Building an Ethical Supply Chain
By Michael R. Levin
The supplier-generated ethics scandal is probably one of the biggest (and least foreseen)
business risks most leading companies face today.
B
eing an
ethical
company
isn’t enough
anymore. These
days, leading
brands are
judged by the
company they
Michael R. Levin keep. Consumers,
investors,
business partners, regulators, and media
organizations now expect a company
and its entire supply chain to be ethical.
Sooner or later, every company is bound
to find itself part of a supply chain
that experiences a significant ethics
or compliance violation. When this
happens, chances are great that the
biggest brand in the chain will get stuck
with most of the blame.
The supplier-generated ethics scandal
is probably one of the biggest (and least
foreseen) business risks most leading
companies face today. The damage can
be great, and protective measures can
and should be adopted immediately. The
good news is that feasible, affordable
solutions exist and can be implemented
relatively quickly and painlessly.
What is the ethics problem in the
supply chain?
Almost every company (in its role as
“purchaser”) buys unfinished inputs
provided by many other companies
(called “suppliers”), before refining
them and sending them downstream
toward their ultimate end-users (known
as “consumers”). Simply put, the ethics
problem in the supply chain is that
38 B o a r d r o o m B r ie f i n g : t h e C ON S U L T AN T S issue
consumers often blame purchasers
for ethical lapses that were actually
committed by suppliers upstream. Blame
attaches to the purchasing company
even though its suppliers are legally
(and factually) distinct and independent
corporate entities. And, in reality the
blame almost always befalls the biggest
brand that played any role in bringing the
offending product or service to market.
The scapegoat company could be a
designer, a manufacturer, a distributor,
or even a retailer. The scapegoat could
be closely associated with the unethical
supplier, or many steps removed.
But the scapegoat will always be the
player with the biggest reputation to
protect (i.e., the one most susceptible to
pressure from outsiders). This state of
affairs may not be fair, but it is how the
supplier ethics & compliance game now
works.
This type of risk is not hypothetical, and
no organization or industry is immune.
In 2007 alone, the drama has unfolded
in these eye-catching headlines:
• Mattel Does Damage Control After
New Recall (Wall Street Journal)
• Del Monte Pet Products Recalls Food
Items (Washington Post)
• Toshiba Laptop Batteries Pose Fire
Hazard (computerworld.com)
• Dole Pre-packaged Salads Recalled For
E. coli (AP Online)
•F  rench Retail Giant Carrefour Is Fined
(AP Online)
Each of these headlines is a real-world
example of a leading brand taking the
hit for ethics or compliance breaches
committed by suppliers. Mattel did not
paint its toys with lead paint. Del Monte
did not choose poisonous wheat gluten
for its pet food. Toshiba did not build
the flammable batteries in its laptops.
In these and many other instances,
suppliers were responsible for creating
the dangerous conditions that captured
the public’s attention—yet nowhere in
the headlines could the suppliers’ names
be found. The biggest brand paid the
price. When toy shopping, consumers
will not impose justice upon invisible-
supplier Yip Sing. Instead, consumers
will rightfully (and righteously) boycott
the Mattel brand.
Despite the pervasiveness and seriousness
of the problem, companies can take at
least one positive step toward inoculating
themselves against damaging headlines:
implementing a credible Supplier Ethics
Management (SEM) initiative. In fact,
boards of directors should make this a
priority for Q1 2008.
What is the current state of SEM?
Supplier Ethics Management is the
management of suppliers and supply
relationships with strategies, programs,
and metrics that better align supplier
business conduct with purchaser
standards, with the goal of reducing
the purchaser’s overall risk of corporate
integrity failure in the supply chain.
“Corporate integrity failure” embraces
any enterprise-level scandal involving
a violation of compliance, ethics, or
corporate responsibility standards.
Most companies manage fairly well
these three risk categories within
their own four walls. However, these
very same companies often fall far
short when it comes to managing and
mitigating corporate integrity risk in
their supply networks.
In multiple, recent surveys of over one
hundred companies in the Global 2000,
we uncovered the following facts:
• 88% of respondents do not maintain
a web-based portal that suppliers can
use to receive communications of
any kind from the purchaser. (Of the
12% of respondents that do maintain
such portals, none used them to
deliver any kind of compliance-
or ethics-related information to
suppliers).
• 86% of respondents concede that
their primary ethics code does not
address the conduct of suppliers.
• 78% of respondents do not include
suppliers in any other type of ethics
& compliance program or initiative.
• 64% of respondents have some
kind of code of conduct (primary
or secondary) that regulates
supplier conduct, but only 40% of
respondents require suppliers to
actually take any action with respect
to that code (e.g., disseminate it to
employees, train on it, acknowledge
receipt of it, certify compliance with
it, or simply read it).
• 59% of respondents do not include
suppliers in their analysis when
assessing their company’s own ethics
& compliance risks.
• 56% of respondents make no effort
to audit supplier business conduct on
a regular basis.
• Only 20% of companies believe
they are “already doing enough” to
manage ethics and compliance risks
in their supply chain.
B o a r d r o o m B r ie f i n g : t h e C ON S U L T AN T S issue 39
What is changing?
Historically, corporate leaders believed
that their duty to ensure ethical
business conduct ended at the four
corners of their own corporation,
and did not extend beyond their own
employee base. At most, companies
inserted clauses into their standard
procurement contracts, requiring
suppliers to represent and warrant that
they would “comply in all material
respects with all applicable laws,
statutes, and regulations.” In short,
the all-purpose corporate defense to
allegations of wrongdoing in the supply
chain has historically boiled down
to “It wasn’t one of our employees”
(occasionally buttressed with “But our
supplier promised us in writing that this
would never happen!”).
When a supplier-generated ethics
scandal occurs, this kind of defense is
no longer enough to mollify incensed
consumers, investors, business partners,
regulators, advocacy groups, or media
organizations. Nowadays, these and
other “stakeholders” count on leading
brands to do something more in order
to keep the marketplace’s trust. Not
everything they possibly can—just more.
Although most companies today do
very little to manage ethics risk in the
supply chain, tomorrow appears to be
a very different story. While 78% of all
companies surveyed by us currently fail
to include suppliers in their compliance
and ethics programs, 57% of them say
that suppliers will be included within
the next two years. This represents a
near-seismic shift in risk management
priorities, attention, and resources
within Global 2000 companies.
Until now, companies have typically
cited three reasons for their inaction in
the area of Supplier Ethics Management:
insufficient time; inadequate budget;
and insufficient administrative
resources. Recent headlines have
apparently galvanized corporate
leaders to develop creative approaches
to overcome at least two of these
deficiencies, and possibly the third one
as well.
To counter the “no time” problem, 86%
of respondents contend that someone
else (i.e., suppliers themselves or
an independent third-party) should
assume the responsibility to drive
supplier participation in the purchaser’s
ethics & compliance initiatives. And to
circumvent the “no money” problem,
75% of respondents agree that suppliers
should share or bear the cost of
participating in the purchaser’s ethics &
compliance initiatives.
The remaining piece of the puzzle is
administrative resources. The creative
solution emerging to address this final
obstacle has to do with collaboration
(internal and external).
Compliance-procurement
collaboration
The majority of corporate legal and
compliance officers have no regular
contact with their colleagues managing
procurement and supplier relations. Few
legal and compliance officers at Global
2000 companies possess (or even have
access to) a list of their company’s major
suppliers; fewer still have adequate
contact information for those suppliers.
Yet almost all big-company legal and
compliance officers want to forge
closer working relationships with their
colleagues in procurement and supplier
relations. Why is this?
In most large companies, procurement
executives “own” the company’s
supplier relationships. In order to have
any type of positive impact on these
supplier networks, legal and compliance
officers know they must cooperate and
collaborate with their procurement and
purchasing colleagues. In fact, savvy
legal and compliance officers proactively
offer to partner with procurement
 colleagues in some or all of the
following five major areas:
• Making compliance & ethics a factor
in supplier selection and evaluation;
• Targeting & segmenting suppliers by
commercial importance and ethical
risk;
• Creating & maintaining compliance
histories of important suppliers;
• Assigning compliance personnel to
important supplier relationships; and
• Conducting regular assessments of
supplier risk-profiles.
This type of internal collaboration is
inexpensive, sensible, and arguably
“win-win” from everyone’s perspective
(including suppliers’). At the very least,
increased Procurement-Compliance
interaction will better position your
organization to declare to the media that
it is not simply enabling or ignoring the
ethics problem in the supply chain. And
it stands a good chance of preventing
the problem from actually occurring the
first place.
What can companies do today?
Most Global 2000 companies lack the
ability and infrastructure to quickly
Julien and Marks, from page 27
audit committee chairman can use
their experience to help mentor the
CAE while at the same time discussing
emerging risks and encouraging an
interactive and continuing dialogue.
The missing link
Finding and strengthening the missing
link. The challenges facing audit
committees have never been greater.
This is a demanding time for everyone
involved in the corporate governance
process because of increasing scrutiny
40 B o a r d r o o m B r ie f i n g : t h e C ON S U L T AN T S issue
contact most or all of the companies in
their supply chain, and communicate
with their suppliers on critical issues
of ethics and compliance. In most
cases, this glaring deficiency could be
remedied in less than six weeks’ time.
Many Global 2000 companies have
already begun the work necessary to fill
the gaps (often by collaborating with
other companies to develop technology-
powered “Supplier Ethics Management
platforms”).
A web-based SEM platform allows
a company to collect and maintain
contact information for its suppliers,
and communicate mission-critical ethics
and compliance information to them
on a regular basis. Deploying an SEM
platform is probably the fastest and
easiest way to get a handle on ethics
and compliance risks in the supply
chain. SEM platforms are inexpensive
to create, and are typically hosted,
maintained and administered by third-
party vendors who specialize in ethics
and compliance risk management.
SEM platforms typically perform several
basic (but important) risk management
functions, including the following:
• distributing a company’s code of
conduct and regular updates to its
suppliers;
and expectations of all stakeholders. The
cost of compliance continues to increase.
Thus, it is critical for audit committees
to locate and use their missing
link—the CAE—to create a value-
added relationship that maximizes the
organization’s compliance investments.
Aligning the objectives of the audit
committee and the IA function
strengthens oversight and helps allocate
limited resources. The IA function will
appreciate a closer working relationship
in assessing risks and executing the
audit process.
• documenting supplier receipt of these
requirements (and, where appropriate,
supplier acknowledgement and/or
acceptance of same); and
• facilitating two-way communication
between a company and it suppliers,
on mission-critical topics relating to
matters of ethics and compliance.
Supplier Ethics Management is not
a new risk management discipline.
SEM simply involves the application
of existing risk management tools,
programs, and practices to new risk-
populations (i.e., business partners).
Your company’s legal and compliance
professionals already know how
to manage and mitigate ethics and
compliance risks among your own
employees. With very little additional
time, money, or administrative effort,
they can do the same among the
thousands of companies in your supply
chain.
Michael R. Levin is director of corporate integrity strategy
at Integrity Interactive. He has worked with over 100
companies around the world to establish best-practice
compliance and ethics initiatives and is a Certified
Compliance & Ethics Professional, and a member of the
Massachusetts Bar. To comment on this article, email the
author at mlevin@i2c.com.
Just as important, CAE mentoring
will be achieved by interacting with
experienced board members about
emerging business risks, and the audit
committee will be better positioned to
help the organization attract and retain
the most qualified auditors.
Rick Julien is an executive specializing in risk
management with Crowe Chizek and Company LLC
in Oak Brook, Ill. He can be reached at 630.586.5280
or rjulien@crowechizek.com. Jonathan Marks is an
executive specializing in risk management with Crowe
Chizek and Company LLC in Philadelphia. He can be
reached at 856.581.7146 or jtmarks@crowechizek.com.