Category Archives: Risk Management

Dietary Changes to Our Risk Appetite

Share This on Linked In

Editor’s Note: This post is from regular contributor Norman Katz, Sourcing Innovation’s resident expert on supply chain fraud and supply chain risk. Catch up on his column in the archives.

The cover story of the June 22nd, 2009 issue of Information Week magazine was titled: “What’s Your Appetite For Risk?“. The article was part of the magazine’s annual security survey.

What we initially learn in the article should be of little surprise: the recession is taking its toll on all aspects of company operations, including investments in technology security and compliance, though these two concepts should not be confused with one another. A lot of focus was given to security and compliance within cloud computing.

With budgets stressed and spending trimmed, the appetite for risk has been forced to grow a little larger as priorities are examined in more detail to determine where — and how — limited dollars should be spent. As the article continues, compliance requirements are getting funded to keep (public) companies surviving from one audit to the next, but that doesn’t really mean that risks are being managed properly.

A reader of my blog posts (on Sourcing Innovation) contacted me in early July to tell me about a supply chain risk management success story. Nick Woods is in the public relations department of Red Prairie, a software company that specializes in warehouse management, transportation, and workforce management solutions. Nick shared with me a press release on the implementation of Red Prairie’s warehouse management solution at Sargento Foods who is known for their cheeses, sauces, and snacks.

In the press release, the VP of Logistics at Sargento Foods, Dennis Roehrborn, was quoted as stating: “By upgrading the solution in our Plymouth, Wisconsin distribution center and satellite plants in Kiel and Hilbert, we are better equipped to exceed customer expectations for accurate order fulfillment and on-time delivery.”

While there are many risks to supply chain operations, the failure to meet customer expectations is certainly a critical one. Regardless of how great your product is few customers will tolerate repeated supply chain disruptions that increase operating costs and result in a failure to cost-effectively get the right product on the store shelf when the customer wants to buy it.

Here is a great example of a company who recognized risk and managed it by investing in the necessary technology. Mr. Roehrborn also states that the implementation was minimally disruptive to existing operations and that productivity target goals were exceeded with the new software.

Seems to me like Sargento Foods has such a large appetite for its supply chain relationships, (and probably a good appetite for the quality products they produce too), that they decided to put themselves on a diet when it comes to risk.

The need to exceed customer expectations is even more important in a recessed economy, and companies must proactively assess the risk of losing sales and customers versus the cost of doing nothing. Managing risk doesn’t require taking bigger bites than you can swallow at one time — that would be foolish when tackling most any project. Even if you have to nibble at it a little at a time, chewing carefully and thoughtfully, make the investments necessary to little-by-little reduce risk and improve performance.

And don’t forget to brush regularly and floss daily.

Norman Katz, Katzscan

e-Leaders Speak: Kevin Cornish of Aravo on how “Managing Supplier Risk Helps You Thwart Zombies, Mavericks, and Other Threats in the Supply Chain”

Share This on Linked In

Today’s post is from Kevin Cornish of Aravo.

Once the economy begins to rebound, some companies may start to scale back their risk management efforts.

Don’t be one of them.

If we’ve learned anything from this recession it’s that in today’s volatile global economy, businesses need to pay more attention to risk, not less. And, while there have been signs that the world economy is beginning to heal (Bloomberg), Federal Reserve Chairman Ben S. Bernanke and others have cautioned that the recovery is likely to be both muted and prolonged.

In other words, now is not the time to ease up on scrutiny of the financial scorecards of your critical suppliers. Why? Because we’re not out of the woods yet, and because you don’t want to unexpectedly find yourself relying on a “zombie” supplier, a business that is so undercapitalized and overleveraged that it’s essentially dead. A zombie supplier won’t be able to raise the money required to get itself back online — and that means it won’t be able to deliver the parts you need to your door.

Of course, fine-tuning your supplier risk management strategies can have other benefits, as well. For instance, as we’re digging out from the worst recession since Word War II, it will continue to be critically important to keep an eye on costs, and getting your supplier house in order can go a long way to reducing another sourcing threat that’s too often ignored: maverick spend.

Maverick spending may be costing you more than you think — not only in terms of per unit price, but with regard to leverage lost in future negotiations, as well. What’s more, it’s probably happening more frequently than you realize. In one study, over half of the employees surveyed (57%) considered it acceptable to make off-contract arrangements if they can get a better deal.

Earlier this year, a procurement trends report co-sponsored by OfficeMax and Purchasing magazine revealed some intriguing statistics regarding office spend. Take a look:

Percent of office spend under management by procurement
0-20%   :   9%
31-60%   : 21%
61-90%   : 36%
91%+: 34%
Average contract compliance rates
0-20%   : 16%
31-60%   : 12%
61-90%   : 41%
91%+: 31%

That data tells me that most businesses have plenty of room for improvement when it comes to optimizing purchasing power, improving compliance, and achieving total cost management — all of which stems from knowing, and managing, supplier information with diligence, transparency, and risk awareness.

A year ago, businesses were pre-occupied with supply risk. Then, concern shifted to supplier solvency risk. Now we’re back to keeping one eye on commodity prices, even while we’re on the lookout for zombies, mavericks, and a variety of other supply chain threats (compliance, environmental regulations, sustainability concerns, etc.). Without a doubt, the lens of risk is constantly changing. However, successful companies don’t just throw out the eyepiece when it no longer works. Instead, they repeatedly readjust their focus so that they can better respond to both the threats and the opportunities in today’s business environment.

Thanks, Kevin!

Managing Military Supply Chain Risk

Share This on Linked In

Editor’s Note: This post is from regular contributor Norman Katz, Sourcing Innovation’s resident expert on supply chain fraud and supply chain risk. Catch up on his column in the archives.

To highlight the importance — and invasiveness — of the concept of the supply chain, take a look at Section 254 of the Duncan Hunter National Defense Authorization Act For Fiscal Year 2009.

As stated in this section: “The Secretary of Defense shall conduct an assessment of selected covered acquisition programs to identify vulnerabilities in the supply chain of each program’s electronics and information processing systems that potentially compromise the level of trust in the systems.”

The assessment includes identification and prioritization of vulnerabilities, recommending ways of managing supply chain risk, and identifying lead Department of Defense personnel for developing an integrated strategy for the management of risk throughout the supply chain.

Of critical importance in the military supply chain is the acquisition of electronic components. The goal is to ensure full operational readiness of US military forces. With the heavy reliance on technology to support the US military, the failure of an electronic component could be costly, not just in terms of tax dollars but also in terms of human life.

Repeated through this section is the word “trust“. In fact, it is repeated eight times not including the definitions of the terms “trust” and “trusted” in the last two paragraphs or the title of the section, Trusted Defense Systems.

I think Section 254 can be summarized as follows: Trust, and verify.

And it’s not just the electronic components that require verifiable trust, it’s also the verifiable trust in the “information processing systems” used in the supply chain. (It sounds to me like they’re talking about the computer systems and communication networks.) Verifiable trust needs to also exist in the design and fabrication processes, packaging, assembly, and quality assurance testing.

So, how should verifiable trust in supply chain relationships work? Perhaps true collaboration between trading partners who monitor each other and (immediately) report discrepancies, especially when the necessary goal is 100% accuracy.

This reminds me of a slide in my supply chain fraud presentation, which simply states: “You can outsource manufacturing, but you can’t outsource responsibility.” As opposed to verifiable trust, it would seem that for too long some supply chains have been operating under the concept of blind trust.

Retailers have been establishing their own quality assurance departments to verify that children’s toys are lead free. Verifiable trust could have helped avoid the deaths from tainted pet food. Tainted peanut-based foods may have never made it to the store shelves with just trust that no supplier would purposefully want to damage their reputation by harming the consumers who buy their products. Shouldn’t retailers and grocery stores be able to trust their suppliers to manufacture quality products that, when eaten or used accordingly, will not cause injury or death?

An argument is that this would come at a cost that consumers who must be willing to bear higher prices, or that companies must be willing to accept in terms of higher operating costs that will reduce profit margins, upsetting financial analysts and thus lowering stock prices which will then upset stockholders, especially if it results in lower dividends. But isn’t this a responsibility that a company manufacturing a product should be willing to — if not expected to — bear? Shouldn’t a company be valued more on the quality of its products then the quantity of its profit margin?

Maybe the government got this one right, folks. Maybe we need more verifiable trust in our supply chain relationships, especially the ones involving the products we purchase as consumers. It’s okay to trust, but verify too.

Norman Katz, Katzscan

Don’t Forget About the NPFTF …

Share This on Linked In

If you’re on the ball and a US public company, you’re probably worrying about the SEC (Securities and Exchange Commission) and the FCPA (Foreign Corrupt Practices Act) because the government has been cracking down — hard — on violations and handing out million, and billion, dollar fines to violators. But while you’re making sure your staff are adhering to the SEC guidelines and not bribing foreign officials, you better make sure they are not committing fraud at home because the National Procurement Fraud Task Force (NPFTF) is ramping up too. Established by the Federal government in 2006, the NPFTF members include the FBI, the DOJ Inspector General, inspector general, defense investigative agencies, federal prosecutors, and various divisions of the DOJ.

Focusing on civil and criminal enforcement, the NPFTF has pursued more than 400 fraud cases since its inception. While bribery is the most prevalent type of fraud, bid rigging, embezzlement, money laundering, false claims, product substitution, misuse of classified and sensitive information, and mischarges have also been pursued. To date, these cases have resulted in more than 300 criminal convictions and hundreds of millions of dollars in settlements and judgments.

It’s important to remember that your average organization has a greater risk to fraud than you realize, according to PwC research summarized in a recent S&DC Executive article that notes that the “risk of waste, abuse and fraud in procurement is seeing an increasing threat in a down economy”. That’s why you need to insure your processes and controls are strong and that they are regularly monitored and evaluated. After all, it’s not just the Feds that are on the ball … over 20 states and cities have followed their lead and started enacting their own civil false claims acts. If you’re a career procurement professional, chances are your ethics are second to none, but who knows what your internal customers, trying to circumvent your processes with their maverick spending habits, are up to.

So what can you do to minimize your risks? Look for, and eliminate, these red flags:

  • inconsistent data across procurement-related systems
  • data quality issues related to spend data and vendor data
  • lack of controls around preferred vendors & negotiated contracts
  • lack of compliance with preferred buying guidelines
  • multiple instances of the same vendor in master data
  • inconsistent payment terms across the organization
  • duplicate payments
  • inefficient invoice processing
  • lack of sanity checks

And take the following actions:

  • streamline procurement processes
  • strengthen IT systems
  • do not rely solely on a code of ethics & whistleblower hotline
  • perform periodic due diligence of vendors
  • analyze procurement trends, payment patterns, & product change mix

Assessing Risk

Share This on Linked In

Editor’s Note: This post is from regular contributor Norman Katz, Sourcing Innovation’s resident expert on supply chain fraud and supply chain risk. Catch up on his column in the archive.

I live in South Florida, and for one half of each year we worry about hurricanes. Actually, we start worrying about one month before our six-month hurricane season begins on June 1st; hurricane season officially ends just after Thanksgiving on November 30th.

(At least with hurricanes we’ve got some warning which we’re very grateful for; earthquakes and twisters provide little advance notice, if at all.)

I use life in a hurricane zone when discussing risk analysis.

Let’s take a look at a risk analysis for hurricane season in South Florida based on some risk characteristics:

  • Occurrence: Hurricane season is guaranteed to happen once per year (frequency), though the likelihood of a hurricane strike is unknown.
  • Control: We can’t control the weather, but we can control other things that create risk.
  • Severity: We cannot mitigate the strength of a hurricane but we may be able to reduce the impact it has to our lives and businesses through various preparations.
  • Interruption: Can we continue through a hurricane strike or will we be forced to recover after a period of downtime?

Once the characteristics of a risk are determined, risks can be plotted on a chart or given a numerical ranking, allowing us to determine which risks should be addressed in an order of priority. This analysis can also be used to determine the cost of the risk versus the value of addressing it.

The exercise of performing a risk analysis has the benefit of uncovering risks to your organization that you may have previously not considered. The Risk Assessment is part of the COSO framework used for Sarbanes-Oxley compliance, so for public companies this is a requirement.

The failure to identify risks is a risk in-and-of itself. I would submit that knowing about a risk and knowing that something could be done about it is pretty much just as bad as not bothering to identify risks in the first place.

Norman Katz, Katzscan