One important source of operational risk relates to the organizations, people, processes, and resources comprising a company’s supply chain. In many sectors, companies increasingly depend on the external elements of the supply chain (e.g., suppliers, outsource partners, third-party logistics) in an effort to cut costs while increasing capabilities and global reach. Because every business depends on a well-functioning, cost-effective supply chain, every board should consider its oversight of supply chain risks. The following are seven suggestions for better board-level oversight of supply chain issues.
1. Strike the right balance when selecting a supplier. Time, cost, quality, and risk are four factors a company needs to consider when identifying potential suppliers, negotiating contracts, and evaluating supplier risk and performance throughout the lifespan of the contract. Boards should be leery when management emphasizes one or two factors over the others as this can result in unintended consequences. For example, seeking to reduce procurement costs when negotiating supply contracts should not lead to the unintended consequence of taking delivery of components that fail to meet critical quality specifications or timing requirements.
2. Make procurement decisions with an enterprisewide perspective. Striving for functional excellence is a laudable goal, but it has its limits. Companies can incur huge losses making procurement decisions in isolation, ignoring initiatives undertaken by the research and development, engineering and finance functions.
3. Ensure the supplier agreement spells everything out. When a contract clearly defines scope, business objectives, deliverables and performance specifications, it lays the foundation for ongoing monitoring of contract compliance and supplier performance and reduces the risk of costly disputes and misunderstandings. For example, the contract should clarify product and packaging specifications and quality control and inspection protocols so that performance can be monitored over time. It also should ensure that intellectual property and critical assets (e.g., proprietary molds and tools the company gives to the supplier) are adequately protected. Due to the complexity of managing suppliers operating in other countries, boards should ensure that the procurement process is supported by legal advisers knowledgeable of the applicable court jurisdictions, particularly in countries where laws, customs, and business ethics may vary.
4. Hold suppliers to the same level of accountability. The rigor of company processes for identifying, sourcing, measuring, monitoring, and reducing third-party relationship risks should be proportionate to the level of risk and complexity of those relationships. With respect to legislative and regulatory developments regarding disclosure of the actions a company has voluntarily undertaken to remove labor abuses from its supply chains, companies should seek the advice of counsel as to the status of these developments and the jurisdictions and circumstances in which they apply. Given this environment, a case can be made for adopting and enforcing a supply chain code of conduct—especially for vendors authorized to act as agents on behalf of the organization. Coupled with a code of ethics that details the principles and values by which the company operates, a code of conduct might address topics such as human rights, health and safety standards, environmental sustainability standards, ethical and responsible business behavior, and cybersecurity standards.
5. Conduct periodic third-party audits. A supply chain code of conduct is only as good as the vendors who sign it. That’s why a cost-effective third-party audit process is Such audits may be integral to the due diligence associated with vendor selection and onboarding. Conducted on a periodic basis, third-party audits may focus on: selected internal controls, such as cybersecurity; vendor performance against contract specifications; and compliance with laws and regulations. The audits may also be conducted before contract renewals.
6. Monitor supplier risk and performance over the life of the contract. The risk environment is not static over the life of the contract. All suppliers should be segmented based on factors such as risk, the level of spend, criticality, and alternatives in the market. The segmentation should drive the level of preselection due diligence, the contracting strategy, and the level and frequency of monitoring through contract duration. Ideally all facets of contract and supplier risk are addressed through performance reporting, including early warning alerts before it’s too late to act on a timely basis.
7. Pay attention to business continuity risk. There are many instances where a single-source supply strategy is the right business decision. In these cases, however, quality, time, and cost considerations often win out over business continuity risk considerations despite the risk of supply chain disruptions. Thus, risk assessments should consider what could happen to the organization’s business model if any key component of the supply chain were taken away, even though a cause may be somewhat elusive at the time of the assessment.
An assessment should also consider the implications of plausible and extreme scenarios stemming from the loss of strategic sources of supplies for an extended period, including exposure to data security risks and physical access to sensitive information, the financial impact, expected recovery time, and adequacy of current recovery and contingency plans. To illustrate, directors should inquire whether management has considered the following questions:
What would happen if we were to lose, for any reason, one or more of the suppliers that we depend on for essential raw materials and components?
How long would we be able to operate?
What if there were significant disruptions in transportation?
What contingency plans do we have?
Have our key suppliers performed their own risk assessments with respect to key “Tier Two” or “Tier Three” suppliers? How do we know?
The board should be informed of the results of these assessments.
Robert P. Silvers is a respected expert on Internet of Things security and effective corporate planning and response to cybersecurity incidents. Silvers is a partner at Paul Hastings and previously served as the Obama administration’s assistant secretary for cyber policy at the U.S. Department of Homeland Security. Silvers will speak at NACD’s 2017 Global Board Leaders’ Summit in October and NACD’s Technology Symposium in July.
Robert P. Silvers
Cybersecurity breaches pose a growing threat to any organization. As we’ve seen in recent years, and indeed in recent weeks, the most sophisticated companies and even governments aren’t immune from cyberattack. Ransomware has become a global menace, and payment data and customers’ personal information are routinely swiped and sold on the “dark web” in bulk. Next-generation Internet of Things devices are wowing consumers, but they are also targets, as Internet connectivity becomes standard-issue in more and more product lines.
How do directors prepare for this landscape? Everyone now acknowledges the importance of cybersecurity, but it is daunting to begin to think about implementing a cybersecurity plan because it’s technical, fast-moving, and has no “silver-bullet” solutions. Most boards now consult regularly with the organization’s information security team, but the discussions can be frustrating because it’s hard to gauge readiness and where the organization really stands in comparison to its peers. Sometimes directors confide in me, quietly and on the sidelines, that their real cybersecurity strategy is one of hope and prayer.
There are steps directors can take now to prepare for incidents so that when they occur the company’s response is well oiled. With the right resources and preparation, boards can safely navigate these difficult and unforeseen situations. Three key strategies can assist directors as they provide oversight for cybersecurity risks:
Building relationships with law enforcement officials
Having incident response plans in place (and practicing them)
Staying educated on cybersecurity trends
1. Building Relationships With Law Enforcement Officials
It’s no secret that relationships are central to success. Building the right relationships now, before your worst-case scenario happens, will help manage the situation. The Federal Bureau of Investigation is generally the lead federal investigative agency when it comes to cybercrime, and the United States Secret Service also plays an important role in the financial services and payment systems sectors.
Boards should ensure company management educates law enforcement officials from these agencies about the company’s business and potential risks. In turn, the company should ask law enforcement to keep it apprised of emergent threats in real time. There should also be designated points of contact on each side to allow for ongoing communications and make it clear whom to contact during an incident. This is critical to ensuring that the company has allies already in place in the event that a cyberattack occurs.
2. Having—and Practicing—Incident Response Plans
Directors should ask to see copies of the company’s written cyberbreach response plan. This document is essential. A good incident response plan addresses the many parallel efforts that will need to take place during a cyberattack, including:
a. Technical investigation and remediation;
b. Public relations messaging;
c. Managing customer concern and fallout;
d. Managing human resources issues, particularly if employee data has been stolen or if the perpetrator of the attack is a rogue employee;
e. Coordination with law enforcement; and
f. Coordination with regulators and preparedness for the civil litigation that increasingly follows cyberattacks.
An incident response plan is only valuable if it is updated, if all the relevant divisions within a company are familiar with it, and if these divisions have “buy in” to the process. If the plan is old or a key division doesn’t feel bound by it, the plan isn’t going to work. Directors should insist the plan be updated regularly and that the company’s divisions exercise the plan through simulated cyber incidents, often called “table-top exercises.” Indeed, table-top exercises for the board itself can be an excellent way to familiarize directors with the company’s incident response plan and its cyber posture more generally.
3. Staying educated on cyber security trends
As your board is building relationships with law enforcement officials and preparing an incident response plan, directors should also be educating themselves on cyber risk. Cybersecurity becomes more approachable as you invest the time to learn—and it’s a fascinating subject that directors enjoy thinking about. Do you know what a breach will look like for your company? What protocols do you have in place in case something happens?
According to the 2016–2017 NACD Public Company Governance Survey, 89 percent of public company directors said cybersecurity is discussed regularly during board meetings. Since a majority of directors in the room agree that cybersecurity is worth discussing, directors should collectively and individually prioritize learning the ins and outs of cyber risks.
One easy way to stay up to date on the latest is to ask the company’s information technology security team for periodic reports of the most significant security events that the company has encountered. This will give directors a feel for the rhythm of threats the company faces day in and day out.
Another option is for directors to take a professional course and get certified. The NACD Cyber-Risk Oversight Program is a great example of a course designed to help directors enhance their cybersecurity literacy and strengthen the board’s role in providing oversight for cyber preparedness. Consider these options to keep yourself as educated and informed as possible.
The more you can prepare individually, the better off you will be when you have to provide oversight for a cybersecurity breach at your company.
How much of your personal data is out there, available for companies to slice and dice—and potentially for hackers to find? Your username and password information to your e-mail account? Your medical records? Your government identification numbers? What about all of the information in your connected devices?
Many companies are moving toward a digital business model, which is generating a massive amount of data about customers. With that proliferation of customer data also comes valuable opportunities for companies to analyze and act upon it. But the explosion of data is also creating a very big, mostly invisible window into people’s private lives that may leave them very vulnerable to identity theft and other crimes.
New privacy laws and incidents of privacy violations, identity theft, and compromise of personal and sensitive information are compounding, which is pressuring companies to prioritize data privacy, security, and compliance. Failure to do so could mean damage to their brand and shareholder value—and even enforcement action by US federal agencies or class action lawsuits.
Data privacy is now a topic that boards need to stay on top of. Directors will want to regularly ask management questions about the company’s efforts to protect its customers’ personal information. Here are five questions boards can ask management about the topic.
1. What is our total dollar exposure to data privacy risk, exclusive of data security? Violating established privacy and data security practices can be costly. According to analysis of government data by PwC, in 2016, companies paid nearly $250 million in privacy and security related fines. It’s critical for the board meet with the right people to understand what steps the company is taking to protect its sensitive information. By meeting with the chief risk, information security, and privacy officers, the board can get a better picture of the state of privacy risk, including the dollar value of the worst possible data privacy risk event. The board also needs to determine if it is receiving the information it needs to oversee privacy risk. And if it’s not, the board needs to ask for and get it from management.
2. How effective is our data privacy strategy? Data is starting to change companies’ business strategies. Nearly two-thirds (64%) of CEOs believe that management of data will be a differentiating factor in the future. For some companies, it already is. The board should ask management to explain the company’s data privacy strategy and outline any goals around data collection and use. Is the data-driven business strategy to grow sales and revenue, improve customer experience, trust and relationships, differentiate the business, or get a competitive edge? Once the board understands that strategy, it can have discussions with management about whether the strategy is effective. The board will want to ask management for updates to that strategy and changes to any plans to achieve those data-related goals.
3. How ready is the company to provide evidence of compliance to privacy regulators? Companies that collect and use personal data need to pay close attention to privacy laws. The European Union’s General Data Protection Regulation (GDPR)—the world’s toughest privacy law—goes into effect in 2018, and the deadline for compliance is May of next year. It is notable that businesses that do not comply with GDPR face a potential fine of 4% of global revenues. Boards need to understand other laws and regulations around data privacy, too. They should ask management about what the company is doing to comply with data privacy laws. Is management ensuring the company stays on schedule to meet the law’s requirements and stays within budget for its compliance efforts? Boards should ask if the company has a data privacy compliance program, what the program entails, and how the company accounts for all the data the company collects, including where it’s housed. Boards need to be assured that management has the right processes and controls in place to mitigate any risk to that data.
4. Are the company’s plans for adopting new technologies and data analytics in sync with emerging global privacy regulations? Directors will want to look beyond compliance with current laws to the ethical issues that data use present. Just because a company collects data doesn’t mean it can—or should—use it, or allow third parties to access it. Data ethics standards are an emerging topic of practice, which means there aren’t always clear rules or laws outlining how companies can use personal customer data. Consider, for example, that some companies may use technologies such as artificial intelligence and machine learning to surveil for terrorist activity. There are few, if any, regulations around this type of implementation, which could leave these companies open to ethical scrutiny. Directors will want to discuss with management how to draw these ethical and privacy lines in the sand and how the company ensures they are not crossed. Boards will also want to ask how the company evaluates the privacy impact of new products or third-party partners.
5. Is the company’s privacy organization sufficiently resourced to enable its growth plan? Data privacy concerns may become bigger if the company grows. The more customers it attracts, the more data about them it may be collecting and analyzing. As the company’s data collection grows larger, the importance of having a data-use framework also grows. A good framework is one that outlines the collection of data, where and how it’s stored, how it’s protected, how it’s being used, any training on data privacy policies, and what the plan is if there is a breach. The board will want to meet with the chief information security and chief privacy officers to discuss the framework and ask how it’s being implemented, tracked, and enforced.
If the board regularly talks to management, asks questions, and gets answers and information, it will be in a good position to effectively oversee the company’s data privacy, protection, and compliance program.
Paula Loop is the leader of PwC’s Governance Insights Center and is a well-known speaker on a variety of governance topics. As a PwC partner and with more than 20 years of experience, Paula brings extensive knowledge in governance, technical accounting, and SEC and financial reporting matters to organizations.
Jay Cline is PwC’s Global Privacy Co-Lead. He has over 20 years of experience and is a nationally recognized thought leader in the privacy profession. He has deep knowledge of law, technology, and business, and specializes in all major privacy legislation and information security standards. In his work, Jay has helped private and public sector clients comply with data privacy and security regulations across nearly every sector.