By Mike Ford, Global Lead, EHS & Sustainability – Avetta
Another article arguing ‘the pandemic has changed things…’. We understand businesses do not operate in vacuums and that supply chains are complex and vital for each other’s survival. If parts of that chain become redundant or fail to function optimally, the impact can lead to disruption and, potentially, prevent companies from delivering their services.
The pandemic highlighted the methodology employed to evaluate suppliers’ need to change from the traditional model. The process of engaging a supplier, irrelevant of the terminology applied – prequalification, vendor assurance, supplier engagement – all have a common theme: this is assessment of supplier-based risk, brought about by engaging the services of a third party.
Discussions with clients responsible for a global supplier footprint, confirm individuals with responsibility for procurement, including sourcing goods and services via direct and indirect suppliers, have found issues highlighted by the pandemic that were, historically, never subject to any risk assessment. During the pre-contract assessment of a supplier, verifying of their suitability placed most attention on factors such as fiscal integrity, safety performance, insurance, and price. The issue of business continuity planning (BCP) within the supplier organisation was rarely assessed to the same degree as those factors mentioned. The Business Continuity Institute (BCI) Supply Chain Resilience Report 2021 argued only one in six companies undertake detailed BCP due diligence on strategic suppliers
All suppliers import risk when incorporated into a company supply chain; the risk level varies, based upon their service provision. To facilitate business resilience and mitigate foreseeable risk that can be introduced into your business is essential, and as part of the supplier due diligence methodology you should be examining how strategic suppliers manage BCP and incorporate a detailed analysis of their capability in this area. A supplier with a great safety record and keen price is of no use if they can’t supply their services due to their inability to address risks to their daily business operation. This applies to both domestic and international suppliers.
During the early months of the pandemic, it became clear that traditional methods of supplier risk assessment were not providing clients with enough transparency, not only with tier 1 suppliers but also from tier 2 and beyond. The BCI identified 40.2 per cent of Covid-related issues in the supply chain were because of issues in tier 2 and lower, exposing gaps within strategic business relationships; the benchmarks used historically to facilitate purchasing decisions were found wanting. We found many buyers simply relied on suppliers advising they had BCP programmes in place with little to no confirmation of their suitability. “Unplanned events can have a devastating effect on any businesses, but where suppliers fall into the small medium enterprise classification, their resilience can be found wanting for the smallest of event”
Assessing the supplier regarding their own supply chain was simply not subject to any interrogation and was not factored into the decision-making process. Simply applying an ‘honour-based assessment’ and taking a supplier’s word that something is in place and that it has been tested, can no longer be deemed acceptable as part of the supplier risk assessment, which prevents the making of informed purchasing decisions.
Some buyers applied contractual mandates to act as a ‘resilience catch-all’. This can no longer be used in isolation as a form of protection. In discussions with senior procurement personnel from organisations with a global footprint, it was identified that many simply asked questions about the status of BCP and assumed suppliers were also undertaking due diligence on their supply chain, many have since confirmed they misjudged the issue, predominantly because nothing had occurred historically to test the thesis of ‘what happens if…’. The reality was, no checks were being undertaken to validate business resilience. This flags the question of what levels of BCP are in place within the supplier ecosystem, how is this risk being assessed and, more importantly, what needs to change going forward?
Change introduced by the global pandemic created a ‘re-assessment’ of the approach to supplier verification, pre-contract award, and a re-thinking of how BCP can be incorporated into the due diligence mechanism and the supplier life cycle. It should no longer just be a verifier during the M&A process. Hopefully, the trend of increasing this control into the supplier risk process is an upward trend, post pandemic.
Unplanned events can have a devastating effect on any businesses but where many suppliers fall into the small medium enterprise (SME) classification their resilience can be found wanting for the smallest event. Smaller, less well-resourced suppliers may find being asked about new management programmes a step too far during the tender process, being perceived as a barrier to doing business with you. As part of any change to a process that has remained static in nature for many years, companies must communicate their ‘business expectations’, confirming how this addition to the checking process is going to be assessed. Clients will need to provide support and guidance in how this risk should be identified, managed, and monitored.
In the last 18 months where support has been high, clients have received greater buy-in from their key suppliers. Support includes providing templates, helping to conduct simulations, and helping differentiation from disaster recovery and BCP. Understanding what BCP relates to is especially important when dealing with emerging economies where it can mean different things. Personal experience in the Far East identified major gaps in the level of understanding among suppliers, in some cases they perceived issues such as fire drills and emergency responses as the extent of good BCP practice.
Providing the smaller suppliers guidance and getting them to understand risk is not restricted to health and safety is a first step, this will help identify potential risks, prepare for emergencies and test how their business is likely to cope in a disaster and ultimately reduce the impact to your own operation.
Our assessment identified many members of the supply chain have little, if any, understanding of the client’s expectations around the basic principles of BCP practice and disaster recovery and how to assess the risks that could impact on their daily operation. Unless expectations are clearly explained, it has the potential to create other supply chain shortfalls, such as suppliers simply not offering their services. Simply increasing further demands on the supplier with little to no explanation will not address this issue.
Discussing the perception of risk when engaging suppliers, many buyers advised us that the primary element of concern was not being able to provide their service for an undetermined period. An element very often overlooked is the reputational impact to a company, based on a failure to respond and continue normal business operations as a result of supplier failure due to unplanned events.
Ultimately, understanding your suppliers’ BCP should be a critical component of the due diligence process at prequalification stage, facilitating a more educated procurement decision. You should increase supply chain visibility by enhancing supply chain mapping and understand a supplier’s capacity to deliver, including their reliance on third parties critical to achieving that aim.
About The Author:
Mike Ford is the Global Lead for Sustainability and EHS for Avetta, a provider of supply chain risk and due diligence programmes, responsible for assisting global business to integrate supplier evaluation and safety/sustainability-based risk programmes to address compliance and ethical sourcing solutions in developed and emerging economies. He has extensive experience in the ethical sourcing and safety arena, having developed programmes for many of the world’s largest brands. Mike has a Master’s degree in Occupational Health and Safety Management and a Master’s degree in Procurement and Supply Chain management, he is a Chartered Safety Practitioner, a Fellow of the International Institute of Risk and Safety Management and member of Chartered Institute of Purchasing and Supply.
About The Company:
Avetta provides a cloud-based supply chain risk management and commercial marketplace platform. Our global solution is uniquely designed to connect the world’s leading organisations with qualified suppliers, driving sustainable growth. We build trustworthy bonds through responsive technology and human insight. Our process is collaborative. Our global reach is complemented by our local expertise. Hundreds of global organisations depend on Avetta to align their supply chains to sustainable business practices, worldwide.
