Ukraine crisis demands sharp focus on third-party risk management

The escalating military tensions between Russia and Ukraine have highlighted the importance of location in third-party risk management, according to Victor Meyer, COO at Supply Wisdom, a supply chain risk intelligence firm.

For some sectors, such as aviation, there are significant and direct exposures in Ukraine from the closure of Ukrainian airspace and pulling of aviation insurance coverage in the country. According to risk consultant Russell Group, this is a particular problem for Ukrainian operators and low-budget airlines with routes in the region.

For the majority of companies though, exposure to Ukraine is less obvious and typically focused on supply chains and third parties. These risks have been exacerbated by a global supply chain crisis that has been two decades in the making and stripped out any excess capacity in terms of services and physical supply chains, according to Meyer.

“This has made supply chains more brittle and the focus has been almost exclusively on cost and efficiency. There has consequently been less focus on risk and even less on locations,” he said during a webinar focused on the geopolitical challenges for third-party risk management in Ukraine.

“The move to lower-cost locations almost always exposes companies to heightened risk of natural hazards and political instability. Locations matter as well from a concentration of risk [perspective], if a greater number of critical services are based in that location,” he added.

Back in 2014, when Russia annexed eastern Ukraine and the Crimean peninsula, there was far less transparency on supply chains, said Meyer, who at the time headed up third-party risk management for Deutsche Bank. “It was somewhat of a surprise what our exposure was and I don’t think we were alone in that,” he said.

“We encountered service disruption as a result of staff not being willing to come in, and not only exposure to suppliers in Ukraine but also one in St Petersburg in Russia. And when we looked at their backup sites, they were located in equally exposed areas in eastern Europe, so it required a massive onshoring of those activities back into the US, which took several months,” added Meyer.

Energy is at the nexus of current exposures to the Russia and Ukraine crisis, said Meyer. Europe has a dependency on Russian gas, which provides close to 40% of its supply, in comparison to the 5% that comes from the US. However, Russia has other markets. It exports hydrocarbons around the world that provide vital foreign currency reserves. Russia is also heavily aligned with China.

Ukraine is also the biggest country in the EU by geography. It has the largest uranium reserves and second largest of iron ore, titanium and manganese. It is also has the most arable land in Europe. There are a lot of resources and exports linked to the country.

There could also be an impact on neighbouring countries. For example, the geopolitical risk rating from Supply Wisdom for Romania has increased in the last quarter, from 4.8 to 5.30.

“If I was a chief security officer of a firm that had exposure to Ukraine, I would militate strongly to unwind that exposure because of the cyber risk alone,” said Meyer. “But there is a realisation that location risk needs to be taken into account, alongside cyber and financial risk.”

There are urgent steps companies can take that fall into the ‘identify, monitor and respond’ framework, continued Meyer.

This includes identifying suppliers and third parties operating in the region, as well as any fourth-party dependencies and identifying specific cities where subsidiaries or suppliers are based. Meyer advised firms to monitor these suppliers and third parties, and how critical they are to operations.

In terms of response, Meyer advised a restriction on all travel to Ukraine, paying close attention to changes in government policies and updating business continuity plans to establish alternative locations.

Mature firms are looking at these locations and have governance committees to evaluate the exposure and the concentration risk from specific locations on the front end, said Meyer. “So before they enter a new location, they are able to see how it impacts their current exposure. And then with a continuously monitored view, they are able to diversify away from an emerging risk before it happens,” he said.

“Of course there will be rapid-onset events, but you take so much risk off the table through a proactive approach,” he added.