From shipping delays to terrorism attacks and cyber hacks – managing the growing risks to the retail supply chain
In an age of growing consumer expectations, unprecedented technological change, geopolitical uncertainty and the shifting nature of terrorism, the retail supply chain has become fraught with potential risk. “There are three key elements affecting the retail supply chain,” says Aon’s Dan Fox – Retail Practice Leader. “Meeting the demands and expectations of the consumer; ensuring the business’s supply model is as efficient as possible; and respecting corporate social responsibilities in an age when brand reputation can be easily damaged or even lost. Within these three elements, there are a wide range of different risks that can damage each of these components and cause a hit on profits, revenue and reputation.” Whether it’s a collapsed shipping company stranding cargo in a far off port, a cyber attack knocking out a data centre, or a terrorist attack preventing deliveries, keeping stores & fulfilment centres well stocked in a timely and efficient way is becoming a challenge of growing complexity and uncertainty.
Shipping delays
Given many retailers source the majority of their goods from overseas on a ‘just in time’ basis, the recent collapse of the Hanjin Shipping company was a stark reminder as to what can happen when supply is interrupted through financial failure. “One of the biggest issues of such a collapse is that ports very quickly realised they were dealing with vessel owners who could no longer pay their bills and so they prevented ships from coming into port to unload their cargo, tranship or even take on bunkers” says Michael Rimmer – Marine Client Director, Aon Risk Solutions. “Having ships at anchor for several days outside port starts to hit the commercial interests of any retail business with cargo on board. Often of course the goods might be perishable goods so any delay is critical and unfortunately delay in itself is not an insurable risk.”
While marine insurance policies cover physical loss or damage of cargo, in many cases the goods were not affected but the delay was still financially damaging. “For retailers it could mean that – through no fault of their own – they run out of stock or miss critical seasonal demand, but have no way of recouping their costs,” adds Gill Bewes – Marine Client Director, Aon Risk Solutions. It’s not just shipping company failures either. There are a myriad of other potential risks associated with shipping such as port blockages, strikes, vessel engine breakdowns, collisions, stranding and on board fires that all illustrate the difficulties that commercial entities have with just in time delivery slots.
Contamination of cargo is also proving to be a growing problem. “We have seen some insurance claims related to people stowing away in curtainside trailers. Depending on how long they have been there, the damage caused means that most clients want the whole of the load destroyed,” says Bewes. “Often, it’s more a fear of loss. Hanging garments for example might not have been damaged, but the brand does not want them to go into the public domain.”
Changing terror threat
Another potential threat to a retailer’s ability to get their product to the customer comes from terrorism which, according to Scott Bolton – Director, Crisis Management for Aon Risk solutions, has undergone a fundamental shift over the last three years. “As an insured peril, terrorism tended to be focussed on “Cat-Loss” events; Large property damage from events such as the London or Manchester IRA bombs. Now, in the West at least, we’re seeing a lot more use of low tech weapons such as bladed weapons, firearms or cars where anyone can undertake an attack, with a focus on attempts to create mass casualties.”
Often there is no property damage at all adds Bolton which can create problems as insurers usually see it as the trigger for insurance to pay out. “The London Bridge attack in June 2017 was a challenge for insurers in that for many insured companies there was no discernible property damage from the attack, even though there was significant business interruption resulting from the area being cordoned and evacuated. Borough Market was shut down for a couple of weeks.”
For retailers, the challenge has been how to protect themselves from losses related to this changing threat, something that the insurance industry has responded to says Bolton. “A lot of work has been done to broaden insurance coverage into non-property damage business interruption; using bodily injury or physical harm as the trigger to access business interruption and then tying it to other areas such as loss of attraction – where turnover may be impacted.”
Broader peril of political violence
Further down the supply chain, terrorism attacks can also impact supply and some countries that are part of the global supply chain experience much higher frequencies of terrorist attacks. There is also the broader peril of political violence, says Bolton, which could be acts of insurrection, coups, mutinies, rebellions, or civil war. “Terrorism is often quite an isolated event while political violence events tend to be much broader in their impact such as the coup attempt in Turkey in 2017 or the red shirts uprising in Thailand. If sourcing products from Thailand for example, a retailer should consider political violence cover rather than just simply terrorism.”
It’s a challenge for every organisation says Bolton which can be managed by a proactive risk management approach. “Using the Aon Terrorism and Political Violence map for example allows businesses to take the data and apply it to their global footprint. Where are they exposed? And to what risks are they exposed? If a retailer and its supply chain are in 30 different countries it is important to see and understand the risk between each country so it can appropriately align its risk transfer (and risk mitigation) strategy.” It’s not just political violence either; political risk can be as problematic says Dan Fox: “The impact of Brexit on the supply chain is huge. Take the availability of delivery drivers which is already showing signs of reducing, while in the grocery sector, where the focus is on local sourcing, uncertainty over EU migrant workers could threaten local production.”
An insolvent supplier
Moving away from security and political risks as supply chain threats, what happens when a critical supplier fails? Kentucky Fried Chicken found itself the subject of high profile national media coverage earlier in 2018 when its logistics supplier – DHL – ran into problems delivering the fast food outlet’s chicken. “Often businesses look at their critical suppliers but overlook the logistics firm as a supplier,” says Grant Foster – Managing Director, Aon Global Risk Consulting. But whether it’s a logistics supplier or the actual product supplier, what can retailers do to protect themselves? “There is a basic insurance answer where businesses have a critical supplier extension in their property damage/business interruption insurance policy where, if something goes wrong and the supplier burns down or floods, it can protect your margin,” says Foster. “In practice, supplier insolvencies are more common and most businesses should have a process in places that looks for red flags such as a supplier missing shipping dates or where quality control issues arise.”
Where a supplier looks to be in trouble, the options then are varied adds Foster. “Businesses can do nothing and simply monitor the supplier. They could offer better payment terms, buy the business, invest in it, or simply dual source the product. Most retailers, depending on the level of partnership, do the latter although corporate social responsibility reasons might mean a business wants to buy a product from a certain place or supplier which can restrict options.”
Another option to help suppliers experiencing difficulties include developing a supply chain finance solution which allows suppliers to be paid earlier – alleviating any cashflow difficulties they might have – while the retailer can optimise its working capital without any negative impact on its suppliers. Given the recent collapse of groceries wholesaler Palmer & Harvey after it suffered working capital and liquidity problems, such a solution can have real benefits says Deborah Peters – Head of Business Development, Aon UK: “Supply chain finance can be brand enhancing because suppliers can be paid early which takes away the often damaging practice of late payment. The retailer also benefits from an unsecured line of credit without impacting its existing finance arrangements.”
The digital danger
Beyond the physical risks to the supply chain, what risks does the increasing reliance on technology hold to retailers? The importance of the data centre in the supply chain cannot be overestimated says Foster: “Recently we have been stress testing what would happen in the event of a retailer’s data centre going down. If they lose the data centre there is some immediate business interruption impact as a lot of the point of sale functionality and financial accounting will go through that system – so they have a big issue accepting things like credit card payments in stores as well as stock ordering.” And while the threat to a data centre could be physical – fire or flood – it could, of course, be the subject of a hacking attack.
It’s not just a retailer’s own systems that are vulnerable to hacking either. Suppliers are potential targets for hackers looking for a ‘way in’ to their clients says Christopher Scott, a Senior Consultant in Cyber Risk for Aon. “Some of the biggest data breaches to date have been a hacker infiltrating a third party supplier to get at their clients.” In December 2013 for example, tens of millions of credit and debit card details for customers of US retailer Target were compromised after a third party vendor’s credentials were used to access Target’s systems. “Increasingly retailers are asking, ‘what risk does that supply chain introduce into my own IT environment because I am constantly allowing third parties access to my network and ultimately it’s my reputation on the line’?” comments Scott.
Cyber business interruption
Retailers are also realising that beyond data breaches, the cyber risk can have a significant business interruption impact on their day-to-day operations adds Scott. Last year, shipping giant Maersk fell victim to the NotPetya ransomware attack which effectively shut down its systems and forced it to halt operations at port terminals around the world. “Where suppliers are geared for just in time delivery, incidents like this can significantly disrupt their operations which means they either need to re-evaluate that approach and store more inventory – which comes at a cost – or risk not having those goods and services and the impact that has on their customers,” says Scott.
In response there has been a significant shift in mindset from seeing cyber risks as purely an IT problem to understanding that this is a broader problem involving people, process and technology says Scott. “Businesses are focussing more on training staff who are in the front line against cyber attacks as well as looking at minimising access that third parties have to their systems. It is critical that retailers identify who their critical suppliers are and get some reassurance as to their resilience when it comes to a cyber event, whether that’s through certification or a deeper IT audit, as well as proof they have effective crisis management and business interruption plans in place.”
Protecting the brand
What all these supply chain risks have in common is the potential to cause retailers significant reputational damage – listed as the number one risk for businesses by Aon’s 2017 Global Risk Management Survey. Given the many variables a retailer has to deal with, effectively dealing with these supply chain risks so that the brand remains intact is a major challenge says Aon’s Dan Fox: “Not only have retailers got pressure on their supply chain to meet consumer expectations and experience they also have to be very mindful of their corporate social responsibilities. Retailers cannot allow anything to slip. Should they have a product coming out of a factory which is unethically sourced, used slave labour or anything that is deemed to be irresponsible, then that will have a big brand impact.”
For further information on how Aon can help you identify and manage risks within your supply chain contact Dan Fox at [email protected]