for reaping the framework’s benefits.

1. Be aware of your industry’s key operational risks. Different industries are exposed to different types of risks, along with varying levels of regulation. For example, financial services organizations focus on service interruptions to their supply chains caused by misconfigurations, misuse, and phishing/hacking. IT hygiene, focusing on active monitoring of your threat environment and proactive patching of security vulnerabilities, is a critical activity, as is having a mature software development life cycle. Manufacturing supply chain risk managers focus on disruption of logistics, transportation, and raw material procurement. Monitoring for and taking actions to address political instability, natural disasters, and the potential for black swan events such as pandemics can ensure greater operational resilience. Understanding your critical risks will allow you to focus on key mitigation steps to ensure operational resilience.
2. Don’t think you can outsource business risk and accountability. Business units often assume that once a function has been outsourced to a supplier, they are no longer accountable for that functionality or the performance of their suppliers and extended supply chains. That is not the case. Establishing appropriate oversight of these relationships is management’s responsibility. By performing quarterly supplier performance reviews based on pre-determined success criteria, this can be easily done. Outsourcing oversight also includes the ability to preserve, and, as necessary, recover services in the event of a supplier failure. All outsourced critical business services need a contingency plan for either bringing the function back in house or migrating it to a new supplier in a timely manner.
3. Maintain operating execution knowledge. Alongside accountability, the knowledge to effectively operate a business, if not carefully preserved by your organization, can disappear. You should always have a fallback plan for your suppliers to ensure your operational resilience should catastrophe strike. Preserving this knowledge within the business, with the capacity to insource or migrate the functionality should the need arise, is often neglected and can create a situation in which the ability to continue operating may be lost over time.
4. Don’t equate compliance with risk management. Your SCRM program can become overly focused on compliance and “check the box” exercises to demonstrate that suppliers have been reviewed to identify operational risks. Focus on ensuring that proper steps have been taken to mitigate risks to a level that meets your risk appetite. Compliance isn’t resilience. Use KPIs to report trending changes in the delivery of critical outsourced products and services before product or service delivery resilience is negatively impacted. This leads to the next point.
5. Focus on total cost of ownership (TCO) of your SCRM program. Your SCRM program can easily become a “Field of Dreams” endeavor in which you spend years building out an asset inventory, identifying supplier relationship managers, and performing increasingly large risk assessments without achieving risk mitigation. Risk assessments alone do not reduce operational risk. When combined with unfettered growth in the number of suppliers used by your organization, this can lead to inefficiencies in your overall risk management program and operational performance degradation. From the beginning of your program, identify quick wins that mitigate actual risks and report to all levels of management on progress being made towards greater operational resilience.

Need Operational Resilience? Get the ROC Book

The Resilience Operations Center book goes into more detail on these and other topics, including aligning a business operating model with strategic risk management objectives, identifying your risk management program’s maturity level, and defining key ROC governance processes. Get a copy of the book here and put your supply chain and your organization on the road to operational resilience.