5.12 Third-party risks, supplier assessment and audits

Risks due to failure to deliver by third parties such as suppliers.

Ports should identify and prioritize critical suppliers of goods and services that fundamentally support their core functioning. They can also devise their own strategies for determining who their critical suppliers or third parties might be. If the impact of a failure by a third party or a supplier is felt by the port, these can be deemed critical for the port and may entail risks for its business continuity. Critical third parties or suppliers can be identified and categorized by: (i) type; (ii) services rendered; (iii) goods supplied; (iv) volumes; (v) service levels; (vi) predictability of demand; and (vii) elasticity of supply.

A ports’ BCP should be integrated with that of third parties/suppliers operating within the port or its hinterland, together with critical third-party suppliers, such as those providing supplies to the port (e.g. cargo handling equipment or services). Ports also need to assess the adequacy of the business continuity processes of third-party providers or suppliers.

These should be considered as part of any contracting process by the port with a new supplier or a revised contract with an existing supplier, particularly when they are key to port operations. In all cases the maintenance of adequate business continuity procedures should be included within the contract, as well as the port’s right of to test them appropriately, either independently or as part of an overall port business continuity testing.

A third party could fail to provide equipment, parts, supplies or services for which it is under contract to procure. This can occur for several reasons, such as strikes by key contractors, regulatory closure of a supplier, or the inability of a supplier to maintain their supply and production capabilities. However, financial failures remain a common source of third-party risk.

An important step is to identify the most critical suppliers, particularly with respect to essential assets (e.g. cranes, IT systems), the expected level of service, and the frequency of third-party demand. Understanding the financial health of a third party is critical. It helps protect the port from a potential disruption and operational failure, as well as from a loss of revenue or the loss of a key third-party support service which could have a negative effect on the port being able to provide a service.

Should an event occur, the financial strength of third parties, e.g. subcontractors and suppliers, can also be an indicator of their robustness. Having substantial cash reserves enables these third parties to absorb the impact of a disruption event. In addition, they are also more likely to enhance the services they offer and support a port’s development through innovation.

Bankruptcy predictors can help assess the financial performance of existing and new suppliers or customers. One of the most widely used bankruptcy predictors is the Altman Z-Score. The Z-Score provides a well-established approach for assessing the financial health of suppliers and customers and requires only a moderate level of financial data. The Z-Score combines a series of weighted ratios for public and private firms to predict the likelihood of financial insolvency. There are several other financial ratios and approaches that ports may want to use to assess the financial viability of third-party suppliers. They could also use international service providers, such as DNB, Rapid Ratings and Creditsafe, to determine the financial viability of these suppliers.

These service providers tend to provide good cost-effective coverage around international public companies but have more limited insights for national private companies without supplementary service activity. A list of potential providers is set out in the section titled “Useful Resources” in the Annex to this guidebook. Furthermore, ports could have regional financial viability service providers to support the financial analysis and help obtain relevant data. For small ports and when resources are limited, a third-party provider is likely to be the best approach.

A third-party supplier audit or assessment should be conducted for critical suppliers and third-party providers before the start of the contract. For existing critical suppliers, these audits and assessments should be annual, or when significant concerns are raised. This is to ensure that members of a port’s supply chain adhere to sound business and legally compliant practices, as well conform with relevant requirements, including those relating to ethics, regulations, laws, business continuity and standards. In the case of ports, this would include relevant freight forwarders and transport partners, among others. Other instruments such as supplier strategies, supplier and third-party portfolio matrix, commodity or category strategies/risk plans, multiple supply sourcing, buffer or safety stocks are also useful in preparing for and mitigating potential disruptions arising from third-party or supplier failures.

Additional information about managing port supplier and third-party risks is available HERE.