Co-Managing Supplier Risk: Part 2 – A Case for Co-managing

In Part 1 of this series, we looked at how the trend towards outsourcing, combined with ever-greater regulatory burdens, has made managing supplier and third-party risk increasingly important, difficult, and expensive. We also examined why the traditional approach to prioritizing supplier management resources falls short when it comes to managing risks. In this part two, we look at a new approach: segmenting risk tasks and having a third party co-manage the tactical risk tasks to reduce costs and risks simultaneously.

Segmenting Risk Management Tasks

The way suppliers are typically segmented may work well for prioritizing procurement resources on supplier selection, managing supplier performance, and supporting and developing strategic suppliers. But it doesn’t always work well for prioritizing resources on risk management and compliance. Many B and C suppliers may be easily switched, but still represent large material risks to the company (such as litigation or regulatory fines).

One answer to more effectively manage supplier risks is to segment the work into strategic vs. tactical risk management tasks, regardless of which tier the supplier falls in. Figure 1 below illustrates an example supplier risk framework, with various categories of risks, showing strategic vs. tactical risk management tasks for four of the example risk types.

• Strategic tasks — require decision making, policy setting, and intelligence and deeper understanding about the company and its unique situation.
• Tactical tasks — are routine and automatable, involving collecting, maintaining, managing, and monitoring large volumes of data.

Micro-segmenting Risk Requirements for Labor-Intensive Tactical Tasks

In this way, suppliers are micro-segmented, based on the policies and rules created by the company’s own internal experts. This ensures the appropriate labor-intensive tactical tasks are performed, only when needed, based on the risk-exposure rules (type of service/product, geography, etc.), ensuring the right data is collected and the appropriate resources are applied. This provides optimal deployment of limited risk management resources, based on the actual risks.

Co-managing Supplier Risk

Done right, this is not your typical “throw it over the wall” business process outsourcing. Rather, the tactical tasks need to be interwoven into the firm’s overall supplier management processes. These are co-managed processes rather than fully outsourced processes. For example, supplier on-boarding may be initiated and managed by a commodity manager or buyer in the sourcing and procurement group, who sends the invitation, interacts with the supplier and monitors progress. But this could trigger key tasks at each step done by a third party, such as launching a survey, requesting certificates, validating responses, and so forth. All of the information is then collected and is available to the internal sourcing and risk and compliance team members and decision maker.

As shown in Figure 2, these co-managed activities can be done by a combination of the internal sourcing or risk staff, the supplier portal / risk management platform, the supplier/trading partner, and third party co-managed service provider. Key activities include:

• Strategy, Program Design, Governance — Knowledgeable, empowered senior staff should lead the design and creation of risk programs.
• Policy Making, Rules Design, Segmentation — Subject matter experts create the policies and design the rules so that the right diligence is done for each circumstance.
• Platform Design, Implementation, Updating — The platform executes those rules. Often the solution provider or system integrator will provide the technology expertise to implement the platform, working hand-in-hand with the subject matter experts to configure the rules engine and workflows. Internal IT staff may learn how to take over the configuration and management of the system or it may be run by the service provider as an ongoing managed service.
• Keeping Up-to-Date with Regulations, Customer Mandates – third party can help tremendously with this herculean task, updating the platform as needed and, when necessary, alerting the internal experts when regulatory changes will impact strategy, policy, program, and rules.
• Data Collection and Management — This is the type of tactical, labor-intensive activity well-suited to a third party that specializes in collecting and organizing surveys, supplier data, etc. A good technology platform can reduce the workload greatly, while ensuring data accuracy and completeness.
• Screening, Due Diligence, Follow-up — Labor-intensive tasks well-suited to specialist service providers.
• Ongoing Monitoring and Alerts – good monitoring and alerting platform is key. But somebody has to be there to initiate corrective actions. This can be a co-managed process, with a third party being the first line of action for mundane alerts while internal experts handle more complex or high consequence issues.
• Mitigation and Remediation – good platform provides tools to organize the response. Internal experts within a company need to own the response to ensure that large looming risks are being properly resolved.

The ROI of Co-Managed Supplier Risk Management

There are two sides to the ROI equation for co-managed supplier risk management:

• Reducing Cost-of-Diligence — the total amount spent in supplier due diligence and risk management
• Reducing Cost-of-Damages — the ongoing risks; likelihood and actual cost of supplier-induced damages

Reducing Cost-of-Diligence

Many if not most companies are quite inefficient at tactical supplier diligence processes. They have a hodge-podge of procurement professionals chasing suppliers to fill out surveys and submit insurance and other certificates; safety people chasing down suppliers’ safety guidelines/manuals or OSHA incident report; legal chasing down their FCPA or CFPB program compliance; and so forth. For most of these people, this is an ancillary part of their job (and often one of the least rewarding parts). Further, these are often not unified in one system, so finding the information after it is collected can be like searching for a needle in a haystack, wasting more precious time and resources.

There are a number of reasons that third parties that specialize in providing tactical supplier risk management services can do them much more cost-effectively than in-house efforts:

• Economies of Scale — Third parties that serve hundreds of companies can realize efficiencies not possible in individual companies. When there are significant overlaps in the supplier base of the provider’s clients, then the data can be collected once and reused many times, especially for standard data.
• Economies of Specialization — The service provider specializes in these tactical tasks. It is their core competency, not an ancillary task as it is for internal teams. This enables the third party to learn over time and make the investments needed to become excellent at these tasks.
• Investment in Technology — Because it is core to their business, service providers will typically invest heavily in platforms to streamline the collection, maintenance, monitoring, and searching of supplier risk documents, certificates, surveys, and data. This not only saves a tremendous amount of labor, but dramatically improves the consistency and quality of the data collected. It also allows for supplier self-service and ease of locating documents and data in a centralized repository.
• Accumulated Expertise — Experienced providers have developed methodologies, processes, and libraries of templates using knowledge accumulated over the years. Having worked with hundreds of different companies, they have learned what works and doesn’t work and can guide clients to best practices.
• Up to date — Often a provider has a team dedicated to keeping up with regulatory changes, denied party list updates, and legislation, to make sure their clients stay in compliance. It is virtually impossible for an internal team to dedicate this level or resources to staying current on such a huge volume of regulation and rules.

Reducing Cost-of-Damages

Because it takes so much effort and the people doing the chasing may feel it is not their top priority, many organizations simply do less of the required diligence and/or do it very inconsistently. This results in increased exposures and a resulting increase in supplier incidents, accidents, law suits, insurance claims, regulatory audits and fines, and getting the company’s name in the newspaper in ways that do not make the C-team or shareholders happy.

Many of these damages can be measured on an annual basis, such as the number and cost of supplier accidents per year, number and cost of law suits or insurance claims filed per year across the firm, and so forth. For less frequent risks, the cost and probability of supplier damage can be estimated, such as potential impact of FCPA violations, exposure and cost of IP compromise, theft of corporate secrets or valuable property theft, impact of IT security breaches, and so on.

A co-managed process can help to significantly reduce the cost-of-damages in several ways:

• Improved Initial Risk Awareness/Identification — More risks are exposed during the due diligence process, at which time actions can be taken to avoid those risks (e.g. insist on proper insurance, use another supplier, etc.) thereby reducing future losses.
• Increased Completeness of Risk Diligence / Number of Suppliers Managed — When properly integrated into a firm’s supplier management processes, these systems create consistency in diligence across the enterprise, which is especially critical for decentralized procurement decisions. The disciplines, processes, and systems brought by an experienced third party provider can generate huge improvements in the number and percent of suppliers for which the proper due diligence is performed and the depth and completeness of that diligence. The result is a dramatic reduction in incidents and damages.
• Improved Ongoing Risk Awareness and Response — When a third party service has well-developed monitoring capabilities, then emergent risks are discovered much sooner as they arise, giving more time to deal with them. Combined with mature technology for instantly gathering all of the right intelligence, the internal team has more options and can execute an optimal response, further avoiding losses.

By measuring your firm’s current cost-of-diligence and cost-of-damages and the potential improvements to both, a strong case can be made based on the ROI of co-managed tactical supplier risk management. The ROI is even more pronounced when the program is supplier-funded, as many companies have done.

____________________________

Resources:

Risk Management

Supplier Management

_________________________________________________________________

¹ For more on co-managed processes, see “New Models for Improving Supply Chain Processes and Performance”
— Return to article text above

---

To view other articles from this issue of the brief, click here.