Tag Archives: Supply Chain Integrity and Security (SCIS)

Supply chain integrity and security: what are the risks? (Part II)

Posted on by

Paul Curwell, CPP, CFE, CISSP

Introduction

Part I of this article addressed the concept of Supply Chain Integrity, which is increasingly being bunded with security under the banner ‘Supply Chain Integrity and Security’ (SCIS). SCIS is part of the broader domain of Supply Chain Risk Management (SCRM), which is undergoing its own renaissance thanks to distruptions to global trade and commerce arising from the COVID-19 pandemic and the war in Ukraine.

Part II of the article is continued here examines what we mean by the concept of Supply Chain Security, and how the field is evolving in response to the world’s changing geostrategic climate.

Photo by Julius Silver on Pexels.com

Supply Chain Security – a rapidly changing field

Supply Chain Security has undergone multiple expansions in scope to accomodate the evolving global threat environment, changes in international commerce, technological innovation and increasingly the 4th industrial revolution. However, this evolution has largely gone unreported by commentators in the field, with many books and articles on the subject failing to reflect the broad scope of risks now recognised by critical infrastructure and governments globally. As an example, Supply Chain Security traditionally focused on two main risks:

Practitioners in this area have largely focused around logistics, with security programs focusing on controls such as shipping container seals and GPS vehicle tracking. The events of September 11, 2001, helped sharpen this focus, with the USA enhancing a scheme to help mitigate supply chain security risks posed by terrorism (known as C-TPAT). Examples of equivalent national schemes include:

Photo by Fabiola Ulate on Pexels.com

To coordinate a consistent global response and maintain safe and secure trade and commerce, the World Customs Organisation (WCO) introduced the SAFE Framework of Standards to Secure and Facilitate Global Trade in 2005, followed by the  Authorized Economic Operators (AEO) Programme in 2007. This perspective on supply chain security is reinforced by various global standards including ISO28001, which is intended to complement the SAFE Framework. However, whilst risks like terrorism, theft and product diversion all remain relevant, Supply Chain Security has evolved even further in the past ten years to reflect geopolitical threats in the current operating environment.

Does this article resonate with you? Please vote below or subscribe to get updates on my future articles

Consequently, the USA, UK, Canada and Australia have all issued updated guidance on Supply Chain Security, which has expanded significantly from theft, diversion and terrorism to encompass the more complete spectrum of what the US Government calls ‘Supply Chain Threats’:

In addition to ‘security’ focused risks, a range of frauds can also materialise in the supply chain. For some organisations, it makes sense to address security, integrity and fraud issues in the supply chain within the same business function or framework, whilst for others they are separated to completely different parts of the organisation. However, common risks here include:

I have already written about a number of these supply chain frauds in other articles on @ForewarnedBlog (refer hyperlinks above). Future articles will also cover aspects of this topic.

Risks and business processes with a nexus to Supply Chain Integrity and Security

In any organisation, there are a number of business functions which commonly touch on aspects related to Supply Chain Risk Management. SCIS programs should try to leverage these resources where possible, either through use of common team to execute a process or through smart process design, which means a common process is used to address multiple distinct business requirements.

Photo by Wilson Malone on Pexels.com

Examples here include due diligence and supplier audits which can be performed once and the results reused multiple times to comply with a range of regulatory obligations or business needs. Examples of risks with a nexus to SCIS that might be leveraged include:

When designing your supply chain risk management program, look across your organisation into other areas or teams (such as procurement, finance, sustainability and compliance) to understand work already performed and identify opportunities to streamline processes and systems.

In addition to reducing your operating costs, this approach could improve your supplier’s experience when dealing with you. Sometimes from a supplier’s perspective, a customer can just become too much hard work, leading to increased prices (in an attempt to encourage you to find an alternate supplier) or severance of the relationship overall.

A common example I encounter is where a supplier is asked for the same information multiple times by different teams from the same buyer, leading to wasted effort and frustration. Managing third party or supplier relationships are exactly that – a relationship – so there needs to be an element of give and take by both parties.

Further Reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

Supply chain integrity and security: what are the risks? (Part I)

Posted on by

Paul Curwell, CPP, CFE, CISSP

Introduction

Supply Chains are complex involving many levels of suppliers who are typically located in multiple countries around the world. For high reliability industries (such as airlines and oil rigs) or industries where there is a chance of life or death (e.g. defence applications, pharmaceuticals and food products), the introduction of a sub-standard or below specification (non-conforming) product could have serious consequences. Further, many of these industries are highly regulated to protect consumers.

Photo by Markus Spiske on Pexels.com

The nature of global supply chains today presents a real challenge, as illustrated by the global supply chain for the Boeing 787 and Bombardier Global Express in this article from Canada’s Aerospace Review. These challenges are magnified somewhat in relation to security and integrity risks, as explored later in this article. To assist readers unfamiliar with these concepts, a simple product supply chain could be considered as having at least eight categories of actors, as illustrated below:

An illustative example of a simple supply chain

Part I of this article addressses the concept of Supply Chain Integrity. Part II, continued here, examines what we mean by the concept of Supply Chain Security, and how the field is evolving in response to the world’s changing geostrategic climate. Supply Chain Integrity and Security’ (SCIS) is part of the broader domain of Supply Chain Risk Management (SCRM), which is undergoing its own renaissance thanks to COVID-19 and the associated distruptions to global trade and commerce arising from the pandemic.

Does this article resonate with you? Please vote below or subscribe to get updates on my future articles

What is Supply Chain Integrity and Security?

The concepts of Supply Chain Integrity and Supply Chain Security are often bundled together under the guise of Supply Chain Integrity and Security (SCIS). One example of this is in the life sciences industry, with the following defintion of SCIS being commonly cited from the U.S. Pharmacopea (a compendium of drug information, effectively the standards for all pharmaceutical compounds in the USA whose application is enforced by the US Food and Drug Administration):

Supply Chain Integrity and Security (SCIS) is defined as a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted. This is minimized by implementing procedures to control both the forward and the reverse supply chains. SCIS involves reducing risks that arise anywhere along the supply chain, from sourcing materials and products to their manufacture and distribution. The ultimate goal is to detect adulterated, falsified, or counterfeit products and prevent them from entering the supply chain.

Supply Chain Integrity defined

Supply Chain Integrity is sufficiently different from Supply Chain Security to require its own explanation. Supply Chain Integrity is defined by ENISA as providing an “indication of the conformance of the supply chain to good practices and specifications associated with its operations”. When I think about what this means in plain english, I deconstruct the concept of Supply Chain Integrity into three core elements:

  • Provenance – What are the origins of all components or raw materials in my product? For example, a ‘blood diamond’ extracted illegally from a war zone using slave labour is still an authentic diamond, however its provenance is questionable.
  • Authenticity – Is the product what it claims to be, or has it been tampered with or substituted? Have the products or components been “produced with legal right or authority granted by the legally authorized source” (AS6174A)?
  • Traceability – Can I trace the movement of components in my product from raw material to the end user? This is defined in AS6174A as “having documented history of material’s supply chain history. This refers to documentation of all supply chain intermediaries and significant handling transactions, such as from original manufacturer to distributor”
Photo by Pixabay on Pexels.com

As I previously discussed in this article on SAE’s standard AS6174 and which are worth reproducing again here, the World Economic Forum identified “four key questions that must be answered at the product level as part of Supply Chain Integrity (Pickard & Alvarenga, 2012):

  • Integrity of Source – did this product come from where I think it did?
  • Integrity of Content – is the product made the way I think it is?
  • Integrity of Purpose – is the product going to do what I think it will do?
  • Integrity of Channel – did this product travel the way I think it did?”

To address each of the elements of Provenance, Authenticity and Traceability, Supply Chain Integrity programs typically comprise a variety of activities, including:

  • Track and trace programs as well as serialisation to uniquely identify each component and locate where it resides globally in the supply chain at any point in time
  • Quality management programs, to identify conforming vs. non-conforming products
  • Supplier integrity programs, to understand exactly who the seller of a product, part or raw material is and assess what if any integrity risks this poses
  • Market surveillance (market monitoring) – intelligence activities to identify where products are being sold and by whom, to manage the risk of counterfeit or diverted products to end users and the manufacturer’s brand or reputation
Photo by Pixabay on Pexels.com

A taxonomy of Supply Chain Integrity risks

As with any type of risk, it is possible to build a taxonomy of individual risks which reside under the category of Supply Chain Integrity. Based on my research, I have listed fourteen risks associated with Supply Chain Integrity below:

  • Adulteration of products or raw materials
  • Tampering of products, parts or components
  • Introduction of counterfeit material
  • Gray market products
  • Substitution of raw materials, parts, components or products
  • Falsified or fraudulent material
  • Use of substandard material (i.e. non-conforming or below specification)
  • Misbranded or falsely-labelled products
  • Expired products (moved to less-regulated jurisdiction, re-labelled, and then re-sold)
  • Products marked for destruction are diverted, re-labelled then re-sold
  • Ineffective product recall
  • Ineffective product storage and / or transport
  • Supplier integrity

These risks are related to, but also quite different to the risks listed in Part II of this article on Supply Chain Security (see link at the bottom of the page).

The relationship between Supply Chain Integrity and your Quality Management System

I have mentioned the term ‘conformance’ a number of times throughout this document, which is defined by ISO22000 as “a product which filfils a requirement”. Conformance assumes that a buyer goes to market seeking to procure products or services which do a particular thing or meet a particular standard (the requirements), and that a supplier is contractually obligated to provide a product or service which addresses these requirements.

Photo by Karolina Grabowska on Pexels.com

For buyers, Quality Management Systems (QMS) play an important role in ensuring the products which are shipped to your door for use are firstly what you purchased (hopefully addressing your requirements), and secondly what they claim to be. This process is referred to in AS6174A as ‘Product Assurance’ which involves “confirming the authenticity of materiel or its compliance with manufacturer’s specifications” (SAE International, p27) to minimise the likelihood of non-conforming materiel entering the supply chain. Product Assurance is undertaken using one of four methods listed below:

  • Documentation & Packaging Inspection
  • Visual Inspection
  • Non-Destructive Testing (NDT)
  • Destructive Testing (DT)

Readers wanting more information on the Product Assurance process can refer to my previous article. In many organisations, the Product Assurance process is typically performed by a combination of warehouse personnel and / or engineers, scientists or quality management teams upon delivery of new parts or products. Alternately, other organisations perform these inspections before a product leaves the factory, ensuring adequate SCIS processes are in place to mitigate any security or integrity risks that may arise between the shipment leaving the factory and delivery to its final destination.

Failure to properly perform Product Assurance may mean company takes receipt of a non-conforming product or component on day 1, however that this non-conformance is not identified until the product or component is placed into service (potentially some days later). This gap between delivery date and usage date may be an extended period of time during which warranties or guarantees may become voided. Risks here are particularly high for business critical or hard to source parts held in inventory as spares in the event of an in-service part failure, which could provide a false sense of security that sufficient spares are held in case of emergency.

To read Part II of this article, click here.

Further Reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

How can Insider Threats manifest in the Supply Chain?

Posted on by

Paul Curwell, CPP, CFE, CISSP

Executive Summary

Insider Threat Management is difficult at the best of times, let alone cascading this implementation into the supply chain. The starting point for managing this risk is to understand how and where insider risks may arise in the supply chain, as well as assessing the likely business impact. Only then can these risks start to be managed effectively. The second consideration is contracting with suppliers to set expectations and form contractual obligations on expected practices: Some organisations rely solely on contractual obligations to manage their insider risks, an approach which is fraught with danger. This article explores these risks in more detail and outlines common pitfalls encountered when developing Insider Threat Management clauses in contract schedules.

Employees and contractors of your suppliers have access to your most sensitive information
Photo by Format on Pexels.com

How can insider threats affecting a principal materialise in the supply chain?

In this post, I use the term ‘principal’ to reference the party engaging a third party (e.g. a supplier). Insider threats can be malicious, complacent or ignorant, and there are two ways trusted insiders in the supply chain may impact a principal:

  • Principal is targeted directly by the insider – examples include supply chain attacks (ICT), issue motivated activism (e.g. anti-fossil fuels), or the introduction of SSFFC (Substandard, Spurious, Falsely Labelled, Falsified and Counterfeit) and / or non-conforming parts or components into the principal’s supply chain.
  • Principal is not directly targeted but is impacted by the consequences of the event – examples might include a workplace violence incident which causes a downstream business interruption that affects quality, availability or some other service level.

Under Australia’s new Security of Critical Infrastructure Act and Rules (2022) (referred to as SOCI), critical infrastructure operators are required to more actively manage insider threats and supply chain hazards. The relevant Rules have been reproduced below:

  • Personnel Hazards: minimise or eliminate material risks that negligent employees and malicious insiders may cause to the functioning of the asset (paragraph (c))
  • Supply Chain Hazards: minimise or eliminate the material risk of, or mitigate, the relevant impact of: misuse of privileged access to the asset by any provider in the supply chain (paragraph (b))

To comply with these obligations, organisations need to understand the intersection of insider threats and supply chain threats and how they might manifest in practice.

What insider risks can manifest in a direct impact on the principal?

We buy products or services from our suppliers, and we may also use other third party relationships such as alliances or consortiums to facilitate business in some way. This means that insider risks can impact people, assets, information as well as products, services and quality. Examples of insider risks in the supply chain are outlined below:

RiskDescriptionControls
Unauthorised use or disclosure of informationMay involve the following categories of information:
a) Intellectual Property & Trade Secrets
b) Commercially sensitive information
c) Personally Identifiable Information		Information Protection Programs
Supervised Destruction at contract termination
Unauthorised use or copying of molds, proprietary materials, manufacturing equipment, tools or techniquesWhere a supplier uses tools and equipment provided for a permitted purpose without authorisation (relevant to Contract Manufacturers and Contract Resesarch Organisations)Supplier Assurance / Audits
Equipment Disposition
Market Surveillance Programs
Supervised Destruction
Contract clauses specifying ownership of IP
Supplier reputation (entity)Adverse media / reputation
Management track record
Finances & Credit Ratings
Watchlist & Sanctions checks
Ultimate Beneficial Ownership & Control
LItigation history & enforcement action
Other checks as appropriate		Supplier Integrity Program
Supplier Due Diligence
Supplier Assurance / Audits
Supplier’s employeesPotential for infiltration by hostile actors (e.g. organised crime, nation state actors) of the supplier.
Hiring of unsuitable employees, contractors by a supplier.		Workforce Screening Program (background checks)
Supplier Integrity Program
Insider Threat Management Program
SabotagePhysical Sabotage
ICT System Sabotage
Data Sabotage
Supply Chain Attacks
Product Tampering		Physical Security Program
Personnel Security / Insider Threat Program
Supply Chain Integrity & Security Program
IT Disaster Recovery
Introduction of SSFFC & Non-Conforming PartsFailure of, or damage to, critical assets whilst in service due to malicious insertion or latent vulnerabilities in parts, components or software.
Unidentified cybersecurity vulnerabilities in products or systems (e.g. network back-doors).
Failure of products or components whilst operating withinin specifications.
Substitution of authentic (conforming) for inauthentic (non-conforming) parts or components.		Supply Chain Integrity & Security Program
Quality Assurance Program
Intentional Interference & Contract FrustrationSupplier / service provider under-delivers or incorrectly delivers intentionally for some reason (including through economic coercion or hostile control by other nation states)Supplier Due Diligence
Threat and Risk Assessments
Contracting
Supplier Assurance / Audits

Designing and enforcing Insider Threat clauses in contracts can be challenging

In my experience working on both supply chain security and insider threat engagements, it is common to see organisations placing a high degree of reliance on the provisions in a contract to manage these risks. Quite often these courses of action are driven by legal or procurement policy decisions in organisations which don’t fully appreciate their threat and risk environment.

Relying on contractual provisions to manage insider threats (or any other supply chain threat) means your organisation is reactive or response-driven: when you need to enact the provisions general incident or loss has already materialised, and sometimes the legal remedy may not be obtained until years after the event, during which time considerable management time, expense and effort has been expended.

Legal mechanisms are only one way to manage trusted insider risks

In addition to the above, I regularly encounter a range of challenges with these contract clauses, including:

  • Sometimes contracts are silent on Insider Threat Management, or the clauses that do exist cannot be readily or easily enforced.
  • Supplier contracts often last for multiple years, and renewals may be simple extensions without using the latest templates. This can mean a patchwork of standards and obligations exist throughout the supplier base, some of which may not align to the organisations current standards and practices.
  • Principal’s don’t specify their expectations of a suppliers Insider Threat Management program, which could be mitigated by providing standards and frameworks for suppliers to follow and referencing these in contract schedules.
  • Sometimes the relevant clauses are in a contract but they are never audited or enforced to confirm the supply plied is actually adhering to what they agreed to. Also, suppliers may have been compliant at a point in time, but then ceased to comply due to cost pressures or management decisions.
  • When dealing with the situation where there is only one or a small number of suitable suppliers globally, negotiating power is an issue. The principal may have the best intentions and a good framework to follow, but the supplier is not interested in agreeing to these clauses and refuses to sign the contract, knowing the principal will likely have to back down.
  • In some cases, it may not be possible for a supplier to agree to the principal’s requirements due to the nature of legal, industrial relations, employee engagement, or culturally-acceptable practices in the suppliers jurisdiction. Workforce surveillance practices such as Used Activity Monitoring is a good example here.

As you can see, there is a lot to consider when making policy decisions on Insider Threat Management practices generally, let alone when suppliers are thrown into the mix. Effective management requires a clear understanding of the threats and risks affecting the principal and how they may impact critical assets. Only then can a risk-based management strategy be developed tailored to the principals needs and risk profile. There is often little room for a ‘one size fits all’ strategy in this scenario.

Further Reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

Australia’s Critical Technology and Supply Chain Principles – a new reality for industry (part 2)

Posted on by

Paul Curwell, CPP, CFE, CISSP

What are the Principles?

As I outlined in an earlier post, Critical Technologies are those new or niche technologies which will confer a competitive advantage for Australia into the 21st Century.

On 15 November 2021, the Department of Home Affairs published the final version of the Critical Technologies Supply Chain Principles, after approximately one year’s public consultation. These principles come off the back of similar efforts in the USA, UK, New Zealand and other countries, all of which recognise the risks associated with Supply Chain Integrity and Security (SCIS).

Photo by Kateryna Babaieva on Pexels.com

Importantly, supply chain integrity and security is applicable to all industries, not just critical infrastructure operators (covered under the Security of Critical Infrastructure Act, or SOCI and its subsequent amendment, SLACI) or those industries involved in Critical Technologies. AgriFutures Australia published its study entitled ‘Product fraud: Impacts on Australian agriculture, fisheries and forestry industries‘ in late 2021, is a prime illustration of this (I will take a look at this report later).

Relevant Definitions

  • Foreign Ownership, Control and Influence (FOCI): A company is considered to be operating under FOCI whenever a foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorised access to sensitive operational information / confidential information or may affect adversely the performance of contracts in Australia’s national interest (adapted from US Government DCSA). Whilst this language originated in the U.S., it also is used by Australia’s Foreign Investments Review Board (see here) as well as Defence.
  • Supply Chain Integrity: “a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted” (United States Pharmacopeial Convention)
  • Supply Chain Security: activities aim to enhance the security of the supply chain or value chain, the transport and logistics systems for the world’s cargo and to “facilitate legitimate trade” (Government of Canada)
  • Product protection: the collection of programs, internal controls and security countermeasures designed and deployed to protect tangible and digital products against fraud, security and integrity threats in the supply chain and marketplace. This includes Anti-Piracy, Anti-Counterfeiting, Track and Trace, and Product Authentication measures (Curwell, 2022).

The Critical Technologies Supply Chain Principles establish 10 ‘agreed principles’ generally applicable to brand integrity, supply chain integrity, and product protection in any Australian industry:

Agreed PillarsAgreed Principles
A. Security by design

Security should be a core component of critical technologies. Organisations should ensure they are making decisions that build in security from the ground up.		1. Understand what needs to be protected, why it needs to be protected and how it can be protected.
2. Understand the different security risks posed by your supply chain.
3. Build security considerations into all organisational processes, including into contracting processes, that are proportionate to the level of risk (and encourage suppliers to do the same).
4. Raise awareness of and promote security within your supply chain.
B. Transparency

Transparency of technology supply chains is critical, both from a business perspective and from a national security perspective.		5. Know who your critical suppliers are and build an understanding of their security measures
6. Set and communicate minimum transparency requirements consistent with existing standards and international benchmarks for your suppliers and encourage continuous improvement.
7. Encourage suppliers to understand and be transparent in the depth of their supply chains, and provide this information to customers.
C. Autonomy and Integrity

Knowing that suppliers demonstrate integrity and are acting autonomously is fundamental to securing your supply chain. 		8. Seek and consider the available advice and guidance on influence of foreign governments on suppliers and seek to ensure they operate with appropriate levels of autonomy.
9. Consider if suppliers operate ethically, with integrity, and consistently with international law and human rights.
10. Build strategic partnering relationships with critical suppliers.
Final Principles – in Critical Technology Supply Chain Principles

Businesses looking to uplift their supply chain and third party risk management practices would do well to incorporate these principles into their policies, supported by a robust framework to faciliate implementation. So what might such a framework look like exactly?

Does this article resonate with you? Please vote below or subscribe to get updates on my future articles

How do the Principles relate to other standards and guidelines?

The Critical Technology Supply Chain Principles are useful as a starting point for businesses which haven’t really focused on this area before when developing their policies or supply chain risk management programs. In my day to day interactions across many industries, whilst domains like cybersecurity are very mature, supply chain risk management is something many businesses have largely overlooked for decades, despite our status as an island nation.

Photo by Griffin Wooldridge on Pexels.com

So, if the Principles provide high level guidance, how much similarity is there between them and other commonly cited standards or guidelines focused on developing more holistic programs? And which, if any, standards might be best used by Australian businesses to compliment the Principles when building their programs to manage supply chain risk? The following table compares the principles against three main guidelines used in this area:

CTSCPISO 28000 Supply Chain Security ManagementSOCI RulesAPRA CPS231 OutsourcingANSI/ASIS SCRM.1-2014
1. Identify critical assets & protection requirementsExistingNot yet finalisedIndirectlyYes
2. Identify risksExistingNot yet finalisedYesYes
3. Design in securityPartial – focus on supply chain, not product protectionNot yet finalisedYesYes
4. Raise awarenessNot directly addressedNot yet finalisedNot directly addressedYes – using ISO31000 principles
5. Know Your Suppliers & assess their securityYesNot yet finalisedPartialYes
6. Work with suppliers to increase transparencyPartialNot yet finalisedNoYes
7. Encourage suppliers to map and understand extended supply chainsIndirectlyNot yet finalisedNoYes
8. Consider foreign interference risks to suppliersIndirectlyNot yet finalisedNot directly addressedNot directly addressed
9. Consider supplier ESG* & Integrity risksNot directly addressedNot yet finalisedYesYes
10. Build partnerships with key suppliersYesNot yet finalisedYesYes
Author: Paul Curwell, 2022.

*ESG risks: refer to the collection of Environmental, Social and Governance risks faced by public and private sector organisations today. For those new to ESG, this article from MSCI provides a useful introduction. ESG risks include Modern Slavery – see here for my previous post on Modern Slavery, Human Trafficking & People Smuggling (part 1)? and here for How should I perform due diligence to comply with Australia’s Modern Slavery Act 2018 (part 2)?

As you can see from the above table, ANSI/ASIS SCRM.1-2014. Supply Chain Risk Management Standard: A compilation of best practices is one of the more comprehensive references for any business looking to build or enhance its supply chain risk management program. Additionally, note that the Critical Technologies Supply Chain Principles introduces a range of new measures not previously. Managing these risks likely requires new skills for many security practitioners (both cybersecurity and protective security disciplines).

Photo by Matheus Natan on Pexels.com

What might implementation and adoption challenges look like?

One observation from me is the interdisciplinary or converged nature of legislation and government policy relating to risk and security that started to emerge with the introduction of the SOCI Act in 2018. There is an increasing emphasis on integrated, enterprise-wide programs which remove the traditional silos that existed between protective security, cyber security and fraud / financial crime, risk and compliance, procurement and operations. Foreign Ownership, Control and Influence – traditionally the domain of Anti-Money Laundering / Counter Terrorist Financing and Trade Compliance – is one example.

Whilst all of these measures are positive and heading in the right direction given the complex threat environment we all now operate in, the question for me is how Australian businesses will respond to guidance such as the Principles and whether they will be embraced and enacted, particularly in Australian industries which have traditionally given their security-related concerns minimal priority. The protection of Australian Intellectual Property (beyond legal protections such as a patent or claiming copyright) is a prime example here. Hopefully our historical Australian attitudes and perceptions of a benign risk environment are evolving given increasing cyber attacks, frauds, and changing priorities for company directors and boards. Only time will tell.

Further reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

Australia’s Critical Technology and Supply Chain Principles (part 1)

Posted on by

Paul Curwell, CPP, CFE, CISSP

What are critical technologies?

As we move into the fourth industrial revolution and a changing geostrategic landscape the likes of which haven’t been seen since World War II, global society is again forging a new path. Whilst resources and labour have been the currency of previous era, now it is advanced technology. The ubiquity of most forms of technology mitigates some of the competitive advantage enjoyed by nations and businesses, with the exception of new or niche technology that addresses the needs of 21st century society. In Australia, this class of technology is now referred to as ‘critical technologies‘.

Photo by Pok Rie on Pexels.com

The Australian Government has defined critical technologies as being those which have been identified as “having a significant impact on our national interest (economic prosperity, national security and social cohesion)“, which the Australian Government has set as its baseline. Whilst some technologies on the list have implications for defence and security, the Action Plan acknowledges these technologies often have broader applications (i.e. they are what is referred to as ‘dual use’ goods or technologies).

Key terms used in the policy documents

  • Critical technologies – Current and emerging technologies that have the capacity to significantly enhance or pose a risk to our national interest (prosperity, social cohesion or national security).
  • Emerging technology – Technologies that are currently developing, or that are expected to be available within the next five to ten years

Critical technologies are exposed to some unique risks

Many of the risks associated with critical technologies have been widely publicised in recent years, ranging from efforts by the US Government to purchase more rare earth resources after a buying spree by the Chinese government (see Scheyder, 2022), through to methods of Intellectual Property theft occurring under the guise of technology transfer (see my previous post). However, it’s worth recapping the key critical technologies risks as listed in the Blueprint:

  • Lack of competitive and diverse markets
  • Highly geographically concentrated supply chains
  • Critical infrastructure interdependencies
  • Creation of an increased cyber threat surface
  • Influence of foreign actors on international technology standards development which may run contrary to Australia’s values and objectives
  • Undermining institutional integrity through mis- and dis-information operations
  • Exploitation of Australian knowledge – such as through economic espionage or foreign interference

Each of these presents it’s own set of risks which is not purely a problem for government to manage. Industry owns the asset and with limited exception industry is responsible for managing those risks. The challenge for many Australian businesses is that these risks are quite unique in nature, and require a specialist set of skills and knowledge to manage which is not readily found in the Australian market. Stay tuned for Part 2 of this post which will go into these risk management steps in relation to supply chain integrity and security in more detail.

Does this article resonate with you? Please vote below or subscribe to get updates on my future articles

Enter November 2021 and the release of Australia’s Critical Technology Blueprint and Action Plan

When the consultation drafts first came out for critical technology in 2020, my first question was which technologies are we actually referring to. When it comes to risk management, knowing what comprises your critical assets is a pre-requisite to safeguarding them effectively.

With the release of Australia’s Critical Technologies Action Plan by the Critical Technologies Policy Coordination Office (CTPCO), Australia’s critical technologies are now clearly defined. The Action Plan identifies 63 technologies across seven disciplines, each of which broadly aligns to an Industry Sector.

So what are Australia’s Critical Technologies?

  • Additive manufacturing (incl. 3D printing)
  • Advanced composite materials
  • Advanced explosives and energetic materials
  • Advanced magnets and superconductors
  • Advanced protection
  • Coatings
  • Continuous flow chemical synthesis
  • Critical minerals extraction and processing
  • High-specification machining processes
  • Nanoscale materials and manufacturing
  • Novel metamaterials
  • Smart materials
  • Advanced data analytics
  • Advanced integrated circuit design and fabrication
  • Advanced optical communications
  • Advanced radiofrequency communications
  • Artificial Intelligence (AI) algorithsm and hardware accelerators
  • Distributed ledgers
  • High performance computing
  • Machine learning (incl. neural networks and deep learning)
  • Natural language processing (incl. speech and text recognition and analysis)
  • Protective Cyber Security Technologies
  • Biological manufacturing
  • Biomaterials
  • Genome and genetic sequencing (Next Generation Sequencing)
  • Nanobiotechnology
  • Nanoscale robotics
  • Neural engineering
  • Novel antibiotics and antivirals
  • Nuclear medicine and radiotherapy
  • Synthetic biology
  • Vaccines and medical countermeasures
  • Biofuels
  • Directed energy technologies
  • Electric batteries
  • Hydrogen and ammonium for power
  • Nuclear energy
  • Nuclear waste management and recycling
  • Photovoltaics
  • Supercapacitors
  • Post-quantum cryptography
  • Quantum computing
  • Quantum sensors
  • Quantum communications (including quantum key distribution)
  • Advanced imaging systems
  • Atomic clocks
  • Gravitational-force sensors
  • Inertial navigation systems
  • Minature sensors
  • Multispectral and hyperspectral imaging sensors
  • Magnetic field sensors
  • Photonic sensors
  • Radar
  • Satellite positioning and navigation
  • Scalable and sustainable sensor networks
  • Sonar and acoustic sensors
  • Advanced aircraft engines (including hypersonics)
  • Advanced robotics
  • Autonomous systems operation technology
  • Small satellites
  • Drones, swarming and collective robots
  • Space launch systems (incl. launch vehicles and supporting infrastructure)

Many of the risks associated with critical technologies will be managed through existing regulatory frameworks

The Action Plan outlines the policy levers – including economic, national security and diplomatic levers – available to it to manage critical technologies in Australia’s national interest and in accordance with Australian values. The Australian Government has commited to “ensure all actions to protect and promote critical technologies are proportional, targeted and sustainable”.

To this end, the Action Plan presents four policy response categories available when pursuing actions on critical technologies, as shown in the figure below:

A response framework for critical technologies – in The Action Plan for Critical Technologies

The Action Plan also conveniently provides a map of the Australian Government’s “comprehensive suite of recent actions to promote and protect critical technologies across all four policy response categories”:

Government actions to promote and protect critical technologies – in The Action Plan for Critical Technologies

As you can see, many of Australia’s actions to promote and protect our critical techologies are already in place, meaning the introduction of new regulation or initiatives affecting industry should be minimal. Some of these fall within this scope of what I write on here at ForewarnedBlog.com – follow me for future posts on the Foreign Interference Guidelines, Supply Chain Resilience Initiative, changes to export control regulations and trade compliance (i.e. the Defence & Strategic Goods List), and foreign investment restrictions for critical technology (including what is referred to as Foreign Ownership, Control and Influence or FOCI). Part 2 of this post will focus on one new announcement, the Critical Technology Supply Chain Principles.

Part 2 – Critical Technology Supply Chain Principles

With a good understanding of the policy landscape and assets requiring protection, Part 2 of this post looks at what this means for the protection and integrity of critical technologies, supply chains, IP and products.

Further reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

Posted on by

Author: Paul Curwell

Introduction

In a previous post, I looked at the anti-counterfeiting and supply chain traceability model proposed by AS6174 for the Aviation and Defence industries. This standard is one of many different standards available, some of which are generically applicable to any industry, and others which are designed to meet the needs of a particular target audience.

This article continues with the current Supply Chain Integrity and Security theme, this time looking at the model developed by the The United States Pharmacopeial Convention (USP) – Asia Pacific Economic Cooperation (APEC) Life Sciences Innovation Forum (LSIF) in 2016.

The United States Pharmacopeial Convention defines Supply Chain Integrity and Security as “a set of policies, procedures, and technologies used to provide visibility and traceability of products within the supply chain. This is done to minimize the end-user’s exposure to adulterated, economically motivated adulteration, counterfeit, falsified, or misbranded products or materials, or those which have been stolen or diverted”.

On first glance, the output of the USP/APEC model is what is referred to as the ‘Supply Chain Security Toolkit for Medical Products’, designed for the pharmaceutical, medical devices, and life sciences industry. This toolbox addresses ten different domains, each of which has a range of sub-components, which align nicely into a Capability Maturity Model that at a high level could be applicable to a range of industries.

In this post, I unpack this USP/APEC toolbox in more detail and explain how the Toolkit could be applied to create an industry-agnostic Capability Maturity Model for Supply Chain Integrity and Security.

Photo by Anna Tarazevich on Pexels.com

The USP/APEC ‘Supply Chain Security Toolkit for Medical Products’

This toolkit itself is a 14-page interactive PDF broken into ten domains, each of which reflects a different element of the supply chain.  There are 64 supporting documents from a variety of authors, including the World Health Organisation and APEC, which dive into each element in differing levels of detail. This is available on the Korean National Institute of Food and Drug Safety’s website. The ten elements are as follows:

Good Manufacturing PracticesThis section sets out 11 key considerations for supply chain integrity and security in any manufacturing process. Aside from processes like Outsourcing and Repackaging, which are recognised as vulnerable to a variety of supply chain threats from product tampering, to cargo theft, product substitution, product diversion, and grey market / parallel import activity, this section also introduces the concept of “show and shadow factories”.
Used here, ‘shadow factories’ refer to businesses which actually perform the manufacturing process (or elements of it), without being declared as such. Aside from the Supply Chain Integrity and Security risks, these practices also expose organisations to Bribery & Corruption risks (such as the Foreign and Corrupt Practices Act and United Kingdom Bribery Act) and Modern Slavery and Human Trafficking risks (such as were workers in ‘shadow factories’ may be trafficked or working in slavery, slave-like, harmful or substandard conditions). See my related posts on modern slavery and associated due diligence practices here.
Good Distribution PracticesThis section, along with the Good Manufacturing Practices, is comprehensive and well-constructed. Whereas the real insights the remaining sections are somewhat buried in the supporting documents, this section is cleanly laid out to reflect the steps required across 11 elements of the distribution value chain.
Good Import / Export PracticesUnfortunately this section remains under development so no further guidance or information is available on importing and exporting
Clinical and Retail Pharmacy PracticesThis section is interesting because of its focus on the ‘end user’ [see my previous post for details on end user verification], covering the lifecycle from “purchase and receipt to storage, and until the products are dispensed and administered”. The supporting guidance includes another 66-page toolkit which is similar in terms of application to AS6174, as well as incorporating similar concepts around traceability of raw materials and storage as the Australian Code of Good Manufacturing Practice for Veterinary Chemical Products.
Product SecurityThe term ‘product security’ appears undefined in the Toolkit, yet seems to refer to the variety of measures used to protect products from “cargo theft, intentional adulteration, Product Diversion, Substandard Products [what I refer to as Product Substitution], and Product Tampering. The materials in this section provide advice on both “upstream” and “downstream” issues in the supply chain.
Detection TechnologyThis section focuses on giving parties in the supply chain the ability to determine the Authenticity and Conformance (including Quality) of any product, with a view to identifying what USP/APEC define as ‘Substandard, Spurious, Falsely Labelled, Falsified and Counterfeit’ (SSFFC) medical products through non-destructive (e.g authentication of packaging) and destructive testing (e.g. chemical analysis) methods. One observation from me is the different language used across industries – whilst this life sciences example uses SSFFC, readers of my previous post may recall that AS6174 used “suspected, fraudulent, and counterfeit” to refer to the same concepts.
Internet salesThe global, unregulated nature of online shopping is a long-standing concern for any Intellectual Property Rights (IPR) Holder, let alone life sciences. TheToolkit highlights a variety of risks to consumers arising from internet sales, including: “(a) not receiving the drug purchased; (b) drugs containing incorrect dosage, i.e. super-potent or sub-potent; (c) or containing no active ingredient at all”. A fourth category, that of containing harmful or toxic ingredients as substitutes (e.g. arsenic), could also be added given this practice is common with many counterfeit pharmaceuticals – see this article published in 2019 from The Guardian.
Track and Trace SystemThe life sciences industry has a range of industry-specific, regulated requirements around ‘track and trace systems’ such as those mandated by the United States Drug Supply Chain Security Act (DSCSA). Usefully, this Toolkit contains a Gap Assessment documenting selected best practices as well as cost-benefit information that may be of use in any business case.
Surveillance and MonitoringThis element is split into the typical Prevent, Detect and Respond domains common in any security or fraud risk management framework and is primarily focused at the government, as opposed to manufacturer, level. The government focuses likely explains why this model does not address the utility of an ‘intelligence capability’ as a foundation to Identify and Monitor threats before they become material to business. I will cover this in more detail in future posts.
Single Points of ContactThis aspect focuses on building a public-private network for information exchange between regulators, authorities, law enforcement agencies and international bodies. In addition to emphasising reporting, this domain also addresses the need for training and cooperation programs.
Photo by Alexandros Chatzidimos on Pexels.com

Using the Toolkit to build a Capability Maturity Model for Supply Chain Integrity & Security

As outlined above, this is a comprehensive, free toolkit for a highly regulated industry that goes into a substantial amount of detail as to the programs and initiatives that should comprise any Supply Chain Integrity and Security framework for the life sciences sector. The attraction of this Toolkit is that it could be easily converted into a Capability Maturity Model and applied across any industry with similar supply chain risks, such as food & beverages, consumer electronics, or agricultural chemicals.

Whilst subtle industry and jurisdiction-specific differences will exist, any reader charged with the task of reviewing or developing a Supply Chain Integrity and Security program could easily apply the contents of this Toolkit to this task. Additionally, Internal Auditors and functional leads (e.g. Heads of Product or Heads of Security) could benefit from using the Toolkit to benchmark their current programs.

Photo by Anna Shvets on Pexels.com

Benchmarking & Capability Maturity Models

Any benchmarking activity should start with the construction of a Capability Maturity Model – effectively a deconstruction of all the major elements in any Supply Chain Integrity and Security framework (e.g. manufacturing, distribution, product security, etc), which identifies each of the sub-elements that comprise each of the major elements. Organisations which lack either a major or sub-element would ordinarily be considered less mature, receiving a lower ‘current state’ score, unless there is a justifiable business need for not performing a particular function.

I have been building and applying Capability Maturity Models since 2006 when I joined Booz Allen Hamilton, and I can personally attest to the tremendous value of Capability Maturity Models in helping functional leads understand what needs to feature on strategic roadmaps or workplans. Just as important as the design of the Capability Maturity Model is what is defined as the ‘target state’ – importantly, you don’t need to have the highest capability maturity score for every major or sub-element. In some cases, a low score may be justifiable.

The whole point of a Capability Maturity Model is to build a capability that meets your strategic and operational requirements, as opposed to having a great capability that is not required given the business’ operational footprint. Capabilities which exceed business requirements can be a waste of money and may be a target for cost reduction or outsourcing.

Further reading

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.

Unpacking AS6174 in relation to Supply Chain Integrity

Posted on by

Author: Paul Curwell

Introduction

Product counterfeiting is a global fraud problem that has been steadily evolving for decades, with no product or industry being immune. In 2015, Frontier Economics estimated “the value of international and domestic trade in counterfeit and pirated goods in 2013 was $710 -$ 917 Billion” (2015). The magnitude of this problem is also reflected in US and EU Customs seizures, which continue to grow (Smith, 2016). Unfortunately, Customs agencies can only seize what they know about, placing the onus on the purchaser to exercise adequate due diligence and supply chain risk management practices.

In 2007, the US Department of the Navy tasked the US Department of Commerce’ Bureau of Industry & Security to conduct an assessment of counterfeit electronics across the US defence industrial base, concluding “all elements of the supply chain have been directly impacted by counterfeit electronics” (2010). Similar findings across other branches of the US Government have triggered a range of Supply Chain Integrity and Security initiatives, one of which is Supply Chain Integrity.

The concept of Supply Chain Traceability

Supply Chain Traceability is critically important as a control to achieve Supply Chain Integrity in safety or high-reliability industries such as Aviation or Healthcare, where the introduction of sub-standard products / components / raw materials (referred to in the standard as ‘materiel’) can ultimately lead to death. Supply Chain Traceability is defined in AS6174 as “having documented history of material’s supply chain history. This refers to documentation of all supply chain intermediaries and significant handling transactions, such as from original manufacturer to distributor” (SAE International, p9), with ‘materiel’ being defined as “material, parts, assemblies and other procured items” (SAE International, p6).

Photo by Alexander Isreb on Pexels.com

This concept of Supply Chain Traceability presented in AS6174 appears akin to the concept of Supply Chain Integrity introduced by the World Economic Forum in 2012, which identified “four key questions that must be answered at the product level as part of Supply Chain Integrity (Pickard & Alvarenga, 2012):

  • Integrity of Source – did this product come from where I think it did?
  • Integrity of Content – is the product made the way I think it is?
  • Integrity of Purpose – is the product going to do what I think it will do?
  • Integrity of Channel – did this product travel the way I think it did?”

The difference between the approach adopted by AS6174 and that of the WEF report is that the standard is, unexpectedly, much more forensic in the way it approaches the concept. Where the WEF principles differ are in their application, which is broader than anti-counterfeiting, and could easily incorporate Environmental / Social / Governance (ESG) and other Sustainability Risk considerations such as Modern Slavery and Illegal Logging as part of a broader focus on Supply Chain Integrity (World Economic Forum, 2015).

Within AS6174, Supply Chain Traceability aims to address the introduction of Suspect, Fraudulent or Counterfeit materiel into the Supply Chain (SAE International, p6). Before proceeding further, it is worth exploring exactly how the introduction of Suspect, Fraudulent or Counterfeit material into the Supply Chain is possible. From my perspective, there are two starting points to this discussion:

Genuine Materials

Genuine materials are used or supplied by the manufacturer, which are subsequently adulterated or compromised, meaning that a legitimate product (referred to in AS6174 as a ‘conforming product’) is transformed into a ‘non-conforming’ (illegitimate) product at some point in the supply chain before it reaches the end user. The transformation from genuine to non-conforming materiel can occur in the supply chain via at least two methods:

  • Product Diversion – where legitimate product is diverted from the authorised supply chain (Bandler & Burke 2009, Datz 2005), impacting the ability of a consumer to rely on a vendors’ warranties around Authenticity and Conformance (SAE International, pp7-10). This can be through theft, but it can also be as a result of sales to seemingly legitimate customers (e.g. OEMs) where that product is then re-sold or passed to a third party, such as a gray marketer (Shulman, 2012)
  • Product Substitution – where a product, or part of a legitimate product, is substituted with non-conforming material (Guide to…2019). The concept of product substitution can be illustrated with a can of house paint. Imagine a paint can with the uppermost quarter consisting of real paint (i.e. conforming materiel). The remaining three-quarters of the paint can is filled with a substitute, or non-conforming materiel, which does not mix with the real paint and is heavier so it stays at the bottom of the can. When a customer receives the paint and looks inside, or perhaps performs testing on the product, they will likely only see the uppermost layer. Provided a sample is taken from this layer, the sample will test positive (i.e. conform with manufacturer’s specifications) and not be detected. Meanwhile, the fraudster who substituted the original for fraudulent product has the opportunity to sell three other cans of paint to unsuspecting consumers for the price of one, less the cost of labeling three unmarked paint cans, pocketing the difference.

Both of the above examples fit the definition of “fraudulent material” under AS6174, which is defined as “suspect material represented to the customer as meeting the customers’ requirements” (SAE International, p6).

Non-Genuine Materials

In the second method, non-genuine materials are used throughout the manufacturing process, resulting in a product that in no way conforms to the specifications or authenticity of the original product itself, other than the application of the victim manufacturers’ Trademarks or branding on the packaging. This is commonly referred to as a counterfeit, or ‘fake’. AS6174 defines counterfeit material as “fraudulent material that has been confirmed to be a copy, imitation or substitute that has been represented, identified, or noted as genuine, and / or altered by a source without legal rights with the intent to mislead, deceive or defraud” (SAE International, p6).

Managing the risks – what does AS6174 suggest?

AS6174 provides guidance across 7 main areas to manage the risks of Suspected, Fraudulent or Counterfeit materiel entering the supply chain. These areas include Product Assurance, Risk Assessments, Contractual Obligations, Purchasing Practices, Traceability Guidance and Reporting / Information Sharing arrangements. The following sections focus in more detail on Product Assurance and the Counterfeiting Risk Assessment. Other elements, such as purchasing and supplier due diligence, will be covered in future posts.

Product Assurance

The purpose of Product Assurance, which effectively involves “confirming the authenticity of materiel or its compliance with manufacturer’s specifications” (SAE International, p27), is minimising the likelihood of non-conforming materiel entering the supply chain. Where it does enter the supply chain, Product Assurance and other elements of AS6174 are designed to facilitate early detection. The standard proposes four elements of any Product Assurance process (SAE International, p27):

  1. Documentation & Packaging Inspection – effectively a review of supplier documentation to trace the history of the product and to review the packaging to confirm it meets expectations around conformance with manufacturer’s specifications. As with all fraud prevention processes, the suggestion of verifying the received documents against the source through means such as confirming the accuracy of serial and batch numbers, is raised.
  2. Visual Inspection – this involves examining the product using various scientific techniques and conditions for the presence of identification markings or traceability indicators.
  3. Non-Destructive Testing (NDT) – involves a variety of tests including radiological, acoustic, thermographic and optical techniques to check the product confirms to specifications without actually destroying or using the materiel itself.
  4. Destructive Testing (DT) – involves analytical chemistry techniques, deformation and metallurgical tests, exposure tests, and functional tests.

Obviously, the performance of some of the above requires access to specialist equipment and / or knowledge (such as details of manufacturer’s markings applied to help prove the authenticity of a product), which may be beyond the reach of some consumers. In this case, businesses in Australia may consider it worthwhile engaging a NATA Accredited laboratory to perform such testing on their behalf. One key principle of AS6174 is that the design of any framework to minimise and / or detect non-conforming parts be risk-based, informed by the likelihood and consequence of a non-conforming part being introduced into the organisation’s supply chain.

Determining Counterfeit Risk

AS6174 suggests that the steps taken to minimise counterfeits in the supply chain, including the extent to which Product Assurance is undertaken, should be driven by both the likelihood and consequence of any “non-mitigated counterfeit item” (SAE International, p13). This means, for example, that greater steps should be taken to prevent counterfeiting in relation to a helicopter engine part than say a ream of paper in the office. The risk rating from this exercise dictates the “degree of traceability required” for that part in the supply chain.

The first element of any counterfeit risk assessment should involve considering the Likelihood, or probability of counterfeiting in that product, industry or market. The guidance provided in AS6174 on how to do this is scant, and does not consider the nature of the counterfeiting threat and the attractiveness of counterfeiting a specific part or materiel to fraudsters or organised crime. In a typical security or fraud management context, the risk assessment is preceded by a Threat Assessment, which identifies potential threat actors (e.g. insiders, organised crime), and determines both their Capability to counterfeit the product or materiel and their Intent. This step, which is missing from AS6174, is in my opinion critical to the risk assessment process for any case where the risk is caused by criminality of a human.

In the absence of performing a threat assessment, it may be possible to rely on informal feedback from others, such as industry groups, competitors or customers, but the quality of their advice is reliant on the processes and tools available to those parties to identify and understand the threat. Given that fraudsters and criminals are financially incentivised to engage in counterfeiting due to the low likelihood of being caught, yet alone detected, it is important to remember that history is not a reliable predictor of the future, and that just because something hasn’t happened before does not mean it will in the future. In my experience, all to often these less mature, ad-hoc approaches to understanding threat provide a false sense of security and may mean risks such as counterfeit parts in a supply chain are not detected because people aren’t looking for them, as opposed to them not being there at all.

One other interesting part of the risk assessment relates to “long term materiel availability” (SAE International, p15) or steps to be taken when a manufacturer stops making something. As part of any Anti-Counterfeiting & Product Protection strategy, manufacturers or Intellectual Property Rights (IPR) Holders will typically perform some degree of market surveillance, to understand where their products are being sold, who the vendor is, and for how much. Market surveillance enables early identification of counterfeit and unlicensed product (e.g. parallel imports) and a facilitates a timely legal response. As products become ‘obsolete’, manufacturers often re-allocate market surveillance and IPR enforcement capabilities towards new products. However, this creates opportunities for sub-standard materiel to enter circulation. Products deemed obsolete by the IPR Holder but which retain their after-market value or are subject to consumer demand in a particular region (e.g. developed versus developing markets) can still be subject to counterfeiting, meaning in these cases market surveillance programs may need to become more targeted rather than ceased completely.

Sources

DISCLAIMER: All information presented on ForewarnedBlog is intended for general information purposes only. The content of ForewarnedBlog should not be considered legal or any other form of advice or opinion on any specific facts or circumstances. Readers should consult their own advisers experts or lawyers on any specific questions they may have. Any reliance placed upon ForewarnedBlog is strictly at the reader’s own risk. The views expressed by the authors are entirely their own and do not represent the views of, nor are they endorsed by, their respective employers. Refer here for full disclaimer.