Responsible Sourcing 3.0 and connected risk management

A conversation on the future of responsible sourcing

Responsible sourcing, food safety and environmental programmes increasingly land on the same suppliers, the same factories, and the same underlying risks – but they still tend to run in separate silos, on separate platforms, with separate teams. As regulation tightens and cost pressure grows, that separation is becoming harder to justify.

In this episode, EiQ Content Manager Jenna Thompson (JT) speaks with Kevin Franklin (KF), CEO of EiQ, Kimberly Coffin (KC), Global Technical Director at LRQA, and Liam Salter (LS), CEO of RESET Carbon. They discuss what Responsible Sourcing 3.0 looks like in practice, where food safety, sustainability and responsible sourcing genuinely converge, what AI can and can't do for supply chain risk, and the first move brands should make towards a connected view.

Episode length: 36 minutes

Full transcript

JT: Hello and welcome to our session on the future of responsible sourcing and connected risk management.I'm here with three guests today. Kevin Franklin, CEO of EiQ and the architect of EiQ’s thinking on autonomous responsible sourcing. Kimberly Coffin, Global Technical Director at LRQA, who leads on connected risk management across food safety and responsible sourcing. And Liam Salter, CEO of RESET Carbon, who help brands measure and reduce their environmental impact across complex supply chains. Thank you all very much for being here.

Last September in New York, Kevin set out a vision for what he called autonomous responsible sourcing. Supplier risk programmes that are continuous, data-led and intelligent, rather than periodic and reactive. A year on, a lot has changed between geopolitics, AI, new regulation and growing cost pressure. The timeline has compressed, and what's becoming clear is that responsible sourcing can't be looked at in isolation anymore.The same factories, the same suppliers, and increasingly the same risks show up in food safety and environmental programmes too. So today we're going to be looking at what comes next, what connected risk management actually means, and what brands should be doing about it.

So, Kevin, I'm going to start with you. Can you take us back to that vision from last September?What's actually different a year on and what's changed in the operating environment that's pushed this from ambition to baseline?

KF: That's a great question. Roughly a year ago, I think we were all looking forward to the potential of AI, and it stimulated us to think of how we could integrate that into responsible sourcing. How we could move from phase one of the responsible sourcing portfolio, which was largely all about audit, to phase two, which was risk-based programme design, to where we are probably right now, which is the intelligent responsible sourcing paradigm.

So risk-based programme design, leveraging data and analytics, connected to audits, self-assessment questionnaires, corrective action plans, and then how we can automate all of that by essentially joining the dots between each of those as a seamless end-to-end workflow with real-time data flows from one part to another, and also to clients’ own buying platforms – in and outbound APIs.Now, a year ago, that felt innovative and new. But over this last 9–12 month period, the bar's risen, right? Not only are a lot of other companies doing this, a lot of other organisations doing this, but companies expect APIs. They expect real-time data flows. They expect to leverage and use data as part of their decision making. So I think the bar's just risen across the board.

But equally to one of your earlier comments, the geopolitical landscape has shifted significantly. The bar around the regulations has also risen significantly. It's become much more challenging for businesses. We have UFLPA, withhold release orders. We have the corresponding regulations in China: 835 and 834. Most materially, we have the forthcoming European Forced Labour Act. So there's a lot of regulation which has really risen the bar there quite significantly, made it tougher and more complicated for businesses. And then there's a lot of cost pressures that companies are facing today that come from really operating in that same landscape. And this has put pressure on responsible sourcing programmes, their design, and it really has made us rethink what our value proposition is and how we can meet the needs of the market. And those needs have changed.

JT: And then you describe the next phase as Responsible Sourcing 3.0. So not a replacement for what brands already have, but three layers on top of it. So could you walk us through what those layers are and where a typical brand sits on that today?

KF: Yeah, absolutely. It's a really good build on the previous question actually. So when I say those needs have changed, they've changed from the first layer which is around connectivity. So that first layer is all about how do we connect the workflow from risk-based to audits or SAQs or CAPs or worker surveys or grievance mechanisms? How do we bring all of that together, and how do we connect it all – such that a data point that flows in through a risk and a Sentinel or adverse media finding leads to a request for an audit, and then any findings from there are addressed through corrective actions, as well as obviously linked to companies’ buying platforms.

So as we were saying before, how do we connect all of those dots together and how do we also work across different audit paradigms? So we have a concept of equivalency, which is where we can ingest audits from multiple different external audit schemes such as Sedex or BSCI or many other equivalent audit programmes, but harmonise that into a common underlying data infrastructure.It's all about data and leveraging that data in ways where it has a currency that is common and consistent and can flow real time. So that's layer one, is the connectivity. And that's very closely connected to the table stakes piece of autonomous responsible sourcing.

But it's not enough, right? Because this new landscape that clients are operating in means they need to go beyond that.They need to think about how they can make the tools they already have sharper. So sharpening the existing toolkit is layer number two. That means taking your existing audits and squeezing out everything you possibly can from that audit. And that's not by just adding more questions. That's exactly what the industry has been doing for the last 15 to 20 years.Add more questions. Train auditors over and over again. This hasn't helped improve audit quality. What we need to do now is leverage AI. Put that into the audit tool. Make sure that through the AI in the audit tool we are real-time triangulating audit results. We are real-time checking audit findings. We are real-time translating and generating audit reports and generating CAPs.

So we're actively looking today at how we can build all of that into one of our tools, which is ERSA, our Enhanced Responsible Sourcing Assessment 4.0. It will include real-time AI in the audit environment to sharpen and improve the audit process, generate a better audit quality, and also ensure it's more efficient and effective, which means the auditor can get it done in the time they have and not try to write up reports two or three days later once they've forgotten the experience they had on site. So sharpening the existing toolkit, that's one example and adding wholly new tools is the last layer. The new tools are things we didn't know we needed in responsible sourcing. So one of the ones we’re actively exploring today is the idea of a digital human rights impact assessment. So a Human Rights Impact Assessment Lite, which leverages all of the underlying data we already have, that's real-time benchmarked and real-time verified through the on-site audits that we are conducting, combined with AI intelligence around a very structured methodology for human rights impact assessment to produce… if it's not a full-on impact assessment, at least a really good human rights report at a country commodity level.

And that is something we know our clients are looking for. Regulators are expecting you to be acting on that intelligence. Use that to identify salient issues as really a deeper, more thoughtful, risk-based programme design that leads to a more thoughtful set of interventions you take with your factories and other suppliers.And when you combine that more thoughtful set of interventions with deeper and better tools like the ones we just spoke about and a stronger, better corrective action planning process, you able to properly drive the right kind of diagnostics, findings, root cause analysis, and therefore address problems at the root cause level, such that hopefully they won't be reoccurring, which is the gold standard for our industry.

JT: Kimberly, if you set a food safety due diligence programme next to a responsible sourcing one, how much of the skeleton would you say is the same and what's actually shared? And what do you think has been kept artificially separate?

KC: It's a really great question, and it's one I think we talk a lot about internally, from an EiQ and an LRQA perspective more broadly, when we look at the assessments and our clients are asking us the same thing is how do we actually, you know, what do we need? Why can't we pull these two pieces together? The risks do have some interrelationships, and I can talk about that a bit more.

But specifically your question about the skeleton, just the systematic component, same. Same basic elements from a systematic perspective with regards to what are the key systems that need to be in place? How do the organisations use that to identify areas of nonconformity or areas of improvement, and actually be able to log and track those corrections that they're actually making, as well as identification of the root cause. Looking at the other key pieces is from when I think about food safety, you know, you have the component with regards to the facility. So you look at kind of risk areas that exist in the facility. When we look at them from a from a responsible sourcing perspective, it's very much around the health and safety components, how are the machines maintained, how is the access maintained, are those things there? We look at similar things from a food safety perspective. We're looking at how again, how is the equipment maintained, how is it being managed, how is it being cleaned. Different purposes. But we're fundamentally still looking at the same components of the facility.

And then probably the third piece is – and increasingly I'm starting to see that there's a convergence, if you will, in these two spaces. And when we look at the actual workers. So when I talk about food safety, when we talk about delivering against brand and brand reputation, they have worker welfare issues, which is around how the workers work. Do they have the right things? Do they understand what they're doing, are they being paid properly, etc.? When we talk about achieving the highest levels of food safety, we're now starting to see a real double down from organisations about driving culture, providing those employees with the why, not just telling them what to do, but telling them why they do things, giving them autonomy, giving them the actual disciplines and the information they need to actually take action, so if you will, empowering that workforce.

And I think those are probably the three key areas when I look at the – there's other places where they kind of interact – but I think those are probably three very distinct areas when I look at and set the skeletons or the frameworks of the standards and the assessment process, again of three key areas that I think are increasingly converging with regards to how they can actually demonstrate both food safety risk, but also a responsible sourcing risk within an operation.

JT: Okay. Interesting. Thank you. Liam, same question for environmental performance. When you're sitting in front of a brand trying to cut Scope 3 emissions, how often is the supplier data they need already sitting in their responsible sourcing programme, just in a different team’s system?

LS: We've looked at carbon a lot. We're also starting to look at not just Scope 3 emissions; we're starting to look at water consumption. We're starting to look at chemicals use. We're starting to look at wastewater discharge performance. And we will find some of that in a responsible sourcing survey. And some of that will be – we can see it in EiQ. And when we look at it. So there's some data overlap, which I think is a helpful start.

But I think what's really interesting is in a way what the different programmes are trying to do is they're all trying to manage risk, you know, in the environmental space we’re less mature than responsible sourcing, I would say. So, both in terms of number of years, but also in terms of, I would say, sophistication around things like supplier segmentation, risk quantification, the deployment of what you would call in responsible sourcing, corrective action plans, which are essentially risk management programmes. I think the environmental community is learning that that's the way forward. Right. And shifting.

What we saw recently was a shift from sort of very aspirational, bold environmental targets, which actually a lot of brands were failing to implement properly across their supply chain because they were too hard, to a more conservative approach. That's driven by a business case, that's driven by a concept of avoiding risk. And so what that does is it takes us down that responsible sourcing pathway of, okay, which suppliers do I really care about in terms of their significance to my business, their location, their environmental impact of their processes? Which ones are risky? As a result, how ambitious do I want to be in terms of reducing that risk? Because it costs me money if I want to engage suppliers, and maybe I'm asking them to make investments in their businesses. And how am I going to engage those suppliers to do stuff, make investments, build their teams, execute new technology projects to reduce that risk and how am I going to have confidence that they did that and that that risk has been taken out of the system? That's very similar to the approach you've been taking in responsible sourcing for some time, right?

So I think the biggest opportunity here is it's actually about you want to have one dialogue with your supplier. And you want to be consistent in that dialogue about what risks you're wanting them to manage, how you're going to support them to manage, what the incentives are, and the consequences are if they don't manage, whether it's safety, responsible sourcing or sustainability, that narrative is starting to look like it's the same. And I think that's the opportunity – if we can bring that discussion right now, it's happening in three different silos with three different software platforms or whatever, right? And I think that's the opportunity here. We can drive risk management more effectively if we consolidate.

KC: You're absolutely right. And I think one of the things that's really interesting when I look at food safety and I think about that supplier landscape and that risk, and I think it's almost a detriment to a lot of the food and beverage sector, is that our industry has been whetted to risk assessment for so long. We understand it. It goes back to the 1960s and the NASA programme around hazard analysis and critical control point. That's the fundamental baseline that we manage supplier risk, we manage manufacturing risk. But we've become really tunnel visioned around: this is the information that we use. This is the type of information we do. We look at inherent product risk. We don't necessarily look at supplier – risk the holistic supplier risk.

And there's this sharp shift that is now changing in the industry that says, yeah, we know what the material risk is, but we need to understand many more dynamic pieces to actually pull that together. And I think that's one of the things that in responsible sourcing, this whole… I don't want to say notion, this whole concept of multifaceted risk. And actually looking then at how do we segment our suppliers – not just call them high, medium, low, high, medium and likelihood of hazard occurring to high, medium and low, and we kind of work out what they are. It's we actually physically start to look at what are the various data streams that we have? How do we pull that information together and how do we use that not just to set a mark in the sand, either when we identify a new supplier, which is common, or on an annual basis, because a standard tells us to do that. But how do we actually monitor that supplier’s performance and use that to actually give us this ongoing dynamic type of risk that then informs – back to Kevin's point – those how do we then make the tools dynamic with regards to how we manage that risk? And I think, you know, we're really good at risk from a food and beverage manufacturing perspective. But I think we're rethinking, whereas you're learning.

LS: We're rubbish at risk from a sustainability perspective. Because we haven't been thinking about it like that. But I think what we are very good at is data gathering. And environmental data is relatively easy to gather actually. You know, you can automate it in a lot of cases, take it out of meters and so on. And, you know, it was interesting you said the response to perceived shortfalls in our approach is to add more questions. And I think sustainability has done that, right? And we're taking so much data out of suppliers in some sectors, and we're not really using a lot of it to be honest.

So data collection, to be honest, has become a little bit performative. One of the things that we need to do, and I think this is what our technical team is working on is to say, okay, well, which KPIs really correlate with risk? Because I can ask a thousand questions, but actually a relatively small number of KPIs can be used to evaluate: are my carbon emissions high, medium or low for a facility of my type? Is my water consumption excessive, reasonable or incredibly low for a facility of my type? Is my wastewater discharge way above compliance or just on the compliance level, or is it… so these KPIs, actually, what we're learning as we talk to our engineers is you can distil a lot of operational risk into a relatively small number of KPIs. They might be more sophisticated KPIs. They might need a bit of an engine to calculate. It might be a benchmarking model or something like that, but you can then collect those monthly, easily.

And that means this real-time thing that you're talking about from a sustainability perspective is it's relatively easy to report, and it's worth reporting if we're actually managing those risks. And then you can see trends and you can have much closer engagement with suppliers, if you think that risks are skewing control because you can see this kind of thing monthly. So we need to ask fewer questions, more intelligent questions, and do more with the information, do more with the data to give us the information, and then we need to act on it. So I think that's the other thing that brands or buyers are learning is how can I support suppliers to manage these risks? Because this is where there are costs involved, both for the brand and for the supplier. And this is the space we want to get into. Because this is about implementation, which I think – that's where you start to reduce risk.

And that's what a lot of people are… it's still relatively new, right? I think you've seen it on things like maybe wastewater treatment in the past as a compliance issue. I went to my supply chain to drive this in. But if it's a performance issue, what is it worth to me to over perform, and how much am I prepared to invest? If we have the right data in the right place, with the right risk management framework, we can make it much more efficient for brands to invest money in their supply chain to improve performance.

KF: I think what's really beautiful about this is that we're finally at a point where we're doing what we always wanted to do, which is address and improve and focus on the issues. Rather than the activities of collecting the data, the activities of reporting, even the activities of risk. That's all a means to an end. And the end is actually driving the improvement activity, which is also why we’re all at this table together, right? Representing responsible sourcing and food safety and the collected set of environmental issues. Because when we look at all of that, we realise that the best way to drive impact across each of those different areas is to connect the dots. Because otherwise you don't have enough leverage in any one of the areas. You don't necessarily have enough data in any one of the areas, and you already have people on the ground at those facilities anyway. So instead of sending three sets of people to do three different sets of things, why not have them work in a much more connected way?

KC: And sometimes we send three different people to collect the same information with a different lens.

KF: Exactly, exactly.

LS: Yeah, I think, you know, we can see reduced transaction costs on a per supplier engagement basis for brands if we integrate, and actually we see it within sustainability. If you integrate carbon, chemicals, water, wastewater, waste or whatever into one methodology, you unlock a lot of synergies. You unlock technical synergies at the plant level because these issues need to be managed together. But you also unlock a cost saving because you send fewer engineers fewer times to fewer sites. They just do more when they get there. And I think this requires us to do a better job. This is where AI comes in for us, is technical tooling that helps engineers. You know, it's a stronger back office, basically. So you can send your energy engineer, he'll collect the chemical stuff and you throw the chemical stuff into the AI engine in the back office, and then he'll get the insights he needs to do that part of the work, or she needs to do that part of the work. So I think the implementation piece is really the unpack now that we're excited to try and learn how to do. But it's very, very clear that we can drive cost savings for brands on a per site basis if we pull all of these issues together and look at problems in an integrated way.

KF: I would just say also that that is the hard work.

LS: Yeah, right.

KF: And in some respects, the cynic in me says there's quite a lot of the market that may have been comfortable doing the easy work, having the pilot project, doing the reporting, coming up with another strategy. That was the easy work. And actually the huge opportunity that comes with AI in many respects. Ironically, none of us expected it, right? But this is what AI can really do well. It can help with planning. It can help with strategies. It can do all your benchmarking. It can do a lot of these activities and what it leaves you with – by the way, that's not easy, you have to work hard with AI to architect that such that it does those things well – but it can do those things. And if you work well with it, you can get those outputs much faster than you would have done before. What it cannot do is drive environmental improvement in a factory. So ultimately what happens is, very quickly, a lot of those strategy planning, reporting activities start to go away. And you’re left with the hard work.

LS: Yeah.

KC: But that's what you should be spending the resources and the energy is on those “hard things to do” because that's where you actually get the impact.

KF: Exactly.

KC: And we focus so long on compliance. I know in the area of food safety is that it's about, we talk a lot about it's become tick box exercise. We've got all this information. We don't do anything with it. But it was all about just demonstrating compliance. And I think it's because it was the easy way to say, yeah, okay, we've checked and everything's okay. But because of the number and nature of recalls and incidents that we've seen, it's not so much that the number is increasing, but it's the impact of those that are increasing when I look at food recalls, is they're bigger in volume and they spread more widely across the globe. And so those incidents are actually starting to tell us a story about –and everybody says, well, what we're doing isn't enough. What we're doing is we're not using the actual outputs of that process to actually inform where we should be targeting resources, so that we can actually have an impact on the significant number and nature and size of incidents that we're seeing from a food safety perspective.

KF: Absolutely right. So in some respects, you're using maybe the right tools to tackle the wrong things or the wrong tools to tackle the wrong things. Because if you think an audit is going to answer that question, it isn't. It will help you to diagnose it. It's definitely something you have to have in your programme. But at the end of the day, you want the improvement work, right?The culture change in the facility, in the supplier, and you want the energy and emissions reductions.

KC: And you want them, from a responsible sourcing perspective, you want to actually increase that ethics of that particular operations.

KF: Right. You want wages, working hours to be addressed. You want to reduce the number of health and safety incidents.

KC: Conditions.

KF: Absolutely.

LS: I think one of the key issues in terms of… so we're thinking now about, okay, how do we build the service to deliver the level of onsite technical support to drive risk down at a price point that's affordable in the markets that our customers are sourcing or manufacturing product in. And whilst AI is part of the answer, a critical, critical part of the answer is people. You have to marry your AI with in-country technical teams who need to keep learning as you make more demands of them technically for the work that they do onsite.

Essentially what we are driving into is implementation. It's more ambition, right? It's less assessment and more about, okay, I want to install these solar panels, I want to do this heat exchange project, I want to do this waste heat recovery project, whatever. This is a level of technical demand that is higher than it used to be for our teams, and we have to respond to that. But I think… so you've got to marry the AI with the people. And without the people, the AI just gets you to another report or data set. It doesn't take any risk off the table. So, and I feel like we're all a little bit obsessed with AI at the moment. And it's genuinely useful. We have to understand very clearly the role and what you build around it to drive the outcomes that we need.

KF: 100%. Yeah. It isn't going to address some of the biggest challenges that we face as humanity? And sat around this table from a connected risk management perspective, if we look at something like climate stress, heat stress, water stress – pick any one of those topics? Heat stress. A lot of countries around the world are feeling heat stress this summer. In a factory, that manifests as people fainting, overheating, potentially reduced cognitive ability, which can lead to accidents. So heat stress manifests from a connected risk management perspective. Responsible sourcing, very clearly. Same for food safety, right?

KC: Absolutely. So when I look at and I think about heat stress, you know, it is the key cause for what I refer to as agricultural migration, which means that we're not able to grow the things in the places that we've always grown them. So it's actually migrating where we can actually grow the things that we actually need to eat, and that we need to source as the inputs to our manufacturing process.

The second piece is it's having a definite impact on not only pathogenic prevalence and pest prevalence, but the ecology of those as well, which I'm not going to get too technical, but it's not just a “there's more pests in places where we didn't expect them”, but the actual ecology. So their viability, their virility is actually being impacted as well in a very negative way that can cause us food-borne illness issues. And I think the one that… that is probably my personal favourite, because it's the one that we don't actually probably think about, is from a transport perspective. So cold chain management. So a lot of our food, and our most dangerous food that we consume, goes through a cold chain, is actually distributed through a cold chain.And if you think about the impact of heat stress on… just think about your home air conditioner and how much it needs to labour when it's really hot and it's not used to it, we need to actually think about that not only in warehouses, trucks, and are the trucks the right one? And at the same time, from a climate perspective, we're often looking at alternative mechanisms to actually run those vehicles or to run those warehouses.And so it's around, you know, what is the impact of the changes we’re making to do the right thing from an environmental perspective coupled with the heat. And we need to make sure that we've gone through really strict, highly technical validation processes.

KF: And these are exactly the issues I think we're going to be discussing more.

KC: Exactly.

KF: Because heat stress is not a topic we've discussed that much in responsible sourcing, for sure. We've discussed some of the outcomes of heat stress. And the more we sit in the same room, we think connected risk management, I think we'll be talking about what are those congruent issues? What are these bridge issues, the things that emerge as like common denominators right across a whole bunch of outcomes? Because if we go after those topics, the impact of our work is not just tripled, but probably much, much more than that in terms of the benefit that it might achieve. So I'm waiting to see what are the other things. We've got heat stress, we've got climate stress, we've got water stress. But there's a lot more than that, right? That is still waiting to emerge.

JT: So the last question, just a quick one. If a sustainability lead is listening to this and they're running four different platforms, four different programmes across the same supplier base, what's the first move that gets them closer to a connected view?

KF: Data. Connect your data. The first move is: figure out where the data’s sitting from each of these different systems, and try and connect it together. This, by the way, is not necessarily a simple activity. Less companies than we might think have a fully harmonised data-linked warehouse, have a fully harmonised data architecture. But this is a thing to go after? It should be the case that from now on, all of your data is connected. When we're talking about supplier X, you've got access to all of the responsible sourcing data, all of the food safety data, all of the environmental data, all of the business data. The more you can harmonise, link all of your data into one environment – that is where the real benefit is from my perspective.

KC: And from my perspective is just talk to each other. Because quite often we find, and we always say that in that space of the food safety, quality, brand reputation, because we're talking about the product, we're talking about the factories. We have heaps of data – into your point earlier, Liam, we have lots of data. We don't even know why we take it, but we’ve got it. So from a sustainability perspective, because those food safety, quality, brand people have been in place and they've had systems in place and we've been managing this much longer than comparable responsible sourcing or climate. Go talk to those technical people. The number of times that I see that, you know, sustainability or the responsible sourcing teams don't actually connect to the guys that are collecting all of this data. You know, they monitor wastewater for quality and for efficacy of the actual processes. They're looking at temperature control. Talk to each other. Because they don't.

LS: Yeah, I think we would suggest look across the programmes and identify what risks you're managing at the moment and what risks you want to manage. So is that enough? Is it too much? So be very focused on what risks are valuable to my business that I really need to manage. And across the three areas, distil those out. And then from that, you can have a look at your data collection strategy and see is it fit for purpose, is it overengineered? And to Kevin's point, that's when you can bring… I think you can redesign more efficient data collection strategies, and that's when you centralise. So if you can rationalise and centralise, then you get you get a double efficiency opportunity because you stop collecting data. That's a waste of time. And you do it all with one sort of mechanism. And so I think that's… one of the things I think we expect to learn more about in the next 12 months is how the different teams are looking at risk, what the synergies are between those approaches and how we can perhaps integrate those into a single overview. And that then I think drives everything else.

KF: It's a really good point. Ultimately, we've all put ourselves into boxes that we've been living and working in for many years, and we're going to have to fight to get out of them, actually. And these are three of the key ingredients to do that. Connect the data in the background, have real people talking to each other about what to do with it and how to work together more effectively, and then systematically go and redesign. That's the future of good business.

JT: Thank you, everyone so much for being here and sharing your perspectives. I think that was a genuinely really useful conversation, and I hope it was really useful for all of you as well. If you'd like to find out more about us, you can go to eiq.com and you can follow us on LinkedIn. And I really hope to see you next time.