Foreign ownership, control, or ownership (FOCI) risk, also called jurisdictional risk, is the analysis of geopolitical tensions, national security requirements, export control regulations and critical asset protection that impact a supplier, product, customer or supply chain. Analysis of FOCI encompasses assessing the extent to which foreign interests can control or influence a company, its supply chains, and its third parties.   This scrutiny is crucial to safeguarding sensitive technologies, intellectual property, and infrastructure, as it helps identify potential risks, vulnerabilities, and conflicts of interest that could compromise national security or economic interests.   Here’s a comprehensive view of all the factors that make up FOCI risk.

Environmental, social and governance (ESG) expectations are rising across investors, consumers, regulators, and financial reporting bodies. However, most programs lack ongoing ESG risk monitoring and visibility into their upstream suppliers — who pose significant risks. Survey and self-reporting information-gathering approaches are slow, quickly outdated, and provide a biased and incomplete view upon which many key risk decisions are based.   Risk exposure multiplies at each tier within your supply chain ecosystem through the unknown reliance on sub-tier suppliers who might be involved in forced labor, experience data breaches or engage in poor environmental practices.   Learn more about ESG risk indicators and how you can proactively minimize these risks.  

This supply chain risk dimension covers reputational, criminal, and regulatory (RCR) risks across the supplier ecosystem.   Maintaining regulatory compliance across fragmented jurisdictions and through a wave of new compliance legislation, regulations and policies that govern how companies manage suppliers, supply chains and customers, has become incredibly challenging. Regulatory compliance failures can lead to fines, penalties or criminal prosecution and can be damaging to a company’s brand.   Whether or not these risks stem from your own operations or those of your supply chain, the impact to your reputation, brand and bottom line will ultimately be the same.   Find out more about RCR risks so that you can identify, assess and mitigate them ahead of time.  

Operational risk spans a wide variety of different categories, including geopolitical and geoeconomic risk, the climate variability impact on the physical location of an organization, counterfeits, and potential alternative suppliers. To prevent disruptions to you or your customers, it’s necessary to understand the operational health of all existing (and potential) suppliers and intermediaries in your supply chain. The scope of understanding should include company leadership, financial stability, compliance with regulations, hardware and software integrity, geographic concerns, and labor issues, among other factors.   Continuous monitoring of operational risk indicators from the following categories is key to reducing potential losses resulting from inadequate or failed internal processes or unexpected external events:  

• Hardware Counterfeit & Compromise Reporting
• Labor Issue Reporting
• On-Time Delivery
• Quality Metrics
• Mass Layoffs
• Corporate Restructuring
• Leadership Changes
• Liquidity Problems, Bankruptcy
• Noncompliance with Laws, Regulations
• Energy Scarcity
• Health & Safety Issues
• Facility Issues
• Product Quality
• IT & Business Process Certifications (like ISO Certifications)
• Financial Stability
• Data Breaches
• Software Integrity
• Alternative Suppliers
• Predictive Obsolescence
• Certification & Awards
• M&A Activity
• Sanctions

Cyber exposure from third parties is often not an organization’s fault, but they must deal with the fallout. Understanding how technology poses a risk to your organization requires understanding how technology could comprise your organization through vendors and suppliers.   Cyber supply chain risk management (C-SCRM) is a broad term that can encompass the cybersecurity of supply chains — in some cases, the supply chain is the vector of the attack, and in others, the supply chain itself is the target. Adversaries exploit the supply chain because it is efficient and effective in achieving their aims; these attacks will continue in volume, velocity and variety.   Learn more about the factors that make up cybersecurity risk, including what you should be looking out for in your supply chain.  

Product risk occurs when there’s a lack of transparency in your supply chain due to siloed data, incompatible systems across an enterprise, or the outsourcing of parts and raw materials. This results in the inability to monitor, influence and control n-tier supplier relationships as well as the components and material-inputs that go into your products — things like metals, electronics, plastics, chemicals and inactive or active ingredients. This can lead to a wide range of supply chain issues, including but not limited to: product recalls, late deliveries, lengthy lead-times, cost-overruns, unexpected supply disruptions and compliance violations.   The first step to mitigating long-term product risk is to map both the entities involved in the manufacture, assembly and distribution of them, as well the item-level bills of material they are made of. Using a variety of highly specialized methods to map product attributes and a plethora of public and private data sources, you’ll be able to uncover hidden tiers of supply, n-tier supplier dependencies, countries of origin, and lead-times at each node of an extended enterprise — empowering your efforts to lower product cost, improve service levels, comply with regulations, and mitigate risk. To mitigate product risk effectively, consider a solution that can help you forecast, monitor, track, and trace the following:  

• Material Input to End-Product
• Material, Processing, and Quality Specifications
• Lead-Times at Each Supply Chain Node
• Rare Earth Mineral Content
• N-Tier Dependencies
• Counterfeit Risk
• Part Compliance (REACH, ROHS, Lead-Free, etc.)
• On-Time Delivery/Recall History
• Quality Metrics
• Sole-Source vs Multi-Source
• Elemental Exposure