The Minsk agreements continue to go unimplemented, so the EU extends Russia sanctions again; OFAC grants an export license for certain petroleum products destined for Venezuela and the Kitchen is there to look into the details.
Categories
Day: July 21, 2021
Welcome to a special six-part podcast series, sponsored by Exiger, on the TRADES Framework, a conceptual, strategic and practical guide for Third-Party and Supply Chain Risk Management designed by Exiger to help organizations achieve supply chain resiliency and optimize risk management at any phase of maturity. In this episode, I visit with Laura Tulchin, ESG Solutions Lead and Peter Jackson, ESG Solutions Lead and Peter Jackson – Director of SCRM Data Management & Innovation on assessing your current risks.
According to Jackson, “The A in the TRADES framework stands for “Asses Current Risks. In steps One and Two, you have been planning and preparing your supply chain risk assessment; now it’s time to actually carry it out. The more robust your preparation, the easier this step will be, but don’t be concerned if you find it necessary to go back and forth between this step and the previous stages. Sometimes we have expectations about the data that’s available, or we make assumptions about overall risk, that are quicky disproven as we move to actually assess our risk. When that happens, simply back up and iterate on the planning stage to find another approach. Assessing current risks breaks down into three levels.”
The Strategic Level. Tulchin says you should begin at the Strategic Level in order to “maintain a robust, long-term third-party and supply chain risk management framework, organizations must agree to and document a broad risk appetite statement. Start at the strategic level.” Moreover, “A risk appetite statement is absolutely critical to defining the workflow for you of the outputs of the risk assessment.”
We moved to a risk appetite statement, which Tulchin said, “is going to give you guidelines about what is acceptable risk and what is not. It’s extremely important to put in thresholds and metrics to make the results of the risk assessment actionable – KRIs that tell you when things are moving toward unacceptability and what to do then.” Additionally, “Ultimately, the risk assessment is going to strategically define a workflow for you of the outputs of the risk assessment. Finally, your ”risk assessment methodology should ensure that the risk model meets your business need and risk profile – in other words, align with the way that your organization sees the world.”
The Program Level. Implementing a risk assessment program begins with defining the risk assessment application and prioritization process. From there, organizations need to determine the frequency of risk assessments and establish policies to escalate risk events. Risk thresholds and decision-making processes must be clearly documented.
Jackson said that at this level, “it’s time to buckle down and collect, analyze, and synthesize the data you need to identify your risks and fit them into your risk appetite. Something to keep in mind as you carry out your plan at the program level is that there are both weak points and strong points in any supply chain.” While many aspects of the risk model focus on identifying potential weaknesses or vulnerabilities in a supply chain, the flip side of that analysis is to discover the best and strongest parts of your supply chain as well.
Moreover, the Program Level is “the perfect place to identify what is working well and to investigate why is it working well. Since we use risk as a starting place, we can look at the bottom of the list—the lowest-risk areas—to look for positive practices that can be replicated throughout your supply chain. Program level risk assessment is the right place to drive value creation as well. Although supply chain risk is focused on reducing vulnerabilities, there is also tremendous potential here for discovering efficiencies and creating significant value capture from your supply chain as well.”
Tactical Level. At a tactical level, the risk assessment process should include application, visualization and a vulnerability evaluation. Individual third-party risk assessments, critical supplier assessments as well as supply chain assessments should all be included as part of an organization’s risk assessment application. That risk should then be visualized to depict third-party and supply chain portfolio risk areas and indicators to provide actionable intelligence and allow for the prioritization of investigation and mitigation efforts in an efficient manner. A high-level comprehensive assessment should evaluate overall vulnerabilities across the complete level.
Here implementing the risk assessment may mean different things for different entities based upon criticality. Tulchin related, “certain types of suppliers may be subject to more stringent data collection that leads to a more comprehensive risk model that brings in a large swath of data.” It could also be that you “want to perform a risk assessment within a given supplier relationship. As defined by the risk model design/methodology, tiering with regard to the need to perform micro or single entity risk assessments.” Finally, there “may be certain suppliers, or a certain high-risk jurisdiction, or a certain critical product that require single-focus risk assessments to bring that data into an overall program review.”
Jackson feels the Tactical Level “is the place where you are most likely to discover the need to iterate on your supply chain risk model design. The tactical level is where you can best identify any persistent information gaps or determine the need for data orchestration.” Yet he cautioned, “It’s also important to keep in mind that the outputs of your assessment will be responsive to your risk priorities.” Finally, he emphasized that it is “critical to keep in mind that we aren’t assessing just for the sake of assessing. Especially at the tactical level here, always keep in mind how your organization can use the work that you’re doing and put your outputs to immediate use. If your findings are more strategic in nature, then the changes may be sweeping organizational solutions; if your findings are more tactical, then perhaps they will result in only a small tweak to a specific buying pattern or relationship. As you carry out your risk model plans in this step, always keep in mind a clear path ahead for any given outcome.”
Join us in our next episode, where we discuss determining mitigations with Carrie Wibben and Aaron Narva.
Resources
Exiger TRADES Framework
Exiger Website
Laura Tulchin
Peter Jackson
Welcome to the Great Women in Compliance Podcast, co-hosted by Lisa Fine and Mary Shirley. Lisa and Mary welcome listeners back to a new season with hot seat questions put forward by their audience without time to prepare. They also give a spoiler alert for their next joint episode as something to look forward to and think about your submissions for the future. Here are the questions Lisa and Mary tackled in this episode:
- How do you continue to learn in order to stay on top of things in your role?
- “If your ideal compliance leader was an animal, which animal, and why?”
- When did you realize that GWIC has grown from the podcast to a larger community? Was there a moment for you?
- If you had an extra $10k and had to spend it within the month- what would you do (personal or professional)?
- As someone who is a global traveler, when you get to go home to New Zealand, once you recover from the flight, what is the first “local”/hometown thing you want?
- Is it ever okay for an E&C investigator to employ deception when interviewing a subject? I’ve worked at companies that allow very limited exceptions and others that say “never.” A common exception involves a subject who might figure out who the reporter is (and then retaliate against her/him). As we seek to do everything and anything possible to prevent retaliation against reporters, the investigator might say to the subject during an interview (in a situation where the internal reporter is known to the investigator), “Please make no effort to guess or otherwise identify the reporter. Doing so risks violating our anti-retaliation policy. The reporter may be anonymous or from outside the company–it doesn’t matter. The bottom line is, you must refrain from trying to determine or conclude who it is.” Of course, nothing in this example is a lie, but it is deceptive given the investigator knows the reporter isn’t external or anonymous. Certain countries may have laws or regulations that answer this question but, importantly, the standards of an E&C investigation–at least in the United States–are not the same as a government-led investigation. Also, many E&C investigators are not licensed attorneys, so there are no “licensed professional” restrictions to consider. So, , do you think it’s okay for an E&C investigator, in rare and previously identified instances, to deceive an interviewee when doing so likely could have a material effect on protecting a reporter from retaliation?
- What’s the biggest area (related to your current role) you are curious about and why?
- What are some of the things you are researching right now? (Could be personal- could be professional, could be vague)
- If there was one thing you could change about the way Compliance is perceived by people outside the profession, what would it be?
- We often hear of the importance of the birds and the bees. But in the compliance world, if you could only pick the attributes of one, which would it be and why?
We hope that you enjoyed this episode and welcome any feedback you may wish to send in to gwicpod@gmail.com.
For those of you in the northern hemisphere, it is the season for beach reads and you may be traveling after a long break. For your time off, you can pick up a copy (or download) “Sending the Elevator Back Down: What We’ve Learned from Great Women in Compliance” (CCI Press, 2020).If you’ve already read the booked and liked it, will you help out other women to make the decision to leverage off the tips and advice given by rating the book and giving it a glowing review on Amazon?
As always, we are so grateful for all of your support and if you have any feedback or suggestions for our 2021 line up or would just like to reach out and say hello, we always welcome hearing from our listeners.
You can subscribe to the Great Women in Compliance podcast on any podcast player by searching for it and we welcome new subscribers to our podcast.
Join the Great Women in Compliance community on LinkedIn here.
Compliance into the Weeds is the only weekly podcast which takes a deep dive into a compliance related topic, literally going into the weeds to more fully explore a subject. This week Matt and Tom take a deep dive into the recent SEC enforcement action regarding the SPAC Stable Road Acquisition Corp. and its acquisition of the space technology company Momentus. Some of the issues we consider are:
- What were the underlying facts?
- Were red flags missed, consciously avoided or outright ignored?
- Where was compliance due diligence?
- Bill Ackerman, Pershing Square Tontine Holdings and the proposed Universal Music acquisition?
- Diamond Acquisition Corp and its acquisition of Lordstown Motors.
Resources
Matt in Radical Compliance
The Second Act of SPAC Enforcement
In today’s edition of Daily Compliance News:
