Cyber Risk & Supply Chain Management

Supply chain management involves the coordination of the flow of goods, from the transaction and storage of raw materials, to checking inventory and shipping finished products. Supply chain weaknesses are one of the biggest threats facing businesses – particularly those involved in manufacturing or retail. Cyber risks can undermine effective supply chain management, with research showing that disrupting a supply chain cuts the share price of the affected company by an average of approximately ten percent.
Bearing in mind that international supply chains (and transport infrastructure) are the skeleton of economic growth, trade and the basic functioning of an increasingly interconnected global economy, anything that can reduce cyber risk has an economic payoff.

What are cyber risks and how do these risks impact supply chains?

For the last few years the Supply Chain Risk Initiative, spearheaded by the World Economic Forum, has sought a deeper understanding of the systemic vulnerabilities to international supply chains and transportation channels. The initiative urges companies around the globe to shift from a reactive stance against cyber risk to proactive steps to risk management.
Supply chains can be disrupted by external threats or systemic shortcomings. External threats include things like demand shocks and natural disasters, whereas systemic shortcomings include things like information fragmentation and cyber risk. In fact, the escalating cyber risk to supply chains has caused over four-fifths of companies to emphasize the resilience of supply chains, according to research conducted by Accenture.
What are the factors that inform and can help mitigate systemic risks like cyber risk?
Cyber risk can be mitigated to protect supply chains by:
• Tightening the security at every step along the supply chain;
• Creating resilience in strategy, partnerships and information technology
Benefits to Addressing Supply Chain Risks
Of course, the economic ramifications of cyber risk and systemic vulnerabilities to supply chains vary by the industries in which they take place. A company that leans on logistics, for instance, has different risks. Irrespective of the industry in which cyber risk occurs, however, cyber risk can usually expose customer accounts and intellectual property in a way that puts company finances and reputation in permanent jeopardy.
Research from Zurich shows that over half of disruptions in supply chains accrued because of information technology or communications shortcomings between suppliers and buyers. This finding highlights the importance of curbing systemic vulnerabilities and cyber risk at the beginning of the supply chain especially. That said, risks at all levels should be addressed because information technology pervades every step along the supply chain ladder.
Unfortunately, these systemic vulnerabilities to supply chains are expected to increase as the US economy and global growth once again accelerates. While companies should understand the risks of external threats, the lion’s share of future cyber risk will come from systemic failures to secure customer data and proper IT functioning at all levels of the supply chain.
Checking that each vector of your supply chain is airtight and trustworthy is an important ingredient in significantly reducing cyber risk. Addressing shortcomings in vendor management can also reduce cyber risk and systemic vulnerabilities – producing growth as an offshoot.
Being proactive in combating systemic vulnerabilities is essential in cutting down losses in share prices due to supply chain disruptions; moreover, addressing systemic vulnerabilities now rather than after-the-fact will spur growth, trade and expansion.

Risk Management: Lessons for Middle Market Businesses

When you are a middle market company, it might seem like risk management is less of a concern, but even smaller businesses can learn from the mistakes of big boys like Goldman Sachs and Toyota. Emerging companies needs to embed risk management practices into the core of their business so that as they grow, there is a foundation to build on. Here are a few basic steps that middle market companies can take to more effectively manage their risks:

1. Proper Continuity Planning

A common practice for large businesses, but sometimes overlooked in smaller arenas, continuity planning helps identify potential risks, both internal and external, and then looks for solutions. Businesses must pinpoint the hard and soft assets necessary to protect the company from risks and allow for swift recovery while still maintaining a competitive edge. For example, crisis management schematics and off-site backup storage are tools for continuity planning.

2. Creating a Crisis Plan

A crisis plan gives direction should a problem occur. The goal is to target the decision-making process and ensure that decision makers have the resources they need to act quickly in a crisis situation. Once the plan is complete, test it thoroughly and often. Without proper testing, a crisis plan can lose validity as the business changes.

3. Focus on Supply Chain Issues

A business is only as strong as its supply chain. In an attempt to create a more cost-effective process, many companies allow the supply chain to narrow. If a key supplier fails unexpectedly, this can put the entire business at risk.

4. Understanding Risk Appetite Levels

Risk appetite is the level of risk the business is willing to accept before taking action. A business must assign risk appetite levels for each project and understand some short-term failures may lead to long-term success in the right situation.

5. Benchmark the Quality of the Risk Management Strategy

Benchmarks tell a business how well their risk management effort is working. It measures progress in areas like:

• Risk identification
• Risk Assessment
• Risk Tolerance and Evaluation

These all require regular scaling to ensure they remain effective. Benchmarking looks at risk models and evaluates the infrastructure.

6. The Use of Captive Insurance

Captives are effective tools for covering certain lines of business – such as worker’s compensation – that have predictable claim rates. This allows the middle market company more leeway in other ventures and helps them maintain risk in other areas.

7. Understand Cyber Risks

In today’s high-tech environment, cyber risk is even more prevalent in businesses of all sizes. Enterprises must produce cyber risk polices and define online behavior rules to improve virtual security, especially when dealing with personal mobile devices and social media sites.

8. Establish Return-to-Work Standards

Return-to-work programs can lower workers compensation costs by establishing protocols for employees coming back after injury. Return-to-work programs allow these individuals to participate in modified work assignments that get them back on the job safely to reduce disability payouts.

9. Provide Ongoing Risk Education

Companies of any size can benefit from ongoing risk management education. This can include sending key staff to continuing education classes and seminars or helping them network through conferences and professional organizations. Ongoing education exposes them to the latest trends in risk management.

Middle market businesses that establish risk management practices are already ahead of the curve. As the business grows, they will have the core necessary to identify and handle crises as they happen and set up protocols to avoid them.