[00:00:00] Speaker A: Hi everyone and welcome to a special year end episode. I'm your host Bill Coffin and this is the best of the Ethicast.
2024 has been a terrific year for this program. We have produced more than 100 episodes speaking with thought leaders from across the ethics and compliance space, covering a great breadth and depth of topics including Speak up culture, anti bribery, anti corruption, cultures of integrity, data analytics and much, much more. As we bring 2024 to a close, we looked at some of our most impactful episodes of the year and wanted to present to you once more our series on supply chain due diligence featuring Patrick Nates, CEO of Vector International, Rob Bales, Director of Sustainable Supply chains at Control Risks and Ethisphere Executive Vice President and supply chain expert Craig Moss. Together, Craig, Patrick and Rob lead an amazing discussion on the implications of the EU's supply chain due diligence directive and what it means for ethics and compliance programs. We'll share some of the highlights from that discussion as well as links to their full episodes. Enjoy.
[00:01:18] Speaker B: Rob, at Control Risk you're dealing with a lot of large multinational companies that have very complex supply chains. What are you seeing as an impact that these new laws and maybe in particular CSDD are having on, on the companies you deal with?
[00:01:35] Speaker C: Yeah, thanks Craig.
Well, I think the first thing to say and probably just for the benefit of of listeners is that just to describe the types of clients that we that we work with and the business functions, Control Advantage is a, is a third party risk management solutions provider. So we work with many different types of businesses to provide screening solutions and due diligence solutions and typically looking at risks such as sanctions and business integrity and our function of the business or the buyers that we typically work within those businesses is the compliance team or the compliance function. Now what's happened with the emergence of supply chain due diligence regulation over the last 10 years, but particularly, you know, accelerated in the last two to three is that's really pushed a lot of what was typically a sort of niche domain for the sustainability or ESG function of the business much more on into the lap of the compliance function.
And of course you know, there's a little bit of nuance to that depends on whether the businesses have an ESG and sustainability team in place. Quite often the mid size or smaller companies don't often have that, but that's one of the trends we're seeing. So what we're seeing is increasing number of questions now coming from our compliance buyers and those functions about what do we now do and of course, that presents challenges and problems because the subject matter around sustainability, esg, is quite complex. There is a wide variety of impacts across the social and the environmental. Everything from carbon to biodiversity to human rights, which itself is a huge agenda and covers everything from child labor to forced labor to health and safety. And you're asking the compliance function of the business to have to now understand all of that and manage that risk. And that's, that's not easy. So, I mean, from a, from kind of high level perspective, that's, that's what we're seeing. And the CSTDD regulation in Europe is only going to amplify that in the next two years.
[00:03:54] Speaker B: So, Patrick, over to you. What are you seeing in your client base? And in particular, I know that you're really active in Asia is one area. And then how do you think companies are reacting both to the regulation and then possible enforcement that may happen in the future?
[00:04:12] Speaker D: Well, thanks very much, Craig.
What happens in Asia, I think it is very much a mixed bag.
If you think about Asia. We have large customers that are, you know, exposed to European companies and therefore they kind of, you know, have to comply somewhat with the laws in the countries that you've mentioned because of their customers. But you also have a lot of large companies that actually supply for local markets. And here I think we're getting a very mixed bag of, okay, what's going on. They, these, these companies have to do that. We don't. But suddenly, you know, we get an inquiry and then we're not ready. So when I think about Asia, just in general, what we see is very different responses. A lot of confusion, a lot of misunderstanding and a lot of miscommunication. Actually, there's still a lot of confusion between the whole auditing and social compliance of a factory versus real due diligence of a supply chain. Looking at knowing what your supply chain looks like, knowing what they do, knowing what they are, knowing what the risk is upfront, and then kind of managing that risk.
So I think generally, and not only in Asia, I think there's quite, you know, a lack of understanding of what it really all is.
I think with that, I think there's a lot of, you know, advice being given, especially by external advisors that focuses then on the detailed differences between the different lies. And that frankly, just makes the confusion even bigger because, you know, as Rob said, you know, ESG is vast, it's expanding, it's everywhere. There's a huge challenge of knowledge.
And then we should not make it more complex. I think we need to make it simpler. And I think you know, we need to kind of step back in, you know, kind of what are the principles that really kind of underlie all of these laws? And you said it Craig, you know, it, it largely is based on the OECD guidance which of course you know is also based on the Ruggie principles. Right. I mean when you know, John Ruggie went around the world and talked to many people, he kind of created this initial precedent of a legal framework for due diligence and risk management on human rights which is reflected. And I think we need to go back to principles and systemic approaches for companies rather than very specific. This is how you comply with one law because again suppliers supply multiple customers in different countries. But it's not only where your customer is based, it's also where the customer where your product is eventually going to end up. Right. So you have to think of supply chains as in the country of manufacture, the country of transition and then the country of use and all of these laws on ESG there. And so what is the best systemic way that an organization can take? And I think there's a lot more clarity needed not only in Asia but in also other parts of the world.
[00:07:53] Speaker C: If you don't have visibility in the upstream supply chain, how do you expect to understand or identify and measure and quantify the risks? Right. So what's not measured doesn't get managed. What's not visible doesn't get managed. So that's really the reason for traceability. Traceability data is not an end. Collecting that data is not an end in itself. It's you collect that data to serve of a purpose. And you know, and in this case what, you know, what the regulations are driving at really is that that purpose is to reduce, manage and mitigate the negative upstream impact, both social and environmentally.
There are of course across, you know, many of these different regulations, quite a lot of, there is quite a lot of difference nuance in terms of what they are asking for around supply chain mapping and traceability. So there's no one specific requirement that is telling you across all legislations how far back in the supply chain you need to go, where you need to go. Right. That, that really is for companies to interpret, you know, so thinking about the German supply chain app for example, just to throw kind of sprinkle a few examples in here, the majority of the focus of that regulation is, is tier one suppliers. But it does clearly state that if there is allegation or evidence of a non compliance or a violation, social and environmental, then the Company the the should be required to then trace and look upstream. That's a different, you know, prescription to what the EU deforestation due diligence is, is asking. That is very specifically asking companies to trace commodity flows back to the production unit and, or the plot of land. So it's a very specific requirement around geolocation which is again is different from what you see, let's say from the EU Sustainable Batteries Directive.
And the Sustainable Batteries Director talks about the need for controls and transparency and a chain of custody system to identify upstream actors. So you can see there's all these sort of variations that are being asked. But I think undoubtedly the direction of travel is towards traceability and transparency. But the key point is, and I think if any company was asking for our advice and counsel on this, it would be the risk based approach, right? So it would say regardless of, you know, obviously you need to look at each regulatory set of requirements, but what you need to do is understand where your biggest risks are in the, in the supply chain and that's where you put your traceability effort. So you don't need to trace every single link in the supply chain back to origin for 30,000 tier one suppliers, which we know, you know, some companies can have that volume of supply. You don't need to do that. What you do need to do is focus on your highest risk categories and raw materials and that's where you need to trace back upstream.
Just making sure then, you know, speaking to that point around prioritisation that you need to then look at that next step which is well, where is my biggest risk and what is it that I need to do to do that risk prioritization exercise? And, and you know, we can talk about more on that, I'm sure we will in subsequent sessions. But that, that you know, that's really a case of, of you know, it could, and it can be done in multiple ways drawing upon different data sets that sit in the public domain which can provide the necessary data to speak around inherent risk or potential risk in certain geographies. We know that jurisdictional or national level country ratings are available on different categories of risk.
And what we see a lot of companies doing is combining those with materiality assessment information, stakeholder engagement data and or combining that with things like criticality and sort of running that through a weighted model to say well look, these are all of the impacts and issues that we potentially have. But based on the data and our models we can say that our high risk is 10% of that and that's very achievable.
[00:12:18] Speaker B: No longer is it going to be that you have a sustainability person and even that you might have an environmental person separate from a social person. But you're also now going to get need to get more involved with your compliance team, with your legal team. And of course it's the supply chain people that own the relationships with the third parties. So you're going to have to be able to form this kind of internal cross functional team to be able to take the right steps, to be able to put the right programs in place, the policies, the procedures, do the risk assessment. You're going to have to broaden your lens, so to speak, and form this kind of cross functional team internally. I'm going to go to Patrick first. Patrick, you've been at this for a long time and you've really worked with a lot of multinational companies helping them build their programs. What's going to happen now with these new types of requirements and how are companies going to deal with the difference between environmental requirements and social and human rights requirements?
[00:13:24] Speaker D: There's been an interesting shift over the last couple of years. I mean, if we think back, we had environmental teams that were looking at environmental management as such, probably more of their own operations than of the supply chain. And we had social compliance people that would reside in ESG or sustainability teams that were kind of the compliance function. They were not really compliant, but they looked at does the supplier meet certain criteria. And as these laws and as the OECD guidance is becoming more familiar to a lot of organizations, we begin to see the shift and we begin to see that multiple stakeholders are talking to each other within an organization. We've got procurement, which is a central function to manage the suppliers. We've got legal that is now involved because clearly there is regulatory compliance requirements. And we still have the ESG environment, social, sustainability people, you know, there as well. But the shift is quite dramatic. Where it is now you have to comply and you have to do it in a systemic way. But the question is comply with what?
And how do you comply systemically? And a lot of organizations are now beginning to figure out, okay, well, here's really kind of where procurement takes the lead. Here's really kind of where we have the social or the environmental people that take the lead and provide support. And this is really what we need from the legal teams. The challenge that we are seeing with a lot of organizations is that these three different internal stakeholders are looking at the regulations in very different ways and somehow they speak quite a different language. It's almost like they talk about the same thing, but they don't really understand each other. And I think the OECD guidance and you know, the more the question for a more holistic, systemic approach is forcing that dialogue, looking at, you know, different aspects of the system, talking the same language, looking at data in the same way. And I think that's really healthy still with a lot of organizations, social and environment is not combined very often. They're still very different focus areas. And you know, again, some of them are looking at, you know, climate change and water usage and scarcity reduction, you know, others are looking at hazardous material, you know, social compliance, you know, the traditional topics, child labor, working hours, etc. So in a lot of organizations, these systems are still quite separate. They do have systemic approaches, but not the same system.
[00:16:19] Speaker C: You know, we've seen over the last 10 years an increase in, you know, multi stakeholder, well, longer than that, 20 years, multi stakeholder initiatives and platforms which are really designed to bring companies together to help drive sectoral change.
Because of course we recognize that, you know, one company acting on its own is never going to deliver the change in the supply chain. So we have to bring all of the companies around the table. And I think, you know, to your point, the kind of the ethos that sits behind all of those is really mission driven. It's a, it's a vision of change in a sector that recognizes that all companies have to play an equal part.
And that if you look at it as a hierarchical approach, we mandate that you do this. You're never going to, you're never going to achieve very much. And so I think we need to see more of those collaborative platforms. We need to encourage companies, once they've identified their risks in the supply chain, to engage with those different sectoral platforms or commodity platforms. They can come in many different forms and structures.
But just to your point, I think I remember a conversation just three weeks ago, an initial conversation with an interested client. And the first question that they ask is, well, what happens if we have no leverage or we have very little leverage over many of our suppliers? You know, what do we do? And I mean there are, you know, there was an answer given to that, but I think it's almost the wrong question to be asking at that stage anyway. Because I think the question you need to be asking is, well, do I have visibility of risks to start with?
Do I even understand what the risks are? Because I don't even need to think about applying any leverage at this point point because I don't have the visibility. So build your baseline first, get the data that you need and then worry about the leverage later. But even then, you're never going to drive that change just through policing alone. You're going to drive it through getting suppliers to buy in, to collaborate, and to share in a vision of change.
[00:18:26] Speaker A: To learn more about how Ethisphere Control risks and Vector International can help you manage your supply chain risk, please Visit@the sphere.com supply chain. That's supply chain and for a host of helpful reports, on demand presentations and more on supply chain due diligence, please visit the Ethisphere Resource center at ethisphere.com resources I'm Bill Coffin and this has been the Ethicast. For more episodes, please visit the Ethisphere YouTube
[email protected] ethisphere and if this is your first time enjoying the show, please make sure to like and subscribe on YouTube, Apple Podcasts and Spotify. And if you'd like to appear in the show as a guest yourself, please drop us a
[email protected] ethast thanks so much for joining us. And until next time, remember, strong ethics is good business.
