Key Strategies to Strengthen Third-Party Due Diligence for the Retail Industry

As retailers seek to offset the impact of the US economy’s relatively slow recovery, opportunities to outsource processes to emerging markets have become very attractive.

While this practice seems like it will continue to grow, organizations need to consider the enormous risks associated with it, and prepare to handle supply chain disruptions efficiently. Retailers need to ensure that their third-parties protect confidential IT information, avoid unethical practices, maintain a safe and healthy working environment, comply with regulations, produce safe and quality products, mitigate operational risks, and much more.

When products are manufactured by contracted factories in different parts of the world, the risk and compliance profiles of many retailers change drastically depending on the policies and practices of each of those factories. For example, ‘fast fashion’ increases supply chain risks as factories are pressured to deliver products within short lead times, resulting in unauthorized sub-contracting. The retail industry in particular is highly dependent on suppliers, and is more likely to add new suppliers as and when products, fashion, or raw materials change. With the addition of these new suppliers, the cost of compliance and audit activities also increase. Hence, many retailers find it difficult to estimate their current compliance costs and determine how to align their resources to manage and mitigate critical compliance risks.

Retailers, therefore, need to put in a resilient third-party due diligence program in place in order to meet regulatory challenges, increase transparency within their supply chain, onboard new suppliers, and mitigate emerging risks from complicated supply chains.

 

Key Components of Third-Party Due Diligence

Third-party due diligence goes beyond just auditing and gaining visibility into the supply chain. It is the process by which a company takes action on the insights gained from due diligence programs to manage risks more effectively, and use supplier collaboration to bridge supply chain risks.

• Assessing Third-Party Risks

Given the number of locations from which companies source products and the route to market, the number of risks involved in the supply chain are numerous. Therefore, the first step is to identify and access high-risk areas that need more focus such as product safety and quality, supplier’s ability to meet deadlines, compliance with SLAs, social compliance issues, unauthorized sub-contracting, and so on. Better visibility into these areas helps organizations proactively handle risks that otherwise are overlooked due to complicated supply chain networks.

• Identifying Supply Chain Gaps

Once potential risks are identified, the next logical step is to determine the volume of products flowing from each supplier across the world. Conceptualizing risks through tools like Google Earth or 3D mapping helps in identifying points of vulnerability in cases where large volumes of products flow from suppliers in high-risk regions. This process helps in determining the nature of the retailer-supplier relationship: long-term versus short-term, the volume of products sourced from different factories, and so on. It helps in prioritizing third-party audits and assessments based on their level of compliance with exposure to top risk areas, and in determining gaps existing in the supply chain.

• Using Supplier Collaboration to Mitigate Supply Chain Gaps

Once the supply chain gaps have been identified, the company should collaborate with suppliers to help close those gaps. Retailers can engage with suppliers and factories and proactively work with them via corrective action plans, training, and incentive programs, to drive improvements that will lead to better productivity, quality, and risk management. They can also collaborate with industry peers to develop solutions to common problems and across common factories, if any.

• Managing and Monitoring Performance

In order to manage a sustainable third-party due diligence program, the organization needs to establish third-party performance parameters and map them to the identified third-party risks. Organizations should configure and distribute supplier performance surveys and self-assessments, define supplier KPIs, and create and manage supplier scorecards with closed-loop support for performance improvement. They can prepare supplier scorecards with scores based on quality, delivery, cost, and responsiveness. Based on supplier scorecards and rating, organizations need to evaluate corrective actions and collaborate with factories periodically to measure improvements, monitor emerging risks that stem from business expansion, and report internally and externally to improve supply chain risk management.

 

Technology as an Enabler

Traditionally, retailers conducted third-party compliance and risk checks through labor intensive, manual processes using tools like Excel. To manage the complexity of global supply chains, third-party due diligence software and solutions play a major role in helping organizations conduct audits, compliance checks, and mitigate associated risks.

With an automated and robust third-party solution, organizations can streamline their end-to-end third-party due diligence program from supplier on-boarding to risk assessment, information management, due diligence reporting, and corrective actions implementation. Additionally, advanced analytics and powerful dashboards help retailers convert data into meaningful insights and make informed decisions.

Organizations can leverage third-party management solutions to:

• Streamline third-party screening and on-boarding by defining a process to qualify, segment, and rank third-parties
• Identify and automate risk assessment process to understand the level of risk associated with the third-party and perform risk assessments based on the type and context (i.e., reputation, information security, financial, strategic, or business continuity)
• Continuously monitor and review the performance of third-parties to identify and document ‘red flags
• Integrate the due diligence programs with external third-party data sources that have information on high risk vendors, sanction lists, state-owned enterprises, regulatory alerts, politically exposed parties and other relevant information

 

Conclusion

As organizations grow, expand, and merge, it is important to build sustainable third-party networks by leveraging the power of sophisticated technology. Especially for an industry like retail, where there is a necessity to add new suppliers at frequent intervals, it is imperative to establish a streamlined third-party due diligence process.

Once implemented, third-party due diligence becomes a normal part of doing business that everyone in the organization values and follows. It helps the organization establish relationships with the right vendors from the beginning, and therefore, brings down the overall cost of audits and compliance. In the end, knowing your vendor risks in advance not only helps the organization as a whole, but is also in the favor of consumers and the society at large.