EP50: Supply Chain Risk Mitigation

Speaker A: Foreign. Hi, I'm here at ah, dpw. This is Amy Fong from Everest Group and I am here with Vince Grosso from craft and we're going to talk about supply chain risk. So Vince, tell me if it. Yeah, it's great to see you here today. Um, for listeners who don't know about CRAFT and don't know your background, why don't you give me a little bit of uh, how did you get here? Your first time at dpw?

Speaker B: First time at dpw. Um, I lead product marketing for Kraft. Kraft is a supplier intelligence platform. Um, so we work with um, companies that have what we like to say is mission critical supply chains or supply chains of high consequence. Um, we do a lot of business with the federal government as well as government adjacent, um, segments and industries. Think, um, aerospace and defense, uh, supply chain logistics, um, higher education even, um, some of those areas. Um, really what we do is solve the problem of data fragmentation and um, risk signal sort of across the broad risk categories and really closing the gap between data intelligence and decision making in that risk category.

Speaker A: Okay. And um, who typically is using the CRAFT platform?

Speaker B: Yeah, so you know, the three kind of key groups we've been hearing about all day here at dpw, um, obviously procurement teams, uh, you know, going through those sourcing, qualification, due diligence exercises. Risk teams as they are heavily involved, involved in that exercise as well, really managing, mitigating, um, and uh, really thinking about risk as part of that procurement cycle, um, and supply chain folks as well, um, as they're concerned with deliverability and products getting off the line, um, really starting to think about how is risk going to impact, uh, whatever product they are getting off the line, uh, being able to be delivered.

Speaker A: Yeah, that really is the intersection between those three groups right now. That's where all the action is happening. And there's talk all over about risk, right?

Speaker B: Absolutely. You know, I was just sitting in a session that was really the topic of um, how do we start doing those things in a way where we're using the same underlying data in a way that I like to talk about it as high utility or high fidelity, in a way where all teams can use that same data set and have the same point of view on risks that um, maybe need to be mitigated now or even in an ongoing manner, what we need to monitor for and react to early, um, you know, kind of throughout that vendor life cycle. And we're seeing all three of those groups start to work together in really exciting and interesting ways in this problem area.

Speaker A: Yeah, I Love that term high fidelity. Um, tell me a little bit more about what that means and supply chain visibility and yeah, you know, I, I

Speaker B: like the term high fidelity a lot as well because it, it sort of points to this problem of noise that we end up talking a lot about when we're, when we're thinking and talking about risk signal. Right. So you can have listeners listening for anything about a particular supplier or even a geolocation, um, or in a particular risk category. But you know, as practitioner or what do you do with all of that information? How do you cut through the noise and pay attention to what's actually actionable? Um, and again get you close to that decision point without having to fight through all of the data and all of the noise that comes through. So when we say high fidelity, it's surfacing the higher utility, the actionable intelligence out of all of that data noise to really help you do your job in a more efficient way and to help mitigate risk better. Um, and to help kind of keep uh, the drumbeat of your supply chain.

Speaker A: Hummingbirds and sounds easy, right? Easier said than done. Um, where do you see people still catching up on that?

Speaker B: Yeah, I think there's a couple different areas. Um, you know, starting at the foundation, the sort of data layer foundation to it. Right. So, um, you can get risk data on different risk categories from many, many different sources. You can build your own listeners, you can, you know, subscribe to different types of databases, have domain knowledge. But how do you bring that all together to then extract the intelligence from it? So we've seen, we talk to a lot of customers and prospects about um, they've tried to build these data foundations and really they're not able to close the gap between the data and the intelligence. Um, and a lot of that comes down to um, how do you make sure you're um, doing entity resolution correctly? Right. So how are you making sure you match um, a company name to that actual company entity or that person name to the company entities they have a relationship with? And so that's where I think we see a lot of companies stumble. Um, and where platforms like CRAFT do a great job as part of our underlying data foundation to make those connections in a way that's highly validated and the output is traceable and auditable.

Speaker A: So highly validated, Traceable and ah, auditable. Tell me more about that.

Speaker B: Yeah, um, and again this is deep into the, what we call data fabric or data foundation to all of this. Right. So it's um, know if you're looking at a Particular supplier, validating that you're not looking at a record for geopolitical risk for one company that's named the same thing as another. And you're looking at a signal for something, um, like foreign. Foreign, uh, influence on that, on a different company. Right. It could be Acme Inc vs Acme LLC vs Acme CO.

Speaker A: Right.

Speaker B: Happens all the time. And so, um, data tools, um, like craft are built to do that really, really well. Um, and that's leveraging technology, it's leveraging AI tools and also leveraging people in the loop validation when necessary to do some heavy lifting if sometimes the technology can't handle that sort of parsing. So there is a little bit of, um, uh, not a little bit. I'd say a lot of the legwork resides in that data foundation, that data fabric to m. Make sure you can get the intelligence output that's validated.

Speaker A: Yeah, that's so important.

Speaker B: I think the one other piece there too, I think you asked about is traceability. Right. Um, so I think it's important that platforms like this are able to show where that data comes from and how that data was actually brought to the point of intelligence. So being able to, you know, produce a supplier profile with a great level of signal and intelligence, but be able to see where that came from and how the dots were connected, um, is a really important part of ecosystems like this.

Speaker A: Yeah, definitely. You need to go back and if you're testing technology at all, you got to be able to back up, you know, and an audit and to your CEO, whoever, when you take action. So let's talk a little bit more about risk. I think when most people think about risk, uh, supplier risk, specifically procurement tends to think about things like costs and price risk and delivery risk and quality, um, or even, you know, financial health. And I know that varies a bit by category, but those are kind of the, the areas I see people really deep diving. How have you seen that changing?

Speaker B: Yeah, I think, you know, those core four, um, while very important, are starting to uh, become a little bit insufficient in the full kind of um, 360 degree view of risk. I think. I think you would say so. I think regulation is driving a lot of the change there where now companies are starting to be required to think about things like foci risk, um, cybersecurity, M. Um, um, things like geopolitical risk. And I think those are starting to be added to that list of real core areas of concern. Um, and again, regulation is starting to drive a lot of that. You know, we see a lot of it because our relationship with, um, the federal government in the U.S. but we're seeing a lot of that bleeding into the commercial space as well and sort of using that as a model to start assessing and mitigating risk in a responsible way at sort of this defense level. Um, with this sort of defense level rigor, I guess you would say.

Speaker A: Yeah, it's really interesting, um, something that, you know, I think we all think of as government related that's really impacting enterprises. Um, so, uh, how should, as a procurement government leader, you know, where do you start to see that show up? How should you be thinking about that?

Speaker B: Um, yeah, I think where you see it show up, um, you know, a lot of times, I mean, for example, things like mergers and acquisitions things, um, where you can kind of see ownership become obfuscated a little bit. Um, you know, we're starting to see, um, companies that look like they may be a domestic supplier and look like there's a very low risk profile. But when you start combining signals across some of these other categories, you peel back the onion and start to see, hang on a second, there's some connection via, uh, patents or certain people level entities back to foreign areas of concern in other countries and suddenly there is some type of risk there that you need to be really concerned about or at least mitigate in some way and vet some way and make the decision, um, in an educated manner on whether you should do, do business or more business even with a supplier on that front.

Speaker A: Yeah, that's really interesting. So at the surface, the first cut of the data might look just fine, but you've got to dig a lot deeper.

Speaker B: Yep, absolutely.

Speaker A: Are there any categories where that appears more across the board or, um, services, product,

Speaker B: you know, categories? Not off the top of my head as sort of, as sort of hotbeds. I think, um, I think a lot of what we see, given the space we operate in, is really around geopolitical risk and again, foci for an influence. And that's really what we specialize in. So a lot of times that's what we're seeing as risk areas that are that level two and level three deeper. Um, but it really is making the connections between those things, um, and thinking of, um, not only assessing a supplier, a single entity company supplier, but a supplier network. Right. So it's not only who you do business with, but who they do business with as well and where there might be, uh, connections from those sub suppliers into places that could pose risk geopolitically or foreign influence wise.

Speaker A: So definitely a Geopolitical or a location based driver there.

Speaker B: Yeah, big location based driver. Um, um, yeah.

Speaker A: So what kind of signals should people be looking at and you know, to know that a supplier deserves a closer look. And how do you really separate those signals from all the noise in so much data? Probably some bad data. How does CRAFT help with that?

Speaker B: Yeah, absolutely. Um, you know, I think a lot of it is pattern recognition. Um, and so looking for places where you're seeing connections that might not be obvious in sort of first pass, um, risk analysis. Right. So seeing where some, a person of interest has some connection to a foreign entity and then is connected to multiple suppliers. Right. Um, that could be a flag to say, hey, hang on a second, we need to be concerned about this person, um, and this group of supplier network around that initial entity, um, that may cause some type of concern or some type of risk to your supply chain. Um, to answer your question about signal to noise, you know, I think the technology has come a long way in being able to cut through the noise and, and help you, um, help surface what again is that high utility signal to pay attention to. So tools like CRAFT that have the technology built to do that sort of work for you, um, are able to cut the noise in a, in a really significant way and AI is just accelerating that. Um, I think, you know, um, in the more of a tactical sense, a lot of it comes back to how you as a company and you as a practitioner think about risk. So do you have a risk framework that really describes your risk appetite as an organization, um, to then sort of tune tools to that sort of risk matrix or scoring or however you organize those things. And um, so tools like craft being able to reflect a, ah, risk framework that you have built out for your company that describes that risk appetite or risk threshold goes a long way in cutting the noise as well.

Speaker A: Yeah, yeah, that makes sense. Um, what about when you go, you, you mentioned kind of sometimes it's the supplier, supplier, supplier. Right. You go N levels deep. Um, where. How does CRAFT handle that? That, that I've found has always been like the hardest piece.

Speaker B: Right. Yeah. The entire analysis is, is a very challenging one. Um, you know, I, I think in our experience with enterprise, you know, the Fortune 500 customers and customers in the defense industrial base, after that second tier, things become pretty murky and foggy.

Speaker A: Yeah.

Speaker B: So a lot of times when we have end tier conversations like you should be concerned through, um, you know, whatever tier you can really get the data on. Right. But really where the risk typically resides is the top end. Of that and that first, second, maybe third tier. Um, and so with a tool like craft, you can take those suppliers, which you probably know those first couple tiers really, really well before you get into the fog, um, and really analyze them, um, you know, kind of across the board and across those risk vectors, um, in places, you know, might affect your supply chain.

Speaker A: Interesting. Um, okay, so tell me more about, you know, the technology here. Uh, everybody wants to talk about AI, Right. Uh, and I think AI and risk management, you know, there's a lot of places you do want to use it. There's a lot of places you don't want to use it. Let's talk about AI Now. We can't, we can't do this without talking about AI. Right. Uh, but, but, you know, where does, where does AI really help in this? In risk?

Speaker B: Yeah, there's places where AI is very, very good. Um, and I think, let me start with, with, uh, um, a place where we think at least current state of things. Um, the practitioner, the person, still needs to be in the driver's seat. And that, I think, is the decision point. I think you and I have talked

Speaker A: about this before too, and this is what gets missed.

Speaker B: Right? Right. So, you know, these very, very powerful tools are just getting better and better, but the decision still needs to reside in the hands of the practitioner who knows their business, who knows their supply chain, and again, knows those risk thresholds and what's, um, what the risk appetite is to make that core decision. What AI tools are, are doing is closing the gap between the legwork that has to happen to get there and point, um, and helping a lot with sort of the validation, traceability behind that as well. Um, so, for example, with craft, the AI is really helping in a couple really key, impactful ways. One, in that data foundation. Back to the conversation we started with being able to source and validate data. Um, AI does a great job of taking really broad and deep data sets and helping with that parsing and helping with the intelligence extraction from that broad and deep data set.

Speaker A: Yeah.

Speaker B: Um, and then it's also helping in a big way produce deep analysis from that. So a lot of, you know, before these tools, you'd have an analyst that would have to sit there and do a month of work. I think somebody in a presentation just said it was 45 days of work to produce that, that type of diligence or qualification analysis to make a decision. You know, that's something that can be done now in days, if not hours with an AI tool because they do, uh, such A great job of sort of parsing and producing intelligence from that broad and deep data set. Um, and I think that's probably the most powerful sort of um, implementation of AI in this risk space that we're seeing today. Um, and you're really able to, you know, um, you know, at, at your fingertips be able to produce a risk analysis on a company and then continue monitoring that risk over time. Because AI is able to do it in such an efficient and um, an accurate way.

Speaker A: Yeah, I think that's uh, that pattern recognition and the ability to just do more with the resources you have is so important there.

Speaker B: Yeah, you know, we've seen companies uh, also starting to use AI to do cross category analysis as well. So again, zooming out from just that supplier company level entity, um, being able to say, you know, across categories, where are we seeing risk pop up and where can we again recognize those patterns or those dotted lines between things that you might not see in an initial pass or monitoring of one specific entity? Now you can see it across categories or, or even um, like I said, the person level entity where they may reside in between things.

Speaker A: Right. And what are the odds that a human is going to recognize that in a mass of data.

Speaker B: Right.

Speaker A: You know, much and tears too, too deep. You know, it's, it's, you wouldn't have even found that even if you had, you know, 40 people for 45 days to dig through it. They're not likely to, to turn that up. So that's really interesting.

Speaker B: Let me, let me ask that question back to you too. You know, in your practice, where are you seeing sort of the most impact full implementations of AI? Uh, where are you seeing it make it the big splash? The big.

Speaker A: I mean I do think that, I think AI can be used in, you know, it's a broad group. I think a lot of it right now is that scale. When I think about risk specifically because there's, there's many applications, but I do think it's the ability to scale and cover more. And you know this, we always wanted to cover all of our suppliers and go N tier deep into the supply chain. Right. But it's just so much information and so manual. So I do think that it's a huge accelerator for that. Um, I think often when people are looking at risk in the supply chain or risk management in general, they're thinking of just a few subsets of risk. They're not thinking of all of these. Personally, we work a lot with global locations and locations and geopolitical risk is huge and people uh, don't think about that. There's reasons to be single sourced with big service providers in one country. Um, but what are the risks involved in that? What do you need to be watching out for? So I think AI helps with that. But I agree with you. Some of those biggest decisions, decisions of what do we do about that? Do we add a supplier? Is there something that's, you know, a legal or regulatory risk? Is there some shenanigans happening with this, this person with, you know, involved in multiple suppliers, a conflict of interest or something? You know, those are leadership decisions. Um, they're probably not even the analyst's role to make, but to surface those and to find mitigation plans. So, um, I think that's where some people miss, you know, misunderstand what AI is really going to do in this space. Uh, we can't, we can't automate the decisions.

Speaker B: Yep, absolutely. I've also heard a few times over the course of sessions today too, where it's, and we firmly agree, right, it's the output of AI really hinges on the quality of data that it's able to reference.

Speaker A: Right.

Speaker B: So that again, going back to this data foundation, right. It's so important for these ecosystems that, and for the, for the AI tools to have that data foundation to give them the right things to look at and the right context within in which to look at them. Right. Um, so that's why we, you know, we talk a lot about this, the craft data fabric and the data foundation in general, because it's kind of a crap in, crap out if you don't really nail it.

Speaker A: And that's the challenge so many people have right now. So, you know, I want to get to kind of the practical steps that people should take. But what are, you know, what are some of the first practical steps? Cause I assume it starts with that data, um, and then there's a lot more to it, right?

Speaker B: Yep. Yeah, I think, um, you know, first identifying what are the key, um, risk areas that are important to you and your company. So again, going back to, you know, what does that risk framework look like? What's important to you? What risk vectors are important to you? Um, often it's a little bit more than you think. Right. So hey, maybe we're concerned with geopolitical risk and locations. Well, peel that back one layer too. You also are probably concerned with the person level entity risks, maybe things like patents and connections geopolitically, um, maybe foreign influence starts to creep into that and a broader view of risk may fit your, um, sort of risk framework a little bit better. Um, I think kind of tactically from there, start with criticality. Right. Start with the suppliers that are the most critical to your supply chain and make sure out of the gate, those are the ones you're doing the deep analyses and spending the time on and using the most powerful tools to really do good analysis on and make the most educated decisions as possible. Because those are the ones that are going to bring you to a halt. Um, and then from there you can expand the program. Right. Um, to those second tier, third tier. From there, um, I think wrapped in, in all that is monitoring. You know, we talk to a lot of companies who, maybe due to capacity or just their risk practice, haven't got to the point where they're monitoring suppliers for risk outside of that point in time. Analyses at point of contract or onboarding qualification, or maybe once a year when they go back through a contract cycle. Um, so starting to monitor kind of out of the gate, uh, with your supplier base is a big, big one you could take action on right away. And tools like craft and other plat are able to do that right out of the gate. Um, now where we may not have been able to do that before.

Speaker A: Yeah, yeah. Ah, um, who, who does procurement work with typically? Who are you working with in the organization and who are they working with internally?

Speaker B: Yeah, so the, the, the key three, uh, procurement teams, risk teams, and supply chain teams. Um, we're also starting to see legal become involved pretty heavily.

Speaker A: That doesn't surprise me.

Speaker B: Right. It makes a lot of sense. Um, and you know, they all have similar interests in a little bit of a different scope. But now we're starting to see those teams work together in a pretty exciting and powerful way. I'm, um, even seeing a lot of conversation today at DPW talking about how those teams are converging and thinking about risk and talking about risk in a unified fashion. Um, but there's still a lot of companies where they're very fractured and they're not necessarily talking to each other. Well, and risk teams are looking at one thing via, uh, very particular lens, and supply chain folks are looking at it, of course, in a different one. Um, let's get them to the same table with the same, um, data set and intelligence set. That's, that's ultimately getting to the same goal of managing and mitigating risk throughout the supply chain. So we're seeing all those teams converge.

Speaker A: Yeah. Um, so, so let's talk future. Um, where do you think supply risk is going to evolve and the tech.

Speaker B: I Mean those are, I think there's, there's two things. Um, the first is monitoring. Continuous um, monitoring is becoming the baseline. Um, we touched on this a second ago too. I think um, a lot of companies in the past haven't been able to get to the point where they're doing monitoring in a meaningful way outside of scraping news and public record. Um, now you can monitor across the same um, data set that you did the initial analysis on. So I think that is going to become the standard for procurement supply chain teams and risk teams across the board. Um, the other is um, defense level diligence is going to be another standard and we're already seeing that creep into the commercial space. But that level of diligence and um, ongoing monitoring for that fact too, um, is going to be another kind of um, line in the sand and a bar that companies are going to start to be held to.

Speaker A: That's interesting. Um, and when you think about ah, if I'm a procurement leader, say I'm a risk leader running a CoE in a procurement organization, ah, where should I be starting now? What should I be thinking about to get ready, future ready for what you just described?

Speaker B: Yeah, absolutely. Um, again going back to the data piece and the risk data piece, think about um, how do we tie these desperate data sources and desperate teams data together? How do we make sure that the point of view on a supplier, on a personal entity or on risk in general is we're looking through the same lens and using that same data foundation to make our decisions across the board. I think that's the most important place to start and everything is a jumping off point from there, um, and enabling across your organization with that data set. Um, and then like I mentioned before, focus on criticality, focus on high utility intelligence, um, and focus on places where you can accelerate time to decision, um, but also make um, better decisions based

Speaker A: on better data and then better decisions. How would you differentiate, you know, really mature teams? Like if I'm looking at an organization, what makes the most mature the leaders stand out? Saria?

Speaker B: Yeah, um, that's a good question. I think the best organizations are truly looking at the full 360 degree view of risk on their suppliers. So they're not kind of cornering themselves with only certain risk vectors or only certain data sets. They really are looking across all of those data vectors, um, and combining all of those data sets to make those decisions. A lot of companies really aren't there yet. Um, and um, they're only looking at one or two. They only have the capacity to do so. Or they're doing things like surveys and not kind of taking the trust, but validate mindset to those things.

Speaker A: Ah. Um.

Speaker B: Because they need to keep those. Those production lines moving and product out the door. Right. Um, and we're not saying slow down. We're saying use better tools to do those things in a better way to be more confident in the decisions you're making.

Speaker A: Yeah, yeah. Um, so much potential here. I mean, I think that this is an area that I've always seen companies struggle with. The tech has always been, you know, not 100% what they need, not comprehensive. And you've brought up a bunch of ways that, you know, risk has been introduced into. Into the commercial space where it may have not been in the past. Um, I think that's. There's. There's a lot of opportunity here for. For organizations and procurement leaders to think about how they address that. So absol.

Speaker B: Excited about it. Our customers are excited about it, and, uh, you know, we're happy to tell you more.

Speaker A: All right, well, this has been really educational, and, uh, thank you for being here. Thanks for telling us more about craft. Um, thank you to the viewers who are catching up on this. Uh, I hope everybody's having a great time at DPW New York, and thank, uh, you for tuning in.