Blog Marcel: The weakest link: supply chain risks deserve our full attention

Companies and other organizations never stand alone but are part of a chain. All too often, the cliché "the chain is only as strong as its weakest link" rings true. Yet many companies focus primarily on their own internal environment. This must be in perfect order: adequate processes and procedures, a state-of-the-art administrative organization system, maximum cyber security, an optimal and fraud-proof corporate culture, a robust fraud risk analysis, measures that significantly mitigate fraud risks, and all possible lines of defense that, if necessary, sound the alarm bells quickly and loudly.

Nevertheless, things still sometimes go wrong. Because of an internal focus, external risks remain underexposed even though they do occur, with all the consequences that entails, such as financial and reputational damage. That is why I advocate paying more attention to what can go wrong in the chain, focusing on the supply chain in which suppliers and external partners can expose your company – consciously or unconsciously – to fraud risks, cyber attacks, AI fakes, reputational risks, and damage.

It is a fact that companies – and the chains in which they operate – are becoming increasingly dependent on automated systems and information technology. In their production processes, inventory management, sales and booking processes, financial transactions, client and other administration, and many other areas. We no longer book airline tickets and hotel stays by visiting a travel agency, but via the internet. Many people bank with an internet bank. Repeat prescriptions for medicines are requested via websites and we no longer collect them from the counter at a pharmacy, but nowadays we get them from a machine that is accessible 24 hours a day. But what if the platforms and websites used by KLM, Booking.com, internet banks, and pharmacies are shut down? To what extent does this affect not only these companies, but also their chain partners? What preventive measures have your supply chain partners taken to mitigate the harmful effects of events elsewhere in the chain? Are they adequately insured, enabling them to limit the damage to themselves but perhaps also to you?

A targeted cyberattack on your company can also occur when cybercriminals infiltrate your business systems via a supply chain partner and shut them down, in what is known as a 'supply chain attack'. Attackers who want to attack your company—which you believe to be well secured—will seek out a weak link in the chain and attack via that partner. This is entirely possible if your systems are connected for efficiency reasons, information is exchanged, or you collaborate in other ways via ICT systems. Cyberattacks take place, for example, via Advanced Persistent Threat software, which detects weaknesses in systems, gains access to confidential information, and causes disruptions in production processes, for example.

Companies need to be alert not only to their own digital resilience, but also to that of their chain partners. Are there any weak links in the chain? What systems do chain partners use? How are they secured and tested? Is there a contingency plan with alternative scenarios in case systems are hacked or shut down? To what extent do such contingency plans take into account the effects on and interests of chain partners? Do they have fraud insurance and does it also apply to damage caused to third parties?