Given supply chains’ importance in the everyday operations of businesses, supply chain managers’ role in keeping risks to a minimum is more important than ever. When they do a poor job, the results can be disastrous. Consider the example of Morgan Stanley, which was assessed a $60 million penalty for not properly overseeing the decommissioning of two of its U.S. data centers by a subcontractor. The company underestimated and didn’t act on the potential risks involved, and as a result, potentially exposed the personal data of its customers. The Office of the Comptroller of the Currency (OCC) stated that Morgan Stanley failed “to adequately assess the risk of subcontracting the decommissioning work, including exercising adequate due diligence in selecting a vendor and monitoring its performance.”
Even if Morgan Stanley did every other part of their contract management and supply chain management processes with perfect planning and execution, missing the mark by bringing on this one vendor to handle the decommissioning cost them $60 million. The reputational damage of this kind of violation and fine can be lasting; partners and customers may be wary about how such a company would handle their data, and shareholders could see an increased risk in sticking with such a company.
No matter the organization, finding the weakest link throughout the supply chain (in Morgan Stanley’s case, it was that vendor) and fixing it is far preferable to fines. Even better, though, is keeping these weak links from being added to the supply chain at all. That requires planning, thorough research, due diligence, and detailed contract management whenever a new vendor comes on board.
An air-tight vendor selection process goes a long way to removing many of the risks that could circle back to harm an enterprise if they end up being realized. Resist the temptation to simply “rubber stamp” new vendors. Instead do your homework and thoroughly vet them. It will take a little more time upfront but could avert disastrous outcomes down the road.
Here are some questions that can help your company assess the risks of potential suppliers during the vendor selection process.
Does the vendor take adequate security measures?
Given how close companies must work with their vendors, and the information that is often shared between them, any risk a vendor takes on due to inadequate security measures will be shared by those working with them as well. A hack could not just lead to your vendor’s sensitive data being exposed, but data from your company as well. This could lead to fines for both companies. Additionally, a vendor who is hacked and must scramble to deal with the fallout of that attack will likely have their production slowed for at least some time—directly affecting your business operations.
How has the vendor performed historically?
This one should come as a given, but it’s the most crucial question to be answered: Is the vendor reliable, are they effective at what they set out to do, and do they meet deadlines while producing the quality of product they promise? Financial reports and press coverage will help shed light on their past performance, as will any references that you can get in contact with. If they can’t keep customers for long, that might be a sign that there is something amiss.
Are they sanctioned—or working with sanctioned companies or individuals?
Sanctions compliance is an extraordinarily complex task for supply chain managers to stay on top of. The U.S. Office of Foreign Assets Control (OFAC) designates what entities are considered sanctioned (or “blocked”), and doing business with one—such as bringing one on as a vendor—is a violation that will result in financial penalties and reputational damage. Companies on the sanctioned list are often there because they’re connected to autocratic government groups, are perpetrating or ignoring human rights abuses, or are involved in other situations that your company doesn’t want to be anywhere near. If the vendor isn’t sanctioned but is working with sanctioned individuals or companies themselves, that adds more risk to your plate; if they are fined or need to replace their partners, this could disrupt or delay their operations (and, by extension, yours).
What is their contingency plan if their partners or suppliers become sanctioned?
With the increased geopolitical instability we’ve seen in recent years comes increased numbers of sanctions. Staying compliant is difficult because the sanctions environment is shifting rapidly. Just because a company isn’t blocked now doesn’t mean it won’t be in the near future—it’s important that your vendors have plans in place if such an event were to occur to one of their partners, just as you should if it happens to a vendor of yours.
Notably, the OFAC 50% rule states that even if a company isn’t on an official sanctioned list, if that company is owned by another organization or an individual that is on the list, the company is also considered blocked. Companies should be vigilant in maintaining visibility into the UBOs—ultimate beneficial owners—of the companies they work with to get a better picture of the real compliance scenario of each potential vendor.
How flexible are the vendor’s operations?
Demand is rarely static, so it’s vital that vendors can scale up or down depending on the situation. Sometimes, seasonal trends affect demand and are easy to predict, but what happens if an unexpected event causes an increase in desire for your product—is the vendor able to spin up production with little delay, and what would that process look like? As artificial intelligence (AI) allows us to predict trends or recognize them in their earliest stages, the other half of the puzzle is having production match that expected demand as closely as possible. If a vendor can’t increase capacity or can’t do it without a long delay, it might result in your company missing out on opportunities.
Do the vendor’s values and operations align with your business objectives?
Setting your company’s values and objectives in stone via a mission statement and solidified by top-down company actions whenever possible helps those principles trickle down to directors, management, and employees. This will go all the way down to the vendors and the way they do business. Whatever is most important at your company, make it known to everyone who works there. Set an expectation that all business decisions should reflect the company’s values and best interests. When it comes to the vendor selection process, assuring that all suppliers being brought on can operate with those same values will help protect brand identity in the marketplace and allow you to continue to deliver on your mission.
How’s the vendor’s diversity stance—and practice?
Higher levels of employee diversity are a boon for a company, leading to greater innovation and financial performance, according to many studies. If the vendor has taken steps to promote a diverse environment at their organization, that suggests a higher likelihood of success at their firm—which your company can indirectly benefit from. Don’t ignore the competitive advantages of supplier diversity, either—a diverse vendor portfolio, with suppliers from different regions and industries will reduce the risk that disruptions that occur at one will affect operations at your organization. A diverse supplier portfolio makes pivoting in response to disruptions easier.
How do they approach sustainability?
Does the vendor have a sustainability program in place? If they don’t, that could represent a significant risk to your organization, since ESG (environmental, social, and governance) regulations have been passed in the EU and are being floated in some U.S. states and other countries. These require companies to report their emissions and other environmental impacts—and the emissions and activities of their vendors are also often required. That means a vendor that does not track their emissions and has no sustainability program in place will, at best, cause more work for your organization as you try to determine how to report their activities and emissions. At worst, working with a vendor who is unable to disclose emissions and doesn’t have a sustainability plan could open you up to fines and other risks.
Further, if they’re not operating with sustainability in mind, there’s a good chance they aren’t operating with energy efficiency in mind, either—meaning their energy costs are higher than they need to be, and they could be passing those excess costs on to you, the buyer.
What are their SEC reporting processes like?
Speaking of ESG, you can get a good view of a vendor’s ability to meet sustainability commitments by checking their U.S. Securities and Exchange Commission (SEC) reporting processes in the last few years. The company’s ability to comply with regulations and report on time is a great indicator of its ability to regularly meet deadlines and provide the products it promises. As an added bonus, these reports shed a lot of light on the financial status of vendors—it’s helpful to know during the vendor selection process if a potential supplier is likely to go under in the near future or not.
What’s your risk appetite—does this vendor fit into it?
Every decision you make will carry some level of risk, and selecting a vendor is no different. Even the safest-seeming vendors could result in unintended consequences to a business. But even when a vendor represents a greater risk than other options, the potential benefits may be enough that taking that risk on is acceptable to a supply chain management team. How much risk—be it financial risk, operational risk, strategic risk, security risk, or risk in another category—your organization or department is willing to take on defines your risk appetite. Some companies have a higher tolerance for risk than others, and there’s no right or wrong level of it to take on. What’s important is to determine what your appetite for risk is and what risk each potential vendor represents. From there, only bring on the vendors that fall within the bounds of your own acceptable risk.
Asked and Answered
The vendor selection process for today’s supply chain managers is long, intensive, and thorough if you want to do it right. While the above questions are not exhaustive, they represent a broad snapshot of the types of questions that you should be asking and where your focus should lie as you determine which vendors are most likely to help your organization grow to new heights—and which should be avoided.
