Category Archives: Risk Management

Supply Management Risk Management Needs to be Cranked to 11!

SI has been preaching the message of the need for strong supply chain risk management for a while now, given that the chances of your organization NOT experiencing a significant disruption over the next 12 months is about 1 in 10 and dropping fast. In fact, the doctor recently authored an entire risk management series for Ecovadis:

But given the uptake in deep supply risk management solutions, SI is not yet preaching to the choir. Don’t worry, this is not another post preaching from the pedestal, unless, of course, you are a vendor.

You see, even the best solution doesn’t have what you need to suitably address risks in today’s risk-laden supply chain. Consider the current enabling technology components, as addressed in the Supply Risk Management Landscape Report, co-authored by the doctor with the prophet and the maverick.

  • basic portal and information tracking capabilities which tracks all suppler and product info and allows a supplier to manage their end
  • risk analytics and reporting that focusses on relevant spend, supply, and supplier metrics that provide good risk indicators
  • risk intelligence feeds that report on current real-world (third-party) metrics and events that can effect your supply chain
  • commodity management enablement with price benchmarking and forecasting, availability projections, price risk exposure, etc.

These are good, but all these let you do is identify potential risks. Once a risk is identified, you need to do something about it. But a solution that only tracks, reports, augments, and projects — while it may give you some ideas — doesn’t let you do anything about it.

Some providers (like Resilinc) give you a command center that allow you to create disaster recovery plans for specific occurrences, or run what-if reports/scenarios based on decisions on how to mitigate a risk, but this doesn’t help you identify how to mitigate the risks appropriately.

And that’s why supply risk management platforms need to crank it to 11. And how will they do that?

The answer, as the doctor outlined in the aforementioned co-publication with the prophet and the maverick, is to also contain support for:

  • supply chain re-design and optimization based on decision optimization, supply chain modelling, predictive analytics, and “what-if” scenario planning

Now, not a single supply chain risk management solution supports even one of the four core capabilities required (although some will claim they do), but hopefully, now that the flashlight has been shone, they will … or maybe, just maybe, a true SSDO (strategic sourcing decision optimization) provider will hire a few risk experts and build a risk management platform on the right underpinnings. Only time will tell. The most important thing is that you realize when you go to market for a supply chain risk management solution is there is no perfect solution and more innovation is needed.

On the Eighth day of X-Mas (2016)


On the eighth day of X-Mas
my blogger gave to me:
Risk Management Posts
Sustainable Posts
e-Procurement Posts
some SRM Posts
some CLM Posts
some Best Practice Posts
some Trend Bashing Posts
and some ranting on stupidity …

Risk is everywhere. Embedded in everything.

The categories of risk are truly The Dirty Dozen.

Every organization is Playing With Fire: [with all of the] Hidden Risks Lurking in The Supply Chain!

These risks stay hidden thanks to the common practice of Siloed Supply Risk Management [which] Just Wastes Time, Money, and Resources.

It doesn’t have to this way. For instance, here are 3 Best Practices in Supply Risk Management That You Are Likely Overlooking.

These will help you understand that Supplier Risk: [is just] The Tip of the Iceberg.

Because, and it is worth repeating, Hidden Risks are Everywhere!!

And when one rears its ugly head, that’s when you find out that Turbulence [is] Not Just for Airplanes Anymore!

But while the enormity of the situation may drown you, despite what your ERP vendor will tell you, your ERP is a big risk. Here are A Few Reasons Why Your ERP is a Disaster Waiting to Happen.

When it comes to risk, could you be managing it right? Yes, and you could start with some Risk Monitoring.

After all, when you consider what a realized risk costs, It Shouldn’t Be Hard to Justify Investments in Risk Avoidance.

Come back tomorrow for the ninth day of X-Mas.

Oversight for more than just your Travel & Expense budget management

Oversight is an Atlanta-based software (as a service) company founded back in 2003 to help organizations monitor spending in an effort to identify errors, waste, misuse, and fraud in the grey area of enterprise spend. As every recovery firm will tell you, the average organization will overspend by 1% to 3% as a result of over billings, duplicate billings, unnecessary spend on superfluous demand, maverick spend, and even fraud. (And they make their living recovering a portion of that, typically a third, and then charging you 33% of the recovery as their fee. Sounds small, but 1/3 of 1/3 of 3% of spend is 0.33% of spend, and if the organization spends 100 Million, they get 330,000 for an effort that can be largely automated and, even worse, be avoided with proper up-front spend monitoring.)

For example, if all invoices are compared to invoices and goods receipts before payments are authorized, this can prevent overpayments. Duplicate billings can be identified in the same way (and duplicate payments prevented). Potential fraud can be identified by forcing all invoices from unknown suppliers, for unknown products, or for unexpected amounts to be manually reviewed. (This can’t prevent in-house fraud, where a buyer pays a fake invoice to a fake company controlled by a relative, or a co-conspirator, but it can prevent external fraud.) Unnecessary spend on superfluous demand will require up front requisition control, as will maverick spend, but at least there will be no overspend or duplicate spend that can be unrecoverable once the contract with the supplier expires.

Oversight is unique in that it is not so much a software platform but an insights platform. Employing a team of data scientists focussed on identifying new algorithms and techniques for fraud detection, Oversight uses their in-depth knowledge of fraud to build solutions that will help the clients identify potential cases of fraud that they could never hope to identify on their own. The best most companies can do is sample based audits and spot checks which are unlikely to identify much fraud as these will generally only be on a few percentage of invoices or transactions, and most employees who have been getting away with fraud for a while will not be doing anything obvious, and the fraud will not be detected without correlations across documents and systems. That’s where Oversight comes in.

The Oversight solution is a web-based software solution for automatic spend analysis and identification of high-risk or potentially fraudulent transactions that comprehensively analyzes T&E, purchase card, and accounts payable spend using a suite of statistical, clustering, data mining, break point, rule-based, evidentiary reasoning, and machine learning algorithms that look for discrepancies, suspicious patterns, known fraud, and risk indicators to identify those transactions that need to be manually reviewed. The dashboard-driven, or work-bench driven, interface allows an analyst to drill into suspicious transactions by country, organizational unit, risk level, or exception type and can be configured to show the analyst only those exceptions assigned to her, or her team, or every unresolved exception in the system.

When a user drills in by exception type, she sees an overview of the overall risks by country and can drill into suppliers to see the specific exceptions. When a user drills in by country, she can see the overall risk by supplier and then by exception. In other words, she can drill into at-risk transactions using country, organizational unit, supplier, and at-risk type in any manner they please.

Or, they can look for exceptions by process. Right now, Oversight supports the identification of at-risk transactions in the travel & expense, procure to pay, and purchase card processes and has recently added support for FCPA, Anti-Bribery, and Corruption Risk — including the identification of known politically exposed parties.

Plus, the platform not only integrates with all of the big supplier and financial data providers — such as Dunn & Bradstreet, Bureau van Dijk, and CreditSafe — but also integrates with providers of risk indicator data such as Ecovadis and Sedex Global. Plus, they maintain their own databases of known politically connected parties, gentlemen’s clubs, denied parties, and other parties that an organization typically should not be allocating funds to. This last capability is quite important … just ask American Express which once received a 241K strip club bill authorized by the CEO. (Source: ShortNews)

Since fraud attempts differ by country, and collusion is hard to detect with a standard m-way match invoice processing platform, Oversight brings a powerful offering to the expense management space. It’s a platform worth checking out. For a deeper dive into the platform, check out the recent coverage by the doctor and the prophet over on Spend Matters Pro [membership required]. (Part I is up with Parts II and III coming within a week.)

Twenty-Two Years Ago Today …

The PlayStation was released in Japan. Even though Sony was late to the scene, as the PlayStation was released with the fifth generation of video game consoles, it was the first “computer entertainment platform” to ship 100 million units and set the gold bar for computer entertainment platforms at the time.

But this is not the only reason it is significant. It’s also significant because it also set the need for a gold bar in supply chain management as Sony lost $150 Million in sales and product reformulation when Dutch authorities halted a shipment of 1.3 Million PlayStations back in 2001 due to illegally high cadmium levels.

What do you think, LOLCat?

All PlayStations are great to sleep on!

A Financial Health Check Should Be a Pre-Qualification of Every Supplier Qualification

And every organization should review a financial health or risk report, comprised of, or augmented with, third party data, and, unless they are (or have in-house) financial experts, this should preferably be done by a third party. The reality is that in today’s data driven world, no organization should be surprised by a bankruptcy of a mid-size or larger supplier that has been in business for at least three years. The probability of the vast majority of these bankruptcies are now predictable by financial analysts and while they may get a few wrong (as some companies may shape up just in time and others may fail faster than expected for a non-financial reason), they get a lot right.

And it’s not like financial ratings are hard to get anymore. While they are not as insightful, as they work exclusively on credit data and stock data compared to released financial statements (which is where the early warning indicators hide), most of the big data / credit services track enough data to come up with a reasonable financial risk score that at least lets you know whether, from a financial perspective, the supplier could be reasonably safe or is currently very risky — and needs a detailed analysis. Moreover, a financial health-focused offering by RapidRatings, and their FHR (Financial Health Rating) Report (which has been around for almost a decade), with an open example here, provides not only deep insight into potential risk, but the magnitude of the risk and the hard data for the risk — as well as the insights — and can detect risks from early warning signs that have not yet manifested in observable behavior (such as late payments).  In addition, RapidRatings’ new Financial Dialogue offering, which works in conjunction with the FHR, identifies the most important questions you should be asking your suppliers based on their health rating.  (An when you look at just the FHR report, you wonder why every organization is not doing at least this detailed level of supplier financial health analysis before committing a large or strategic spend to a supplier when all the data they need can be summarized in an easy to understand fashion.)

Now, you might say that because only one vendor, today, offers this depth of a report, which wasn’t previously available, and because the organization has done just fine without it for almost a decade, that you don’t need it, but SI would like to disagree. With global sourcing constituting so much of your supply chain, you don’t really know that much about your suppliers, their health, or the conditions in which they operate. And if they are supplying a custom made component, a raw material in limited supply, or a specialized service, the cost of recovery could be much greater than the initial cost of supply. These reports are becoming a necessity as part of your risk management.

SI is not saying you have to use RapidRatings or subscribe to their FHR reports (although they should be on your shortlist), but that you should at least do deep financial analysis on all of your strategic suppliers and use a platform to do it.  And while SI expects that other vendors with the same degree of analytic capability, financial know-how, and supplier insight — specifically Resilinc, FusionOps, and Simfoni — will soon attempt to release similar offerings, with their own unique spin, SI doubts that these other providers will be able to match the depth provided by RapidRatings for quite some time, as they are, respectively, focused on supply chain resilience, big data insights, and analytics on the go.  (However, if you are  currently using any of these vendors, you should work with them on their new analytic offerings as they can still offer other insights into the suitability of the supplier for your operation, assuming the supplier is financially viable enough to work with in the first place.)

While financial risk or financial health is only one KPI that should be used to analyze suppliers before qualifying them for inclusion in an event, it is an important one — the organization needs a supplier that will stay in business. Another KPI that should be included is a comprehensive CSR (Corporate Social Responsibility) assessment, as you want responsible and sustainable suppliers, and this can be obtained as well from vendors such as Sedex Global and Ecovadis. Finally, once the supplier has been deemed financially stable and sufficiently responsible, an overall supply chain risk rating should be computed (based on geography, risk of natural disaster, political interference, etc.). This will require either a risk management vendor (such as Resilinc, Risk Methods, etc.) or an analytics vendor that pulls in feeds from one of these vendors.

It’s a lot, but if you can be sure in your supplier, that’s one less worry in your overly complex supply chain.