Category Archives: Market Intelligence

GDPR and non-EU Spend Analytics Providers … Mortal Peril? (GDPR Part III)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

While there has been much debate within EU countries around the preparation for GDPR on the 25th of May, the level of knowledge and preparation for those suppliers of analytics platforms and services outside of the EU remains largely an unknown. Controversially, our assessment is that many customers/suppliers will have ignored it and assumed that it doesn’t apply.

If your spend analysis provider is a large, well-known brand name with a global presence, it is highly likely that they will have opted for the binding corporate rules option. This is a complex and intricate process but is essentially a means of larger data service/analytics providers applying to the EU to establish the provision. The supplier applies a BCR to one of the EU Supervisory bodies (one of the 27 EU members). These are termed Lead Authorities. Once the checks have been completed and the Lead Authority is satisfied with the adequacy of the data privacy safeguards in place, the Lead Authority decision is binding across all Supervisory authorities in other European states. However, as in much European Legislation member states may have additional requirements.

Once Binding Corporate Rules (BCR) status has been achieved:

“Binding Corporate Rules (BCRs) are designed to allow multinational companies to transfer personal data from the European Economic Area (EEA) to their affiliates located outside of the EEA in compliance with the 8th data protection principle and Article 25 of Directive 95/46/EC.”

However, what of smaller providers? No so easy – and it can become rapidly more complex.

The EU has two other provisions for managing data that contains personal information – the rule of adequacy and safeguarding.

Not surprisingly (shock) all 27 EU members meet the rule of adequacy. Adequacy is simply defined around the level of protection at national level.

For other countries who are non-EU, the EU will judge this on the national rule of law; respect for human rights, fundamental freedoms and relevant legislation, both general and sectoral, including public security, Defence; National security and Criminal law. Simple enough …

Now the bad news. There are only some 11 countries globally that are deemed to meet this level of adequacy. These include Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay. If your spend analysis provider lives in any of these countries – that’s fine. Happy days.

However, what if they don’t? The new Regulation is simple in objectivity. The GDPR change removes a controller’s (or data owner, we will explain controller and processor in the next few posts) previous ability to transfer personal data outside the EU where this is based only on your own assessment of the adequacy of the protection afforded to personal data. More work to do.

This brings us to the last option – safeguarding.

Safeguarding means just that – can the supplier offer sufficient safeguards with data containing personal information?

However – can the problem be eradicated and avoid GDPR regulations?

We will cover these areas in the next post. Our advice as always – find a lawyer who understands the regulations and can guide you either as a customer or supplier. If you are in doubt, get advice.

If you breach the regulations – it could get expensive.

Thanks, Tony.

GDPR and Procurement Spend (GDPR Part II)

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

It’s interesting that the more companies you speak to, the less certain you become about whether organizations have truly readied themselves for GDPR.

There are statistics around how companies in general are prepared for GDPR. The focus in most organizations is on the most obvious areas of a business – marketing and customer data. The Regulation is very specific around what is meant by personal data:

‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Well, spend doesn’t contain personal data … does it?

Be afraid, very afraid — spend data can be packed with personal data.

The Regulation states that in-scope data is:

Personal data that is processed wholly or partly by automated means. – Personal data that is part of a filing system or intended to be.

The only exclusions are things like immigration checks, police investigation, personal activity and personal data generated by an activity outside of EU Law.

So, should sourcing and procurement be worried? I would say yes.

In most company data sets within the EU there may be:

  • Staff reimbursement data – many companies still pay staff by setting them up as vendors;
  • Purchasing or corporate card data – many companies use an expense manager. Each card will have a name associated with it;
  • Many invoices will have line descriptions with components like consultant names, “James Smith, managing consultant”;
  • Temporary labour – the name of the person, rate and other details may be included in the invoice text.

There may be a lot more personal data across e-procurement and other data sources. Data inventory analysis is designed to identify those elements … assuming that someone has realized that spend data may contain personal information.

However, does it matter? We would say yes. A name in this type of data identifies a person very quickly. We even know who James Smith, our consultant, works for. Vendor name of course.

If you are not moving the data outside of your own environment (within the EU), the risk is reduced – but there are several elements to consider. However, if you have a spend analysis provider outside of the EU then the problems are suddenly more acute. Our guess is that many of the larger analytics providers will have scrutinized the Regulation and accommodated the required changes already.

For many smaller providers that service European clients from outside of the EU, recognition of the legislation complexities may not have even started.

The Regulation goes live in under a month. The question is – do European clients and analytics providers both inside and external to Europe have the right level of compliance – and understanding of the obligations? They aren’t optional either.

Perhaps it’s time you asked your provider if you are an EU company.

In the next article we will look at some of the complexities of spend data that sits in the GDPR domain. Part of the reason the GDPR legislation has been introduced is to fundamentally change how personal data is managed.

This isn’t a “nodding dog” legislative change – of that there is little or no doubt.

Thanks, Tony.

GDPR – who cares?

Today’s guest post is from Tony Bridger, an experienced provider of Procurement Consulting and Spend Analysis services across the Commonwealth (as well as a Lean Six Sigma Black Belt) who has been delivering value across continents for two decades. He is currently President of UK-based TrainingWorx Ltd, a provider of a wide range of Procurement and Analytic business training programs (inc. GDPR, spend analysis, project management, process improvement, etc.) and focussed short-term consulting solutions. Tony can be contacted at tony.bridger@data-trainingworx.co.uk.

The countdown has begun!

On the 25th May 2018, the European Union GDPR (General Data Protection Regulation) goes live. However, it is unlikely to be introduced with fireworks or an Olympic sized ceremony.

All 27 European members will have a GDPR supervisory body implementing on that day. As it’s an EU Regulation it has zero capacity for change in member countries. For those hoping that Brexit may dilute the Regulation – think again. This is one Regulation that governments are unlikely to attempt to repeal or amend in the short term.

Elizabeth Denham, Commissioner of the UK based Information Commissioners Office (ICO), said in a speech in 2017: “There’s a lot in the GDPR you’ll recognise from the current law, but make no mistake, this one’s a game changer for everyone”.

Like many legal changes of this size, GDPR has spawned a whole new range of enterprises and commercial activity to help organisations manage the change within the EU. However, will it have much impact on day to business? – and is anyone doing much about the impending change? UK Government:

Figures from the end of 2017 showed that more than 44% of employers were not aware of the GDPR, while a government study in January 2018 revealed that only 25% of businesses which had heard of the regulation had made any changes to their operations. (Source: Business Matters)

The ICO in the United Kingdom is certainly preparing for the implementation of the Regulations. A cursory glance on the job boards reveals a constant stream of recruiting advertisements for staff.

Clearly, they are being resourced for the change – and see work to be done. The UK ICO is clearly committed to ensuring compliance.

However, what is more alarming about the statistics on UK preparation, is that many suppliers outside of the EU are going to be directly impacted by the legislation. It is likely that many suppliers will have little or no cognizance of the impact of this change.

The fines for a breach can be staggering. For companies outside of the EU, their geographical location may mean little in litigation evasion terms. It may also exert direct pressure on supplier contracts if they seek to provide goods or services in to the EU that involve privacy data. Elizabeth Denham’s quote implies everyone.

It may also change the competitive landscape as those suppliers outside of the EU who provision for the GDPR may be perceived as a risk reduced implementation option.
What do we think will happen? May be something, may be nothing. If we could predict with any accuracy – we would become wealthy overnight.

Over a series of simple posts, we will look at some of the core building blocks of the Regulation and perhaps point out where sourcing professionals need to do stop and think about their own operations. We would also suggest that no one wants to become the precedent case for a breach.

Like many elements of business, we aren’t a legal firm – our advice is that if you think you are going to be impacted by GDPR – we strongly recommend that you seek appropriate legal advice.

Thanks, Tony.

If you can scroll through 10 pages of worthless headlines …

… sometimes you can find a gem. A costume jewelry gem, but still …

Procurement and audit … the missing link?

According to the article, while businesses spend a lot of time on the contracts and agreements, they spend little on price verification and contract compliance when all is said and done.

And that can be fixed with auditing, especially when contract compliance and audit work side-by-side.

Unfortunately it didn’t say how, or why, but presumably you’re supposed to contact the author’s chartered accounting firm (who are experts in ) for that information.

Well, fortunately for you, SI can fill in some of the gaps!

First of all, you need to audit key invoices beyond m-way match.

You all know about m-way match, where an invoice doesn’t get paid unless it has an associated PO or contract with valid pricing for valid products or services, that have been verified as delivered by a goods receipt or an accepted timesheet, but that’s just one way to prevent money from being wasted.

The next step is to ensure that the invoice is not duplicate, going to a verified supplier’s bank account or address, and complete. (Every processed invoiced, and payment, has a cost.)

And this is where most invoice processing platforms end. But there are still overspend prevention opportunities.

Were all the products undamaged and likely useable / re-saleable? And we’re they (immediately) rejected or returned? If so, a credit has to be captured and applied against the invoice immediately. It can’t go on a to-be processed list where it will sit there until the contract expires and the chance of collection is low.

Also, how many returns to the supplier since the last invoice? Were they under warranty/within the window and for the same products? If so, the organization should capture the credit right away.

And with modern electronic payment systems, it’s easy to send remittance notices that indicate what payment the invoice is for, what adjustments were made, why, and what contract the adjustments relate to (to justify them).

But this isn’t the full value of an audit.

A good audit can dive in and compare the units shipped against the estimates. The hours worked against the estimates. The expenses billed against averages. And so on. It can detect anomalies early, and detect new trends that may need to be investigated before they take over. Auditors find things other people miss. Sometimes they can find things even overworked Procurement people miss — and that’s why audit processes can help.

Any Procurement Function That Thinks Drones Have a Central Role …

Clearly doesn’t understand the goals of their function!

the doctor keeps an eye on Procurement news, even though it always

  • depresses him
    as every day it seems there is a new public scandal
  • tires him
    as many publications push the same non-innovative agenda that seems to come out of a Big 6 2007/2008 play-book

and at this time of year

  • causes major eye rolling
    because it’s conference season and it seems all the big S2P suites have to hold their shows at the same time, go head to head, and see who can come out on top in the classic Bugs and Daffy duck-season rabbit-season argument

And then, once in a while, he sees a headline so ridiculous that he has to wonder just what brand of pharmaceuticals the writers are on. As he writes this, after doing a search for “Procurement” and having the top headline be about how drones are going to be central to tomorrow’s role, he can’t decide if he should shake his head and cry or scream at the idiocy at the top of his lungs until somebody listens.

As a Procurement Professional, you have one primary goal:

  • Save Money

and two secondary goals

  • ensure availability
  • reduce spend through reduce demand

and a plethora of tertiary goals (that the C-Suite spew lots of rhetoric on, but never measure you on)

  • lean process (time) reduction
  • unit cost reduction through product redesign to use less costly / more renewable materials
  • faster acquisition time
  • proactive risk mitigation

How does a drone?

  • Save Money? It doesn’t. It costs money, can’t deliver large products, has little security, etc.
  • Ensure Availability? It doesn’t. Radio interference and your product goes off course. A small EMP and your product ends up in pieces.
  • Reduce Spend? It doesn’t. No explanation should be needed.
  • Lean Process Time? It doesn’t. They don’t go that fast. Require careful planning. And so on.
  • Reduce Unit Cost? It doesn’t. No explanation should be needed.
  • Speed up Acquisition? Unless you’re trying to get a product to the 100th floor when the elevator is broken, it doesn’t.
  • Reduce Risk? Considering another unmanned piece of hardware adds risk, it obviously doesn’t.

You use drones when you need to get products where a human shouldn’t go. And in what part of your Procurement operation are you sitting a desk somewhere humans shouldn’t be. Seriously!

Now get your drone off my lawn!