Tag: Conflict Minerals

Where does conflict minerals fit into your broader 3rd party GRC strategy?

The GRC Pundit BlogPublished onLeave a Comment on Where does conflict minerals fit into your broader 3rd party GRC strategy?

The 3rd Party GRC market is the fastest growing segment of the GRC market.  The pressures are many: social accounability/international labor standards, quality, environmental, health and safety, privacy, informaiton security, credentialing, code of conduct, geo-political and operational risk.  An organization's vendors, suppliers, outsourcers, agents, service providers, contractors, consultants, temporary workers . . . it is hard to understand where the organization starts and stops.  The extended enterprise of today is a complex, distributed, diverse, and dynamic organizations that requires risk and complaince oversight.

One of the most significant challenges bearing down on many organizations is conflict minernal compliance.

Organizations approaching conflict mineral compliance can take several paths leading to varying degrees of program maturity.  Mature conflict mineral compliance is an integrated part of a broader governance, risk management, and compliance strategy. It requires a top-down view of conflict mineral risk that is understood in context of enterprise risks. It also means bottom-up participation where business functions identify and monitor risk and suppliers that expose the organization. GRC 20/20 has developed the third Party GRC Maturity Model to articulate maturity in conflict mineral compliance processes in context of broader third party governance, risk management, and compliance. 

  1. Ad hoc and document centric approach. Organizaitons at this level of maturity do not understand risk and exposure to conflict mineral issues.  The organization addresses conflict mineral compliance in a reactive mode and does not invest in technology for compliance and utlizes documents and emails by the thousands to get the job done.  This leads to a mountain of information requiring significant time to reconcile and report while introducing errors and omissions.  It never produces a defensible audit trail or chain of evidence of how assessments and documents were completed and reported upon.  This leaves the organization into exposure as their compliance program is riddled with flaws waiting for the auditor or regulator to pounce upon. There is limited ownership or monitoring of conflict mineral compliance, and certainly no integration of compliance information and processes. 
  2. Fragmented approach focused only on conflict minerals. Here the organization is fragemented.  Conflit mineral compliance is a defined program but operates independently of other programs monitoring risk and compliance across third party relationships.  The organization most likely has seen the value of technology and utlizes it to address conflict mineral compliance. In the broader scope of things conflict minerals is a siloed initiative operating indepentely of others such as social accountabiltiy, quality, environmental, health and safety, and anti-bribery and corruption across the supply chain.  The requirements are being met and the reports made but the organization is inefficient, ineffective, and certainly not agile as it has redundancy in approaches to third party oversight as information and processes are highly redundant and lack integration. 
  3. Integrated approach to conflict minerals as part of social accountability. The integrated stage of conflict mineral maturity is when it is understood in the context of social accountability.  The goal of conflict minerals is to address human rights violations.  This stage of maturity sees conflict mineral compliance moving beyond a compliance initiative to being an integrated part of the values and ethics of the organization and is lived out actively through the code of conduct throughout the organization and its third party relationships.  The organization has an integrated approach to not only address conflict mineral compliance but also child labor, forced labor, working hours, wage/hour, health & safety across its supply chain. The organization has developed consistent and integrated processes to manage assessments, audits, communicate policies, deliver training, report, and remediate.  Technology enables this and ensures that items are done and that the integirty of the organization is protected. 
  4. Aligned third party governance, risk management, and compliance program. In the aligned stage the organization has a cross-department strategy for managing third party GRC.  Here the organization is thinking holistically across governance, risk management, and compliance issues impacting third party relationships.  As the integrated stage sees conflict minerals in the context of social accountability, both are now managed consistently across other third party GRC areas such as anti-bribery & corruption, quality, environmental, health & safety, security, and privacy in third party relationships. The organizaiton has an integrated third party GRC platform to manage the range of these topics while delivering consistency in policy communication, training, assessment, audit, and remediation in third party relationships.  Suppliers and other third parties are relieved as there is a consistent approach and the burden of responding to multiple items in different formats goes away.  The organization benefits from removing the cost of redundant processes, forms, assessments, and approach but also gains the value of an integrated view of the integrity and health of thrid party relationships in the context of performance.
  5. Optimized as part of  an enterprise GRC architecture. At the optimized stage, the third party risk program – and with that conflict minerals – is part of the fabric of a broader enterprise GRC architecture.  As the Aligned stage brought the value of understanding third party risk and compliance in context across third party risk and compliance domains, the organization at the Optimized stage sees and understands third party risk in context of enterprise risk.  This allows for a holistic approach to a 360º conextual awareness.  The organization understands its risk and compliance posture in the context of business objectives, values, risk boundaries, and strategy.  The intricacies of third party risk and how they impact other risks such as financial, reputational, strategic, and operational are understood and managed accordingly.

How Do I Achieve Effective, Efficient, & Agile Conflict Mineral Compliance?

The GRC Pundit BlogPublished onLeave a Comment on How Do I Achieve Effective, Efficient, & Agile Conflict Mineral Compliance?

The specific obligation of the Conflict Mineral Rule is to gather information about the use and source of 3TG in products and report to the SEC (and on the organization's website). As with other significant regulations with a far reach (e.g., Sarbanes Oxley), there is a lot of confusion out of the gates. This includes misconceptions and failure to scope a program that will stand the test of time.
Organizations are best served to define a supplier GRC program and framework to address Conflict Mineral Rule requirements that will be effective today and into the future. The goal is to establish a process that meets or exceeds requirements and reduces risk exposure in a dynamic and distributed business environment. A successful supplier GRC program that addresses conflict mineral requirements is:

  • Effective. Organizations need the program to be effective in meeting requirements as well as reduce risk exposure to the organization.
  • Efficient. Developing processes that are efficient reduces both financial and human capital costs in meeting requirements and governing supplier relationships.
  • Agile. Organizations require agility in supplier governance as it operates in an ever-changing business environment – regulations and requirements change, the business itself changes and new products are developed, and the supply chain is in a constant state of change.

To be effective, efficient, and agile in supplier governance with a focus on conflict mineral compliance program requires a framework that has the following elements supported by process and technology:

  1. Ownership. At the end of the day someone needs responsibility to ensure that the conflict mineral compliance program is functioning and meeting the obligations and reducing risk exposure. This role needs executive sponsorship, as the organization will have to certify the reports it submits putting the executives and board on the line in regards to their fiduciary responsibilities.
  2. Collaboration. While the organization needs someone to lead the conflict mineral compliance program to ensure that it is both designed and operating properly, there are many departments and roles that need to be involved in the program. This includes supply-chain management, procurement, corporate compliance & ethics, legal, risk management, business operations, and audit. A cross-functional committee of roles and departments involved should be established to ensure that everyone is on board and working as a team.
  3. Policies, Procedures, & Training. The cornerstone of any compliance program is policy. In the case of conflict minerals this starts with the organizations code of conduct with a statement regarding the organization's ethics and values in relation to human rights within its operations and across supply-chain and third party relationships. This gets reflected in the supply-chain code of conduct that suppliers have to acknowledge and adhere to. Further detail on expectations, boundaries, and responsibilities is spelled out in related policies and procedures. Training is critical both internally to the organization as well as with the supply-chain so that everyone is on board and understands what is expected of them. Suppliers need to be informed of expectations and obligations as well as understand the process for compliance.
  4. Understand the organization's products. Product filtering is the cornerstone task for making conflict mineral compliance effective, efficient, and agile. The organization needs to catalog its products and the materials used and determine which ones contain 3TG. This is done to define the scope of the detailed assessment and reporting requirements. Proper scoping of products impacts the effectiveness and efficiency of the program as the organization has to track down the source of 3TG that are used in them. Scoping products correctly directly impacts the organization and suppliers burden in compliance.
  5. Assessment. The majority of conflict mineral compliance work is in the assessment process. Here the organization compiles self-assessment surveys/questionnaires to send to its suppliers. Each supplier that is involved with 3TG minerals in products needs to be sent a self-assessment survey to attest to the use and source of 3TG in those products. The challenge for organizations is to drill down deep into the supply-chain to get to the smelter and mine that the minerals came from. Organizations can send self-assessments to their direct suppliers and then require that these suppliers send self-assessments to their downstream suppliers until the original country and source of the mineral is discovered. Or the organization can insist that their suppliers inform the organization of their downstream suppliers and the organization can send assessments itself down into the depths of the supply chain. This becomes a tricky area to navigate: at many points the organization may have to rely on the attestation and information provided by suppliers finding it difficult to navigate past them to the source of the minerals. The key is to keep a watch for inaccurate and misleading information. Intelligence, intuition, and insight are needed to ensure that the organization has taken 'reasonable' steps to identify the source of conflict minerals.
  6. Due Diligence. If the organizations determines that 3TG in products is sourced from DCR or adjoining countries the next step is due diligence. The due diligence expectation is to determine if the minerals sourced from these countries are connected with armed militias. The organization needs to determine how the minerals are moved and controlled. It is expected that the organization will have to put greater oversight and control over the logistics of minerals from these countries to ensure that these groups do not profit militias known for crimes against humanity.
  7. Audit. An important element of conflict mineral compliance is the requirement to have the Conflict Mineral Report audited. Organizations need to leverage their own internal audit staff to ensure the integrity of the report, information collected, and the process for compliance. However, the requirement is to have the report audited by an external auditor. The goal of internal audit is to provide assurance and find issues for the organization to resolve before it gets to the external auditor. Both internal and external audit will need complete access to assessments and due diligence efforts to conduct their audits. Onsite inspections of suppliers should also be expected.
  8. Reporting. The primary deliverable of conflict mineral compliance is the disclosure forms that are reported to the SEC and put on the organizations website. At a minimum organizations have to file a Form SD. Organizations that have to go further and develop a Conflict Mineral Report to accompany Form SD are those that cannot provide reasonable assurance that 3TG is conflict free and have to go beyond reasonable inquiry to suppliers to a structured due diligence process that is audited. This requires the integration and analysis of all the previous collected information so that the organization can build these reports and executives can attest to accuracy.
  9. Remediation. The end game of conflict mineral regulation is to reduce the use of 3TG sourced from facilities connected to human rights violations and bring greater awareness to human rights violations connected to the militias involved with mines and smelters in the region. When issues are found, the organization is to work through the supply chain to remove these facilities and cut off funds to militia groups in the region of the DRC and their crimes against humanity.

Growing Risk Exposure in Business Relationships

The GRC Pundit BlogPublished onLeave a Comment on Growing Risk Exposure in Business Relationships
This is part 1 in GRC 20/20's series of posts on Conflict Mineral Compliance and broader 3rd Party GRC . . . 

No company is an island unto itself: organizations are a complex and diverse system of business relationships. Governance, risk management and compliance (GRC) challenges do not stop at traditional organizational boundaries. Organizations today struggle to identify, manage, and govern risk and compliance in extended business relationships as they stand in the shoes of their vendors, partners, suppliers, and other third parties. Business partner problems are the organizations problems that directly impact the organization’s brand, reputation, and increase exposure to compliance matters. When questions of business practice, ethics, safety, human rights, corruption and the environment arise, the organization is held accountable, and it must ensure that business partners behave appropriately. 

Organizations need to understand business relationships in the context of the risk and compliance  issues that impact operations and the brand. The challenge before organizations is: “Can you attest to the status of risk and compliance across the organization’s extended business relationships?”  The head of procurement, for example, is often left considering supplier risk during on-boarding of a relationship but has inadequate resources and experience to effectively monitor risk ongoing.

Managing risk across third party relationships is particularly cumbersome in the context of constantly changing regulations, relationships, employees, processes, suppliers, strategy, and more.  Risk, regulatory, and business environments are in a constant state of change. The business needs to be consistent in its GRC processes across business relationships as well. Manual spreadsheet and document centric processes are prone to failure, as they bury procurement and other areas of third party business relationship management, in mountains of data that is difficult to maintain, aggregate, and report on.  This consumes valuable resources trying to figure things out instead of actively understanding and managing third party risk and compliance exposure.  

Third party relationships — supply chain, value chain, vendors, service providers, outsourcers, agents, and contractors — cannot be left to themselves. Risk across these relationships must be monitored and managed. Business relationships must comply with regulatory requirements, corporate and regional cultures, codes of conduct, statements of social responsibility and sustainability, policies, risk limits, controls, and other business practices. Organizations need to actively demonstrate an in-compliance status throughout their extended business environment.

Managing 3rd party risk is a particular challenge in the context of conflict mineral compliance requirements across the organization’s supply chain.  Organizations need an integrated approach to manage the entire supply chain exposure to conflict minerals.  This requires a framework to manage supplier risk, conduct assessments, gather supporting information, report and analyze, resolve issues, and monitor a supply chain that is constantly changing.

In the next few weeks GRC 20/20 will post more articles in the Conflict Mineral series. . .