Resilience by Design: Building Supply Chain Risk Management From Day One.

Can technology help manage supply chain risk? Yes. Can technology eliminate all supply chain risk? Absolutely not: there are a series of third-party risks in supply chain that cannot be prevented with technology, and it’s crucial that organisations identify and manage these risks. And not just to satisfy the demands of regulators, who’ve responded as supply chain complexity and interconnectivity has increased, by adding compliance components that mean organisations must show they have taken control.

We’ve seen it happen: a niche vendor goes under, a critical service degrades and is no longer fit for purpose, or a key software supplier gets acquired and priorities shift. Suddenly you’re exposed. These types of failure in the supply chain can impact organisations by damaging their ability to operate, remain compliant and permanently damage their reputation. Not forgetting the wider implications as ripples of disruption impact stability through the supply chain, affecting your company, your customers and potentially your market too.

The regulations: 3 core supply chain risks

Across every regulated industry —from finance to healthcare to critical infrastructure—there are three core categories of third-party risk that are named in regulations but are often missed:

These are non-cybersecurity risks associated with the use of technology. Things that can happen at any time, that many will experience in their career, but few prepare for. Looking at frameworks like DORA (Digital Operational Resilience Act) that came into force earlier this year, the US Interagency Guidance on Third-Party Relationships: Risk Management, and PRA SS2/21 and you’ll see they all demand robust third-party risk management.

Resilience by design

To manage supply chain risk will need to go back to basics: preventive, detective, and corrective controls. And this all should start at the beginning, during the procurement process; in other words, resilience that’s built in from the start. It means assuming failure by default. It means planning for the worst-case scenario—not because you’re pessimistic, but because you’re prepared.

To that end many of the regulations include stressed exit plans, which refers to the termination of a contract due to service provider failure or insolvency, which is more unforeseen than a non-stressed exit motivated by commercial or strategic reasons. Stressed exit strategies are integral components of a comprehensive third party risk management strategy, ensuring the continuous provision of critical services and mitigating disruption impacts on the institution, its clients, and the broader financial market.

There are different approaches you can take here, but one that meets all requirements is software escrow and verification.

Software escrow services are more than a checkbox for compliance; they’re strategic assets for operational resilience and managing supply-chain risk – a layer of control, built-in. Giving you the confidence that should the worst happen, you’ve got what you need to recover.

techUK International Policy and Trade Programme activities

techUK supports members with their international trade plans and aspirations. We help members to understand market opportunities, tackle market access barriers, and build partnerships in their target market. Visit the programme page here.