Category Archives: Risk Management

If You Need to Bring The Hammer Down, Make Sure You Have An Anvil (Analytical)!

On New Year’s Day, 2022, Anvil Analytical (Anvil) was spun out of 4C Associates to bring a stand-alone spend-analysis technology solution to the market, based on the solution that 4C had developed over the course of a decade or so. (4C was founded back in 2000 to help companies with their Supply Chain and Procurement operations, and that required a deep understanding of the supply base and spend, and that required the ability to dig deep into the organizational spend.)

However, while the solution revolves around their service-oriented spend analytics solution (which can include a contract-focussed spend analytics module), Anvil Analytical also offers a Scope-3 Carbon Tracking, a country-based Risk Intelligence, a Market & Inflation Intelligence solution, and a Project Management (Savings Tracking) module.

When we say service-oriented spend analytics solution, we mean it’s a hybrid service/DIY solution. Anvil handles the data loads and refreshes, the validations, the mappings to your chosen taxonomy (which also maps to their internal taxonomy, more on this later), the initial implementation of the system, new report (dashboard) creation and customization (a certain number of hours for this are included in the annual subscription), and monthly/quarterly check-ins and advisory. (Depending on the client’s typical refresh interval and assessment cadence.) The client does regular monitoring, analysis, project identification and creation, savings tracking, and what-if analysis on market/inflation/project trends to identify new projects that the client wants to undertake. It’s designed for a Procurement department that is sophisticated enough to understand the power of spend analytics and use a modern tool to extract the insights it needs, but doesn’t have the manpower to do a lot of deep analysis work and/or any real data analysts on staff and wants help with the heavy lifting.

Implementation

Depending on the organization size and maturity, the initial implementation and setup will take anywhere from 2 weeks to 4 months from the kick-off meeting. The first step is for the client to provide the Anvil team with data exports for the previous years [they need at least 2 years, or the year-on-year analysis won’t work, for example] from all relevant systems (ERP/AP/I2P). Anvil then manually processes subsets of these to create training sets and verification sets for its traditional AI-classification engine, trains the models, runs the verification sets, corrects the model, repeats until high accuracy, and then runs the full data set. At this point, the client is engaged, remaining errors corrected, the model retrained, and then the system is delivered. Simultaneous to the training process, they work with the client to identify any special reports or customizations the client wants to the primary reports and dashboards and build them simultaneously. Once the system is rolled out, they do an initial training session, review the primary analysis and identify initial areas for analysis, set up the support processes and methodology for the regular (incremental) data updates, and determine the goals of the monthly/quarterly cadence meetings and future training sessions. Every cadence meeting will review the results of the last update(s), identify new suppliers, and identify new analysis of interest.

With respect to validation and cleansing, they will establish data standards and formats and ensure all data adhere to them, normalize and identify suppliers against their database (or a third party database if you have a subscription to one where they have, or can develop, an API) which has almost a million suppliers, validate key pieces of supplier information (such as tax and registration ids), and fill in key missing data elements if they have it (or identify missing data that needs to be collected).

Spend Analytics

Spend analytics revolves around Materiality, Growth, Fragmentation, and Churn. Materiality, defined as a measure of both the scale of your spend and how easy it may be to access, is all about understanding the category spend breakdown, where the most spend, and possibly the most opportunity, is. Growth identifies which categories are the fastest growing (or fastest shrinking) in terms of your spend, and helps you identify where you may need more contracts, monitoring, control, or even (key) supplier development to reduce spend. Fragmentation, which measures how fragmented your spend is in each category compared to the average fragmentation that has been identified through thousand of engagements undertaken by 4C and Anvil Analytical, helps you identify [with color coding that show 50%, 75%, and 90% thresholds] where there is likely significant opportunity through consolidation (or significant opportunity to reduce risk if fragmentation is too low). Churn measures how much spend is being gobbled up by new suppliers in a category and helps you identify where you may need to introduce competition or innovation to keep costs down. This is summarized on one of the primary dashboards included in spend analysis – Deep Dives. Each of these area can be drilled into. For example, drilling into a materiality category from the main deep dive dashboard will give you your overall category spend, supplier count, high materiality supplier count, medium materiality supplier count, spend per business unit, spend per country, supplier spend per business unit, and so on. (And from here you can dive into just the higher materiality suppliers, or just one, and get the relevant insight.)

Like every other spend analysis tool, the entry point is the Summary Dashboard that summarizes your spend, on contract (if you have the contract [sub] module), supplier count, on PO, invoice count, average payment time, consolidation percentage, on-time payment, spend by L1 (top level of the) category (hierarchy), by business unit, by country, overall spend growth summary, and top X suppliers. Each of these can be drilled into for more detail. There’s also an insights dashboard that will give you, for a category, the materiality rating, growth rating, fragmentation rating, churn rating, and opportunity rating. Key insights and observations across each area (based on insights from Anvil’s market-intelligence modules, anonymized recent 4C project results or recent 4C insights, or market partners) are also included, as well as a breakdown by country, the likely chance of success against the main procurement levers (compete, consolidate, demand, or collaborate), and a Pareto analysis. It also highlights the top 5 opportunities based on spend and likely savings potential (based on market intelligence and/or a variance analysis), supplier growth by threshold, inflation impact, and index sensitivity. Finally, you can drill down to line level transactions if needed, or search for, and bring up, summary reports on any supplier in the system.

Contract Analytics

We’ll cover contract analytics next as it builds on spend analytics. In the Anvil platform, contract analytics is another set of dashboards that works off of contract metadata, which would be loaded during implementation and then updated in the regular refreshes. (Note that if you happen to be using one of their partner contract management solutions, they already have pre-built APIs and the loading of this data will take minutes. If your CLM has an API for metadata, they can build an extraction facility to extract that data as a service, and if not, they can work with flat-files as they do with spend.)

Contract Analytics is essentially another (set of) dashboard(s) and reports but focussed on breaking down spend by contract. The main dashboard will breakdown spend by on-contract vs. off contract, % category spend > XK (default 250K) on contract, suppliers on contract, expiring in the short term (3 to 9 months, for e.g.), contracts by business unit, and suppliers with > xK (default 250K) spend with no contract. Other relevant measures can be easily defined on implementation and, of course, all summaries can be drilled down to the line level. Since it’s essentially just another dimension of spend, we’ll conclude our high-level summary of it here.

Carbon Management

The Anvil Carbon Management platform was designed to help a company assess the scope 3 emissions of the goods and services they buy, segment the supply base as needed to support the different engagement approaches needed to maximize reach and results, support decisions when scores for tenders are carbon-adjusted, and determine B-corp accreditation based on carbon-based market ability.

The main entry point to the Carbon Management module is the Carbon Baseline Dashboard that allows you to drill into the spend carbon baseline, quantity carbon baseline, carbon insights, and carbon project tracker. The spend carbon baseline will give you your spend-based carbon footprint, your supplier count, and invoice count. It will break it down by Level 1 Category, Level 2 Category, and Level 3 Category. It will give it to you by supplier, by country, by business unit, and display the monthly totals relative to the supplier count. The supplier spend vs. carbon footprint breakdown can be particularly insightful when you find out that your top supplier with 5% of your spend only contributes 1% of your carbon footprint while your 11th place supplier (not included in the Top 10 report) that only accounts for 1% of your spend contributes 15% of your carbon footprint. It can happen, since carbon production is directly tied to the product/service — certain extraction and manufacturing activities are way more carbon intensive than others, and, even worse, depending on the technology being used, there can often be a 5X to 10X difference between traditional approaches and new techniques that only a few extractors/manufactures use. For example, in the EV industry, the production of a battery can produce anywhere between 2,000 and 16,000 kg of CO2. That means a poor process using materials from dirty raw material extractors can produce 8X the amount of carbon that needs to be produced. Now, it’s likely that in the automotive industry a battery supplier would be a top 10 supplier, but it might not be as obvious just how much carbon is in that Scope 3 battery supply chain vs. the steel supply chain or the electronics supply chain for the control system.

The quantity carbon baseline allows an organization to focus in on new carbon emissions between two points in time, scope 1 vs scope 2 vs scope 3, the measured % (vs estimated from third party sources), and the breakdown by business unit, country, supplier, and combination thereof.

The carbon insight dashboard allows you to drill into a summary of your carbon (project) pipeline and expected carbon savings, vs. carbon savings realized in categories in which you have undertaken improvement activities and marked such in the system (with a start date). You can drill into the forecast, the projects by status, and (potential) by business unit. The corresponding carbon savings dashboard allows you to see the carbon savings you’ve realized over time as a results of projects that have already started delivering results.

For the Carbon Management module to be a success, the organization needs to have data for each level 3 / level 4 product or service purchased. Most organizations won’t have this, and nor will their suppliers, but Anvil will work with you to produce the figures using average carbon production for the industry, category, and region using the appropriate carbon data source which may include, but is not limited to, the ONS (UK), Carnegie Mellon (USA), Project Carbon (France), and other sources they, or you, have access to that may be more accurate. This data will be updated on regular intervals when more accurate estimates and/or actual emissions tracking becomes available for a supplier, methods change as a result of development projects, or suppliers make extraction or production improvements on their own.

Note that use of this module could require significantly more services than the other modules as spend and contract analytics are more-or-less cookie-cutter, risk management is based on standard measures, and the market inflation & analytics offering is also based on market data, 4C & Anvil Analytical project results, and anonymized data from their e-Sourcing partners (which include Market Dojo and Unit4 Scan Market).

Risk Management

Once you have a grip on your carbon/GHG, you can get a grip on your risk. The risk management module tracks location based risks by country and allows you to determine the location-based risks of a supplier based on the country they are in and the risks associated with transport based on the route(s) available between an origin, intermediate, and destination country and the transport method chosen (as the risks are different for truck, rail, air, and water). When you select a country, or a set of countries that would represent a transport route, it will give you, for a slew of major risk factors, a risk score, origin rank, and total rank. These risk factors include factors such as:

  • carbon factor
  • economic quality
  • education
  • electric grid emissions
  • enterprise conditions
  • global slavery
  • governance

The idea is to provide you with a foundation on which to identify which Environmental, Social Responsibility, and Governance factors may be the most relevant to consider for a supplier, based on their location and the trade routes available to you from their location to your consumer market. This could allow you to short circuit an analysis (as you can quickly identify the most likely high risk factors that might eliminate the supplier from consideration). The data comes from 1500+ different open/publicly available sources that include the corruption perception index and transparency.org.

In addition, with the risk management module you will also get a set of risk-based spend management dashboards which profile an organization’s spend and show the likely types of risk associated with these areas.

Market Inflation & Analytics

The market inflation & analytics module provides category specific inflation projections with geographic variances to allow an organization to identify the categories where their costs are likely to rise, determine the projected spend uplift, dive into the sensitivity of each category (against a single inflation point), and, most importantly, counter supplier price increases when there is no data to support the increase.

The platform tracks over 1,000 commodity prices using indices from markets, banks, national bodies, and commodity markets and contains detailed forecasts for almost 100 commodities. The buyer can also drill into CPI Data, PPI data, SPPI power, ONS data, FRED data, Bureau of Labor Statistics data, IMF data, and Worldbank data.

The most interesting parts of the offering are the Market Insights and Buyer Power. The Market Insights integrate category risk weightings, weightings by subject matter (such as human & labour rights, business conflicts, health & safety, service performance, diversity, environment, etc.), and deep dices into constraints, drivers, opportunities and challenges from a demand/risk perspective and trends from a low, medium, high perspective which provide interesting insight into growth, models, inflation, or other factors. You can drill into a regional market and see its size, portion of global market, regional growth rate, global growth rate, average supplier maturity, average buyer maturity, and a Porter’s Five Forces analysis.

Buyer Power allows you to drill into the relevant data around buyer power vs. supplier power, which supports the Procurement levers widget in the summary dashboard (if you have the market inflation module). This insight is unique as it is based on the results of recent, anonymized, sourcing events from the client base of Anvil and its Sourcing Partners and allows you to see the expected results vs. (forecasted) inflation in the category.

Project Management

Project Management is one of the newest modules and accompanies the suite-wide UX update that is being released in December, 2023. It is standard GANTT-based project management for savings and carbon project management that integrates with the analytics and carbon modules so that an organization can also track savings/reductions over time. When we say standard capabilities, we mean that you can allocate resources, manage approvals, define tasks and milestones, track progress, get real-time updates and reports, drill into the project data, and customize it to your organizational processes. There’s nothing unusual, unexpected, or uncharacteristic, but that’s typically what you want for a project management tool.

Services

While Sourcing Innovation is focussed on products, we will note that Anvil also provides sourcing & savings project management on demand, and will manage its partner companies who execute the event for you as well as extract all of the relevant event data and push it into your systems as appropriate.

So if the hammer must fall, consider bringing it down with the Anvil’s support. It’s a solid service-oriented spend-analytics solution that can start you off with the carbon, risk, and market insights you need as well as provide a baseline of services to help your Procurement team mature in their analytics skills and get going quickly.

Source-to-Pay+ Part 9: Cyber

In Part 1 we noted that Risk Management went much beyond Supplier Risk, and the primitive Supplier “Risk” Management application that is bundled in many S2P suites. Then, in Part 2, we noted that there are risks in every supply chain entity; with the people and materials used; and with the locales they operate in. In Part 3 we moved onto an overview of Corporate Risk, in Part 4 we took on Third Party Risk (in Part 4A and Part 4B), in Part 5 we laid the foundation for Supply Chain Risk (Generic), in Part 6 we addressed the first major supply chain risk: in-transport, followed by the second major supply chain risk: lack of multi-tier visibility in Part 7. In our last article, Part 8, we discussed the baseline Analytics that should be part of all of the different risk systems we covered in Parts 3 through 7, as well as a control centre.

Today, in Part 9, we move onto Cyber Risks. In today’s hyperconnected SaaS world, nearly half of an organization’s data breaches originate in the cloud (see this recent article by Illumio on Cyber Magazine, for example). So cyber security is important, but not just for your organization — for your entire supply chain.

Note that we are not going to dive deep, there are plenty of security firms that will do that for you. We’re just going to highlight key points of risk that must be covered in your cyber security plan.

Internal Cyber Risk Monitoring and Prevention System
Risks that must be addressed.

Risk Description
E-mail Plenty of risks come in through e-mail. The biggest one you are likely aware of is fraudlent requests for payment from fraudsters posing as fake suppliers / service providers / consultants or new employees in a remote office asking you to approve an emergency payment. However, since fraudsters blast these far and wide (as it takes less work to create them), the most common fraudulent emails are usually phishing/ransom attempts where you have to click an email and enter your system login information to retain access to your email account (or another system you use). (Then they use those credentials you freely gave them to login to your systems, lock you out of them, and demand payment to unlock your account.)

Your email system needs to do more than identify an external sender. It, or the security plug in, needs

  1. to verify the originating domain of the email (since most fraudsters can’t mask the domain they send from),
  2. to identify the domain and location of the first intermediate server the message hits (since that can’t be masked unless they’ve hacked that) as well as if it matches the locale of the domain the email purports to come from, and
  3. to identify the domain of each embedded link and the company it belongs to (as fraudsters are great at registering domains just ONE letter of an actual domain and cloning the contents of the faked domain; e.g. chaEse.com vs chase.com … one is your bank, one will soon be scooped up by a fraudster who will skim account logins for a day during a “maintenance window”, then drain all the accounts dry (or at least to the transfer limits) the next day and wire the money to a foreign account in a jurisdiction with no extradition or banking treaties with the US, then empty the account the day after that, and then disappear never to be seen again …
Hacking Hackers will constantly be trying to penetrate your firewalls, the web servers and underlying operating systems of machines in the DMZ, the applications you are running, and the underlying security systems you use for monitoring and detection (but these are likely the most secure, especially if you are having them maintained and monitored by a professional, big name, IT security firm); You need to be monitoring for unusual activity, (D)DoS attacks, repeated login failures or access abandonments at particular ports or in particular application logs, and so on; You also need a few attractive honeypots that emulate the systems the hackers would want to access most, and if you don’t understand this, or why, talk to your security guru.
Ransomeware Hackers want to access your systems for two reasons, to steal money and IP or lock you out of them (if they can’t access any IP worth stealing or you don’t use any finance systems capable of [authorizing] payments) so you will pay them to get back into your systems. You need to be very careful to not only detect hacking attempts, but the installation of new software that is unrecognized / not authorized by security. This is because you could be totally screwed and have no choice but to pay the ransomware even if you do complete, incremental, daily backups across all systems because smart hackers will install the ransomware, let it sit for a few weeks or so, and then activate when you can’t roll back to a backup because you’d lose weeks or months of data (as you’d have to roll back to just before the ransomware was installed because the majority of backup systems would not be able to identify the actual file changes and there’s no way you could do a restore and not restore the ransomeware after the ransomware was discretely installed).
Infected Websites Your users love to surf, surf, surf the web and go where the hidden links take them. You can’t expect they will all keep their browsers up to date, keep the underlying OS up to date, and, simply put, not be careless. You need to enforce security software on their machine, and check for it, before that machine accesses your network and that the security software is up to date because if they visit the right infected website (from a fraudster’s point of view), it can be an instant hack and/or backdoor for the automatic installation of ransomware on their machine and/or your network.

External Cyber Risk Monitoring and Prevention System
Risks that must be addressed.

Risk Description
Compromised Supplier Site If a supplier site or system is compromised, and you engage with that system in any way, then your system could be compromised. You need a system that monitors for supplier system/site/cloud risks as well as (known) supplier breaches.
Compromised Data All of your systems run off of data. Compromised data is the easiest way to compromise a system. If an email gets intercepted and altered in-transit with a man in the middle account and the hacker changes bank account information, you’re paying a fraudster and not the supplier. If the third party risk metrics are adjusted, your system can be tricked to diverting all business to a single, new, supplier which, while a legal entity, was setup by the founder to take your money and run. And so on.
Compromised Identities Identity theft is on the rise, and it’s often the easiest way for a fraudster to get funds from a business. You need to track all known cases of identify theft associated with all individuals associated with all businesses associated with your business as you will need to do extra verifications on requests from those individuals.
Web-Based Vulnerabilities You need to be aware of where the biggest web-based vulnerabilities are in your suppliers and partners, make sure your suppliers and partners monitor and address those, and make sure you lock down your security to the max when you have to interact with their systems that are classified as high risk for vulnerability.

And more. There’s a lot of risk in cyberspace thanks to the fact that the information and financial worlds have merged, and your organization needs to be on top of it. Identify appropriate providers, or you will need very good luck to not fall victim to a significant cyber-based threat.

Source-to-Pay+ Part 8: Analytics / Control Center

In Part 1 we noted that Risk Management went much beyond Supplier Risk, and the primitive Supplier “Risk” Management application that is bundled in many S2P suites. Then, in Part 2, we noted that there are risks in every supply chain entity; with the people and materials used; and with the locales they operate in. In Part 3 we moved onto an overview of Corporate Risk, in Part 4 we took on Third Party Risk (in Part 4A and Part 4B), in Part 5 we laid the foundation for Supply Chain Risk (Generic), in Part 6 we addressed the first major supply chain risk: in-transport, followed by the second major supply chain risk: lack of multi-tier visibility in Part 7.

In almost every article to date, we’ve highlighted that a key aspect of every risk management system is good analytics, and, in particular, a good control centre to manage the data, the analytics, and the insights gained from the analytics (as well as the plans created around those insights).

Capability Description
Graph (Analytics) Support Standard analytics based on numeric data is not enough. As we have illustrated through this series, risk is more than numbers, roll ups of numbers, and trends on numbers. Risk is relationships, risk is connections, risk is propagation, risk is feedback. You have to be able to track the impacts across chains that span entities, geography, and time.

The risk application must natively support graphs, graph algorithms, and graph analytics. It must be able to count the number of impacted nodes up and down a BoM, multiple BoMs, a chain, and multiple chains. From this, it must be able to calculate an impact of a delay, a shortage, and a catastrophic failure based on BoM requirements, production times, costs, and margins.

Multi-level Metrics and Trend Analysis Even though graph analytics is key for supply chain risk analysis, good old fashioned metrics and KPIs are still key for analyzing risk potential at a point in time, and over time based on changes (and comparison to past trends that have led to risk and failure). For example, an increase in delivery times in every shipment, decreasing raw material supplies going into a source supplier that provides a refined version of that raw material, increasing failure in key components, etc. all indicate increased risk.

The application must support the definition of metrics based on arbitrary formulas, roll ups, and drill downs. It should also support basic trend analysis, allowing for comparison between time periods, similar trends, and historical trends of interest. it should also be capable of projecting the trend for an arbitrary time period in the future based upon the current trend progression and the most likely continuation based upon correlation with similar and historical trends.

Real-time Data Monitoring & Automation The application needs to integrate with third party data feeds, get (near) real-time updates, update all of the metrics the data relates to, monitor the changes against alerts, update the trends, and determine if any updates indicate trends of interest, significance, or concern. This all needs to happen automatically.

The application must support an open API, support standard data formats, be aware of standard data records used in direct supply chain, integrate with third party data feeds for all types of supply chain (risk) data out of the box, and be able to normalize all of this data into a standard data store (warehouse, lake, lakehouse, etc.). It must support rules-based alerts, integrations, monitors, and workflows to allow for appropriate automation support.

Mitigation Plans The platform must support the definition of mitigation plans, with individual actions, objectives, and impacts. Mitigation plans should support multiple stages, actions should support detailed definitions and expected outcomes, objectives should support a metric-based definition, and impacts should support detailed cost definitions.

It should be easy to instantiate an instance of a plan when a risk event is detected or defined by a user, track updates in real time as new data comes in or users define new data, track the impact of a recovery action (if it decreases the time to recovery, etc.), and auto-generate progress reports on a regular basis, as well as roll up all of the impacts, and recoveries, for users who need it. It should also support the creation of what-if scenarios to calculate the potential impacts of a potential action (in a given timeframe), and allow for cost vs impact vs margin/profit improvement calculations to help an organization determine if the action could be worth it, especially if the associated chance of success is limited.

Surveys The platform also needs to support the creation of surveys that can be distributed to multiple parties up and down the chain to collect data for analysis purposes.

The surveys must be capable of collecting numeric, type-valued, and open-valued data, as required.

Source-to-Pay+ Part 7: Multi-Tier Risk

In Part 1 we noted that Risk Management went much beyond Supplier Risk, and the primitive Supplier “Risk” Management application that is bundled in many S2P suites. Then, in Part 2, we noted that there are risks in every supply chain entity; with the people and materials used; and with the locales they operate in. In Part 3 we moved onto an overview of Corporate Risk, in Part 4 we took on Third Party Risk (in Part 4A and Part 4B), in Part 5 we laid the foundation for Supply Chain Risk (Generic), and then in Part 6 we addressed a major supply chain risk: in-transport.

As part of (generic) supply chain risk, we highlighted multi-tier risks that arise when multiple suppliers need to process materials, make sub-components, build components from those sub-components, and then assemble those components to make your product. When it takes 10,000 suppliers to make your product (which is the case with some complex electronics products), the risks are beyond what most minds can comprehend. Multi-tier risk management systems for direct supply chains must address a number of specific requirements outlined in Part 5.

Capability Description
Connections & Relationships It is incredibly important to keep track of all of the connections in the supply chain, not just the links that represent the paths of raw materials from the source into the products that your tier 1 suppliers supply you. You need to know who else your suppliers supply, any risks that poses to you (if your competitors have more influence and can steer the direction, process, and quality of the supplier); who supplies your suppliers, any risk that poses to them, and thus to you; who owns your suppliers, and any risk that creates to your organization in different countries of operations due to sanction lists; and who your suppliers contract out too, and any risks that may pose.

It is thus critical that a multi-tier supply chain risk management solution support connection graphs that can be re-oriented around any entity at any time for a quick inspection of risks posed by that entity and all entities it may in turn affect. It is also critical that the solution support drill-in at each entity for deep insights and analysis.

Bill-of-Materials The platform must support multi-level bill of materials (BoM) support. You can’t track the full supply chain if you can’t track the full product inputs all the way down to the raw material inputs for each component, sub-component, and primary part. You also need to be able to trace any product with an issue down to the supplier who made the part/sub-component/component with the issue.

The platform must make it easy to define, maintain, alter, and otherwise work with the bill of materials. It shall be easy to instantiate an instance for each supplier of a product and trace all the way down to the mine or fields the raw materials come from, or the recovery/recycling plants if the materials are being re-used in a sustainable fashion.

Manufacturing Visibility The visibility doesn’t stop at the BoM. It begins at the BoM. For each product you buy from each supplier, you need to track the supplier’s production capacity at the plant, as well as how that capacity is influenced by other products, and switchover time. (If you buy multiple products that use the same production line, then you can’t get full capacity of both.) It must be easy to see all manufacturing information related to a plant of a supplier, how many products it is associated with, and what tradeoffs are in effect when you order a specific product from a supplier.

The platform must be capable of calculating the units per hour/day/week, the switchover time, and how many units of each could be produced given a requirement for one product. (And the same must hold true for three or more different products/configurations.)

It’s critical that the platform allow for easy definition and manipulation of BoM instantiations, supplier plant nodes, manufacturing details, production line capability, and associated timings.

Public vs. Private Differentiation The platform must be able to maintain the distinction between public and private entities, specific to the countries the entities are located/headquartered in, as well as the different types of information the organization needs to keep on both from a risk perspective. In some countries, public entities are more rigorously regulated and in other countries, private entities could be more heavily regulated. The platform needs to allow a buying organization to ensure that the entities are acting appropriate to their type. Also, investments and sanctions can sometimes work differently depending on entity type.

The platform must be capable of tracking entity type, associate the entity with the relevant regulations and requirements based on the type, and alert the organization if anything changes with respect to the type or any change that could impact the type classification.

Predictive Sub-Tier Mapping A supplier may not always disclose it’s sub-tiers. In such a situation, the platform must predict which sub-tier suppliers are being used based on product type, raw material, raw material availability, available transport networks, and so on.

The platform must contain an adaptive algorithm that learns as new information becomes available, continuously updates its knowledge from market data feeds (import/export logs are often public information), and integrates with third party (commodity) markets that can predict changes over time.

Source-to-Pay+ Part 6: (In) Transport Risk

In Part 1 we noted that Risk Management went much beyond Supplier Risk, and the primitive Supplier “Risk” Management application that is bundled in many S2P suites. Then, in Part 2, we noted that there are risks in every supply chain entity; with the people and materials used; and with the locales they operate in. In Part 3 we moved onto an overview of Corporate Risk, in Part 4 we took on Third Party Risk (in Part 4A and Part 4B), and then in Part 5 we laid the foundation for Supply Chain Risk (Generic).

As part of supply chain risk, we highlighted transport mapping and tracking as a key risk that the system should track, but noted that a generic supply chain risk management system would generally not be a full featured transport risk management system because such a system would also monitor and mitigate risks of goods in-transport. (Not just risks at nodes.) Such a system has a number of specific requirements beyond the basics outlined in our last article. In this article, we are going to discuss a number of those specific requirements.

Capability Description
Modal-Specific Support Cargo can travel by land, rail, sea, or air. As a result, an in-transport platform has to recognize each of these modes, the differences between them, the data that needs to be tracked, and the data that can be obtained from carriers providing each mode.

Such a platform should integrate with industry standard data feeds from TMS (Transport Management Systems), data feeds from major carriers, GPS systems, and other systems that provide data on your shipments, where they are, and when they are expected to get to the next location if the current leg of transport does not have a real-time GPS feed.

Cold Chain/Hazardous Not all cargo can travel dry at room temperature. Some has to travel wet, some has to travel refrigerated or frozen, and some has to travel with special precautions for hazardous materials. It’s critical that such a platform be able to tag items with these tags, these transport requirements, and assess the risks associated with the transport based on carrier, route, geolocation, etc.

Such a platform must be able to detect when a risk materializes or escalates, such as the delivery time estimate being pushed forward by a week when the cargo was only expected to have a shelf-life of six (6) days when delivered, extreme weather phenomena suddenly materializing in the region of the transport vehicle, or dangerous (man-made) accidents occurring as a result of a leak, accident, or failure in transport.

Manifests/Bills of Lading The system should be capable of accepting bills of lading and cargo / shipping manifests and ensuring that the bill of lading exactly matches the shipment that is expected from the supplier, the cargo/shipping manifest exactly matches the bill of lading, and the inventory at the dock/yard matches the cargo manifest. This is the only way to minimize the chance of theft and fraud during transport. And by fraud, we don’t just mean your goods disappearing, we mean your containers and your company being used to smuggle goods into one or more countries where the goods are prohibited in those countries.

The system should also be capable of identifying carriers who have had incidents in the past, the carriers who are most at risk due to the regions they operate in, and the carriers who are most at risk due to the products they are carrying, both for you and for others (based on public manifests).

Ports The system will track detailed information on the ports that are used in the supply network. It will maintain information on port capacities / throughput, the carriers that go in and out, the equipment, the security at the dockyards, and so on. It will maintain information on the labour situation (last strike, the date the contract ends, likelihood of a strike/slowdown, etc.) as well as the available workforce.

The system should be capable of tying in weather information, local geopolitical information, economic information, and other disruptions that could affect the port, as well as any other risk-based factors that are relevant.

Canals/Straits A lot of the world’s goods flow through canals (primarily the Panama and Suez) and straits to ports that are off of lakes and seas and not on the Atlantic or Pacific Ocean. While there are the risks of natural disasters just as there are on the high seas, there are also the geopolitical risks associated with all of the countries that border the canal or strait. (Especially if they are unfriendly to the country of origin, destination, or registration of the ship.)

The system must track all of the risks specific to the canals and ports that the organization, and its carriers, use in the ocean-based transport of goods.

Warehouses/Cross-Docks Most goods procured by an organization will live in multiple warehouses in their journey through the supply chain. The suppliers, the shipper’s local cross-dock, the port warehouse, the railroad cross-dock, your primary warehouse, and the regional warehouses that supply your local retail centers or manufacturing plants, as appropriate. These docks all pose a security risk.

The system should support all of the third party risk capabilities that are relevant for the owner/operator of the warehouse, the locale the work force is in, the third parties that provide the workers, and any other risks that can be identified and monitored for.

In-Yard (Rail/Dock) Sometimes the goods are in a warehouse, and sometimes they are just in a yard at the dock or the (rail)yard waiting to be loaded on a truck or a train to be taken to a cross-dock or warehouse. The risk will be a blend of warehouse/cross-dock and port/rail risks, tailored to the relevant locale.

The system should support all of the associated third party risk capabilities that are relevant, and, as with the warehouse/cross-dock, support risks that can be identified and monitored for.

Airports/ Some goods will go by sea, some by rail, some by land, and some by air. Airports have their own class of risks — which can include hijackings, crashes, and way too many carriers and personnel in and out of shared warehouses.

Similar monitoring to in-yard, but expanded to meet the specific need of airports servicing your cargo.

Driver/Conductor/Captain The biggest risks in transport are often not the third party carriers you deal with, but the people — are they appropriately vetted, trained, certified, and monitored? Who are they associated with? Can those associates pose risks? Do they need to be monitored? If so, when and how?

This system should integrate with an employee/contractor certification and monitoring systems to at least make sure all employees/contractors assigned to the organization’s cargo have appropriate licenses, certifications, training, and insurance.

And, of course, an In-Transport Risk Management system will also need a host of generic analytics/planning/monitoring capabilities, but since many of these are common, and since stand alone risk-focussed analytics applications are also part of the plethora of offerings out there, instead of discussing these generic features in this and every other article, as we noted in our coverage of Corporate Risk, we will instead discuss these capabilities in an article dedicated to Risk Analytics and Monitoring.