The evolving world of supplier risk

The evolving world
of supplier risk

The evolving world of supplier risk
Industries impacted by recent supply chain disruptions are moving
quickly to improve their ability to manage procurement risks.
Oil and gas companies can learn from their experiences.
By Niul Burton
When the Japanese tsunami
devastated that nation in 2011,
the impact of the disaster was
eventually felt around the world.
The Japanese manufacturing
industry was hard-hit, with many
facilities shut down for months. In
turn, auto manufacturers in Detroit
and elsewhere — who rely on parts
made in Japan — had no choice but
to suspend production when their
supply chain was disrupted.
Natural disasters can have catastrophic
consequences for today’s interconnected
global supply network. But they are not
the only risk. In the airline and aerospace
have hampered the ability of manufacturers
to get parts in a timely manner. And for
violations surrounding their procurement
activities in foreign countries have had a
negative impact. These types of disruptions
long-lasting consequences.
For some time, companies have approached
supply chain uncertainty in a fragmented
operations all working independently to
manage certain aspects of supplier risk.
These unconnected activities, however
successful, provide no enterprise-wide
awareness or understanding of which
why. By attempting to manage supplier risk
in functional “silos,” companies lack the
overarching strategy, structure and processes
to prevent a costly procurement situation.
Today, however, company boards are expecting more proactive efforts, and smart companies
are integrating these functional efforts to develop a holistic view of supply chain risk —
identifying key gaps in the chain, monitoring potential risks and taking mitigating measures
of what natural or man-made obstacles might occur. This approach, which Ernst & Young calls
Total Supplier Risk, is helping companies effectively manage all types of procurement-related
risk across the breadth of their enterprise in a coordinated, strategic fashion.
Supplier risks in the energy industry
Despite increasing awareness post the Macondo well blow-out of the risks that are embedded
in the supply chain, there is still a mindset in the oil and gas industry that supplier risk is just
part of doing business, and managing it is a bit of an enigma.
Many energy company procurement departments have never been asked to assess or quantify
or manage risk. It is a skill set they haven’t developed, and doing so alone — without proven
It is true that oil and gas companies operate differently than, say, an automobile manufacturer,
assembly lines moving. But suppliers still play an important role in the production of energy.
In fact, there are substantive supplier risks that impact the oil and gas industry. The rapid
pipe and drilling materials such as sand in several regions of the country.
Of course, many energy companies do business in developing countries where major suppliers
to be reliable. And insolvency of suppliers within the supply chain can be an issue even here
multiple liens against a US producer who had done business with the shuttered company. It
cost several million dollars to extricate the producer from the situation.
Another critical issue for oil and gas companies is supplier regulatory compliance — for
example, is that third-party contractor handling clean-up work following all applicable
environmental statutes? Is your contractor in Nigeria following international bribery laws
when it obtains licenses or permits? What due diligence did you undertake? These are risks
The good news is that awareness of the need for improved supplier risk management is
organization needs to improve existing processes or add capabilities to improve their
supplier risk management. These companies — including many in the energy industry —
supply chain breakdown.
The evolving world of supplier risk

Five critical areas of risk
Execution — Is your company in danger of
having to stop operations because you can’t
get tools, supplies and necessary services
on time at locations where you do business?
Do your suppliers meet all appropriate
safety and environmental regulations and
provide quality goods and services?
Commercial — Do your suppliers comply
with all contractual terms? Do they bill you
appropriately?
Continuity
stable? In the event of a natural disaster
or other disruption, do you have multiple
suppliers with geographic diversity who
can keep your operations running?
Competitive — Do your suppliers present
risk in terms of theft of intellectual
Compliance — Do your suppliers comply
with critical regulatory guidelines such
as the Foreign Corrupt Practices Act/
UK Bribery Act, labor laws, domestic
government regulations, tax laws and more?
Total Supplier Risk is a program designed to
recognize and eliminate avoidable risk, and
reduce the impact of unavoidable risk.
Procurement takes a proactive role in
identifying and managing risk, and functional
groups are involved in risk-event response
and post-event repair to limit the impact
and reduce the amount of time it takes
the company to return to business as usual.
In addition, risk monitoring functions,
such as Internal Audit, Legal, Compliance
and EHS, coordinate closely to avoid
duplicative activities or, worse yet, fail to
monitor controls in high risk areas. The
goal is to create an ongoing program that
improves the company’s understanding of
its supplier base — and the overall operating
environment — so that procurement risks can
be managed with the same level of intensity
Path to maturity
A comprehensive supplier risk program begins with reactive activities to manage disruptive
events. A path toward achieving a comprehensive supplier risk program includes functional
real-time/predictive continuous supplier risk management. Along the way, the company
develops an integrated program — underpinned by technology — to measure supplier
performance and manage potential risks wherever they occur. All aspects of supplier risk are
covered and responsibility for monitoring and management is clearly delineated.
At Ernst & Young we use an operating model to articulate all of the necessary components
of an effective supplier risk management program:
for TSR, including objectives,
sponsorship and funding
Create and apply risk mitigation
and monitoring activities to
ensure compliance to plan
Implement the optimal
approach to address
each risk
Design TSR organization
and governance,
including roles and
responsibilities
A critical part of the process is applying tiered criteria to the company’s supplier universe to
segment out by risk levels. For example, a company with 2,400 total suppliers may have 200
50 with trending quality issues or liquidity concerns, and a handful that require immediate
remediation or phase-out actions. Understanding which companies present the highest level
of risk is critical to focusing mitigation efforts properly.
Through this process, Total Supplier Risk can help companies determine which vendors require
additional development support — liquidity workouts, capability development or health, safety
and environmental training — and which vendors should be phased in an orderly way.
dashboard views, and enable risk impact modeling, supplier risk scoring modeling and
mitigation effectiveness modeling.
From there, companies can create controls and processes to mitigate avoidable risks, and
develop supplier options to minimize the disruption of unavoidable ones.
The evolving world of supplier risk
People and
governance
4) TSR
monitoring
Monitor
Address
Strategic
direction
and policysetting
Processes
1) Supplier
segmentation
Identify
Assess
3) Mitigation actions 2) FMEA assessment
Technology
enablement
Segment suppliers into appropriate
risk segments
Vet suppliers against the relevant
global procurement risk inventory
Conduct failure mode and
effects analysis (FMEA) on
suppliers/segments and
determine mitigation steps
Design and
implement the tools,
systems and
reporting to support
the TSR program

suppliers are segmented into risk tiers as described above, and
a failure mode and effects analysis (FMEA) is conducted on each
high-risk supplier/segment. Then, mitigation options are tested and
plans are implemented. The company begins its supplier monitoring
activities. This serves to limit the imminent exposure.
In the second phase, the operating model for Total Supplier Risk is
built out as a repeatable process. The strategic direction and key
developed. Technology requirements are determined. The processes
ongoing monitoring of controls is established to verify that they are
operating as intended.
The actual detailed steps involved in Total Supplier Risk can be
tailored to align with the goals of the organization. For example,
an energy company that is concerned with regulatory compliance
operating environment in those locations.
In conclusion
The issue of supplier risk is a critical one for every company that relies
on suppliers, contractors or third parties for necessary products and
services. Total Supplier Risk can help companies assess high-priority
tested processes and capabilities going forward for recognizing and
dealing with all manners of procurement issues.
The result is a fully integrated risk management program that helps
your company is measuring, managing and responding appropriately
to the business risks your suppliers present.
Contacts:
Niul Burton
niul.burton@ey.com
Craig Nishimura
craig.nishimura@ey.com
Lee Prillaman
leeland.prillaman@ey.com
Ernst & Young
Assurance | Tax | Transactions | Advisory
About Ernst & Young
Ernst & Young is a global leader in assurance,
tax, transaction and advisory services.
by our shared values and an unwavering
commitment to quality. We make a difference
by helping our people, our clients and our
wider communities achieve their potential.
Ernst & Young refers to the global
organization of member firms of
Ernst & Young Global Limited, each of which
is a separate legal entity. Ernst & Young
Global Limited, a UK company limited by
guarantee, does not provide services to
clients. For more information about our
organization, please visit www.ey.com.
Ernst & Young LLP is a client-serving
member firm of Ernst & Young Global Limited
operating in the US.
How Ernst & Young’s Global Oil & Gas
Center can help your business
The oil and gas industry is constantly
changing. Increasingly uncertain energy
policies, geopolitical complexities, cost
management and climate change all present
significant challenges. Ernst & Young’s Global
Oil & Gas Center supports a global practice
of over 9,000 oil and gas professionals with
technical experience in providing assurance,
tax, transaction and advisory services across
the upstream, midstream, downstream
and oilfield service sub-sectors. The Center
works to anticipate market trends, execute
the mobility of our global resources and
articulate points of view on relevant key
industry issues. With our deep industry
focus, we can help your organization drive
down costs and compete more effectively to
achieve its potential.
© 2012 Ernst & Young LLP.
All Rights Reserved.
SCORE no. DW0198
WR no. 1209-1395355
This publication contains information in summary form
and is therefore intended for general guidance only. It
is not intended to be a substitute for detailed research
or the exercise of professional judgment. Neither
Ernst & Young LLP nor any other member of the global
Ernst & Young organization can accept any responsibility
for loss occasioned to any person acting or refraining from
action as a result of any material in this publication. On
any specific matter, reference should be made to the
appropriate advisor.
ED None