Winter is Hard on LOLCats in Logistics

Should All Service Spend Be Subject to Procurement

Last week, Spend Matters UK ran a great post that asked “why do executives employ their friends as consultants”, which noted that one of the most problematical spend categories is professional services, and in some organizations, this is even more problematic than contingent labour spend, marketing spend, and legal spend. Why? Not only do some executives in some firms often engage senior experts and big 5 consulting firms on six, seven, and eight figure (plus) deals without any notice or without any respect for the process, but they often do so without any background checks or references whatsoever.

Sometimes, as pointed out by the public defender, the consulting firm or expert is being hired because the consulting firm or expert was hired in the past and did a great job, and, more importantly, there is a need for speed.

Sometimes, as also pointed out by the public defender, the budget holder is simply lazy. He knows the consulting firm or expert will do an okay job, and that’s good enough for him.

But sometimes, as documented by the public defender, there is an emotional dependence on the supplier, and that’s a good enough reason for the budget holder not to rock the boat, and other times there is a personal relationship, which is a great reason for the budget holder but not so great for the organization.

And sometimes, as clarified by the public defender, the reason is not a good one, or even a legit one. The budget holder might be making the award on the future expectations of a favour or because of a bribe and/or kickbacks that have been, or will be, received.

But if bribes and kickbacks was the worst situation that could happen, that wouldn’t be so bad. It would just mean that the award was costing the organization more than it should (and maybe significantly more than market average). If the work is quality, and identifies an ROI, that’s not too bad.

You see, if proper process, and due diligence is not taken, the organization could:

guarantee a large minimum payment regardless of work quality, completion, or dismissal (such as a 1M payment for early termination)
hire someone with a known criminal record for fraud
hire someone with known terrorist associations who will try to steal trade secret technology protected under a defence act

And if you think overpaying an average consultant who will take twice as long to produce an inferior result is bad, imagine how much worse each of these situations would be.

So, while maybe it is the case that not all spend should be under the control of Procurement, it is the case that all spend should follow the proper Procurement process under the guidance of Procurement so that all the facts, and options, are available to the budget holder. And since the CFO and CEO can be held criminally liable for certain oversights in the business, they should support this as following a good Procurement process and policy is the best CYA defense there is.

Data Breach Response Planning Part II

Today’s guest post is from Torey Guingrich, a Project Manager at Source One Management Services, LLC who specializes in helping global companies drive greater value from their IT and Telecommunications investments.

In our last post, we indicated that no industry or company can escape the potential of a data breach, including yours. Given that large retailers, health insurance companies, financial services firms, and the U.S. federal government have had to deal with reporting and responding to large-scale data breaches in the last few years, it’s becoming more and more of a certainty that if your organization is of a significant size and has a fair amount of valuable (or secret) data, at some point it will be desirable enough for a third party to try and obtain it illegally through a hack or systems breach. And bolstering prevention alone might not be enough, any weakness at all in any system used by your organization, or a supplier, could be enough to let a black-hat in. Thus, the best preparation, and prevention, is often that which assumes a breach will occur and has plans, and relationships (as per our last post), to identify, patch, and deal with the breach as fast as possible. A quick response can be the difference between a breach that is only able to capture a few dozen credit card numbers at one point of sale and a breach that continues to infiltrate the system until thousands of credit card numbers across dozens of points of sale are compromised.

In order to insure a quick identification and response to a data breach, along with choosing partners to work with for a breach, the key to quick action is to have the internal processes and systems in place to respond accordingly. As part of preparation, companies are beginning to define data breach response teams to develop response plans and define clear roles for the key departments that would need to spring into action. Typical roles/areas that companies would need to include are:

IT
Companies look to their IT departments to immediately identify and rectify the point of entry for any breach. IT will need to work with forensic IT partners to get as much information as possible in terms of scope and scale of the breach, as well as ensure systems are up and running to keep regular operations functional.
Communications
The Communications team needs to take a lead role in responding to a breach and developing key materials (e.g. for the call centre scripts, press releases) within a data breach response plan. Appoint a role or individual as the spokesperson for the company and ensure that all employees, and even BOD members, know to reference back to this person when contacted regarding a breach.
Operations
The call centres are one of the first areas that are overloaded when a breach occurs. Work with Communications to prepare scripts and materials to provide to the call centre (both in-house and outsourced) to ensure a consistent message and avoid unwanted confusion. Your Operations team also needs to ensure that internal operations are adjusted as necessary and continue to run given that a breach has occurred.
Legal
Your Legal department (and likely outside counsel) will need to look at the compliance and regulatory implications of a breach. Depending on what industry your company is in, data breaches can carry hefty fines. To report a breach accurately, key individuals will need to work with IT to understand scope and scale and report to the necessary governing bodies. As this landscape evolves, ensure that the Legal department is aware of any new regulation that your industry may become subject to, e.g., proposed cybersecurity regulations for banks and insurers. The Legal team will likely need to engage with law enforcement, either local or federal, and manage the company’s duties along with direction received from law enforcement.
Suppliers
A supplier may in fact be the point of entry for a breach in your system, as has been the case with many of the breaches in recent years. It is important to understand that your customers will still be looking to your company to respond and correct that breach. Because you will need to work with your suppliers to correct and adjust operations as necessary, Procurement should consider including language in contracts or RFXs that obligates suppliers to comply with your response plan in the event of a breach.
CEO/C-Suite
Within each of these groups, it is vital to have individuals within the response team that can make decisions. Typical delegation and “chain of command” decision making will only delay the process and response that your company is able to provide. Executives and team members also need to understand that they may need to make decisions with incomplete information; this can be difficult for organizations who are accustomed to making decisions only when all variables are identified. Due to the scrutiny and reputational risk at stake, it should be made clear to customers that decisions are being made given the information available at the time.
Procurement
Procurement will need to support supplier selection, contracting, engagement, and performance management of all necessary outsourced response services. Procurement will be managing different priorities and requirements from various stakeholders involved in a breach, i.e. all of the departments above, and will be expected to act as a cornerstone in ensuring that different requirements are met and balanced when and where they need to be.

As indicated at the start of this post, in today’s atmosphere, the possibility of a breach cannot be ignored and relying too heavily on breach prevention without a focus on response preparation can be a costly mistake. To avoid this, make sure your organization has a validated response plan and key materials primed in advance of a breach to be able to promptly respond to customers and return to normal operations as quickly as possible. Given the department’s experience in supporting process improvement and collaboration, Procurement is in a unique position to champion a proactive approach to response planning by bringing together stakeholders and identifying strategic partners that can enable the entire organization to respond to the dreaded data breach.

Thanks, Torey.

The Strategic Sourcing Lifecycle: A Free e-Book for You.

Last fall in our post on how the Trade Extensions Event Was Different, we noted two important things. The first was that the Trade Extensions event was different because, unlike many vendor events, not a single presentation was about their platform — it was all about the customer and the various types of value available to the customer (including a focussed vision, sustainability, and an understanding of how what comes next can generate value). The second was that their message was different. Unlike most vendors which focus on their key capability, their most powerful modules, etc, Trade Extensions only had one thing to say. It’s not optimization. It’s just sourcing.

And SI echoed this point in a series last fall because that’s the truth. It’s just sourcing. And sourcing is not just an RFX, e-Auction, or optimization-backed negotiation. It’s a process. A process that starts with the identification of a need and only ends after the last unit required by the organization has arrived safe and sound and is put to proper use or the last hour of service has been successfully completed.

This process covers the entire product or service lifecycle from the initial planning phase through the traditional sourcing phase (which includes the RFX, e-Auction, Optimization, Negotiation, Contract drafting and award) and the traditional execution phase (which includes performance, relationship, risk, task, and change management) to the analysis phase (which includes a formal review and opportunity assessment before the next opportunity is selected).

This process goes beyond what a typical platform will support, and what a typical vendor will tell you. Especially when the vendor’s platform will not support each and every step that you need to be aware of. But Trade Extensions will tell you (because only educated people can make proper use of a true optimization-backed Sourcing Platform), and to make sure they got it right, they commissioned the doctor to write an e-book that exemplifies the full end-to-end strategic sourcing lifecycle that makes it clear for one and all what it is, what it requires, and what you should keep in mind when looking for a platform to support one or more parts of the cycle. And that e-book has now been made available to anyone who wants it for FREE over on their site. Simply fill out a brief 5-box form and The Strategic Sourcing Lifecycle: A Brief Introduction, a 118 page e-book, can be yours today.

In addition to a detailed definition of each of the four phases (planning, sourcing, execution, and analysis), the e-book also takes you through the evolution of strategic sourcing, Supplier Relationship Management (SRM), the next level of sourcing, complex tenders, and the evolution of strategic sourcing platforms as well as providing you with a detailed sourcing glossary that will define the most common terms and abbreviations. This is essentially a print-book in e-book form as it even includes a full index!

Whereas the most an average vendor will give you is a long white-paper disguised as an e-book, just like the Spend Visibility Guide (still FREE) was the first true e-Book on Spend Visibility and Spend Analysis, this is the first true e-book on the full strategic sourcing lifecycle. Download the The Strategic Sourcing Lifecycle: A Brief Introduction today. It will be worth your time.

Data Breach Response Planning Part I

It seems as if no industry or company can escape the potential of a data breach. Over the past few years, we have seen large retailers, health insurance companies, financial services firms, and the U.S. federal government deal with reporting and responding to large-scale data breaches. The first reaction to the threat of a breach is to bolster prevention. While there are clear ways that companies can mitigate the risk of a breach, there will always be someone looking to exploit weaknesses in security systems and protocol. While preventing a breach would be ideal, prevention should work hand-in-hand with preparation for a breach, including having the necessary partners identified or in place to respond to, cease, and mitigate damage. Procurement plays a key role in preparation by working with IT and various stakeholders to determine which types of services are needed for a data breach, as well as supporting the selection and management of the specific suppliers.

There are a few key supplier partners that Procurement should look to establish relationships with in preparation for, or in the event of, a breach:

Forensic IT
While your IT department is very familiar with the systems in place and is able to manage them, they may not have the expertise needed to identify the source of a breach. Forensic IT firms can help identify the source and extent of a breach so that your IT team can focus on securing against the breach and ensuring operations can return to working condition. Procurement should work with IT to evaluate potential suppliers for forensic services based on the organization’s architecture, network, and potential entry points and vulnerabilities. Procurement can look to leverage sourcing activities or existing relationships for IT managed services to identify potential suppliers for forensic IT services.
Outside Council
Unless your internal legal team is well versed and qualified to respond to a breach, you will likely need to bring in additional resources with specific expertise to direct your company on compliance and regulatory implications. When evaluating potential legal firms, Procurement should look for those who have expertise in notification requirements in all fifty states of the U.S. as well as in other countries, as appropriate for the company’s operations, and in your company’s specific vertical (e.g. healthcare, banking, insurance). Because these requirements are evolving, be sure to identify firms that are keeping pace with the most recent rulings and regulations.
Credit Monitoring/Identity Theft Repair
With the increase of cyber threats and attacks over the past few years, firms that used to be seen primarily as credit monitoring tools are leveraging their experience and insight to offer response services that include customer notifications and call centre support, along with credit monitoring and identity theft repair services for affected customers. Procurement should ensure the chosen supplier is able to meet the expertise and capacity needs of the organization and can offer value-add services to bolster your response plan. Some suppliers offer services such as data breach simulations that can help identify holes or potential gaps in the designed response plan.

Procurement will need to consider the best-fit way to contract these services in order to utilize them in an efficient way. These services can be contracted in advance of a breach; this approach guarantees capacity, provides a faster response, but comes with both a monthly or annual retainer and variable costs that correspond with the breach.

You can also looks to purchase these services when a breach occurs; this would eliminate the retainer portion of costs, but would not guarantee capacity, may put you in a less favourable position in terms of negotiating variable rates, and will have a longer lead time. If you chose not to retain services, it would be prudent to establish beforehand a short-list of potential suppliers to approach for the necessary services when breach occurs.

Another option to obtain these service is through a data breach insurance plan; this is certainly an option for many organizations, but do consider your company’s ability to fully develop a response plan, ability to control the response, and reputation risk when working within the confines of an insurance policy. Deciding which services are used, and how they are purchased, will likely depend on your organization’s aptitude for risk and budget that can be allocated to these services. Procurement will need to explore the different purchasing methods against the risks associated with a data breach to determine the appropriate approach for securing these services for the organization.

Whatever supplier partners you decide to work with (whether proactively or reactively) Procurement should identify what they will need to begin working on your behalf and mobilize as quickly as possible. The development of your data breach response plan should also identify the types of data at risk (i.e. beyond customer data) and how a breach of that data will affect your business. This practice will allow you to identify business areas that may need to be involved in the creation and execution of the response plan in order to properly prompt internal action as you engage suppliers.

Now that you have your response partnership (plan)s in place, in our next post we will discuss the next key to a successful data breach response.