Introducing the Supply Chain Risk Assessment and Management Toolkit
Authors: Jenny Wiegel, Pablo Siles, Luisa Claros, Jessenia Angulo, Andrés Charry, Nguyen Mai, Thuy Thanh Nguyen, Tiffany Talsma, Giacomo Celi.


The Supply Chain Risk Assessment and Management Toolkit, developed by the Alliance of Bioversity International and CIAT in collaboration with FMO and Mercon Coffee Group, has the objective of helping companies assess the risks of engaging with or endorsing unlawful/unethical practices in their agricultural supply chains, and defining adequate measures to prevent, minimize and mitigate their impacts. The toolkit groups risks in three major Areas: Labor, Human Rights, and Environment, which are further disaggregated in Sub-Areas and Components. Each component is paired with one or more Root causes that directly or indirectly influence the presence and magnitude of the risk exposure. The analysis is carried out at a Macro and Micro level, providing companies a contextualized, nuanced, and granular understanding of the challenges they (may) face, which will guide the development of tailored risk management strategies.

The toolkit is comprised of four different tools: i) Macro Risk Assessment, ii) Supply Chain Mapping Tool iii) Micro Risk Assessment and iv) Prioritization and Action Planning.

Macro Risk Assessment: This tool assesses the risk exposure of engaging with or endorsing unlawful/unethical practices in agricultural supply chains at a national level. The result of the assessment is a relative rating of risk exposure in the three risk areas, based on national statistics and other publicly available databases, indexes, reports, news, and similar sources.

Supply Chain Mapping Tool: This tool is designed to help collect and organize data on the company's in-country operations along its supply chain, as well as the importance of the target origin for the company's overall business.  This information is useful in considering risk mitigation strategies as well as for prioritizing among countries/origins.  

Micro Risk Assessment: This tool assesses the risk exposure of engaging with or endorsing unlawful/unethical practices in agricultural supply chains at a local level. The result of the assessment is a relative rating of risk exposure in the three risk areas, based on information available from visits to randomly selected farms coupled with interviews with farmers, workers, company personnel, civil society representatives and other local key informants.

Prioritization and Action Planning: This tool supports the process of prioritization and action planning for minimizing the risk exposure of engaging with or endorsing unlawful/unethical practices in agricultural supply chains, by providing guidelines and resources for facilitating relevant discussions among company personnel.      It combines the results from the Macro and Micro Risk Assessments with discussions of potential consequences of risks, and the efficacy of current mitigation strategies, for estimating a relative rating of risk exposure in the three risk areas. This information is used to guide the development of recommendations and action planning to prevent, minimize and mitigate risks.  

Each tool contains its corresponding instructions and is accompanied by relevant supplementary materials, including data collection instruments and templates designed to streamline the process of inputting and analyzing data.
All tools have been designed using generic terms to accommodate different commodities and countries, nevertheless, the team responsible for the assessment must review and adjust the instruments and files for the specific country and commodities to be evaluated (all the information on the suggested adaptations is included in each tool´s instruction section).






Supply Chain Mapping, Macro, and Micro Risk Assessments

The process starts with a macro-level evaluation, which includes a broad review of performance standards and root causes of different risks at the country level. By leveraging publicly available secondary data, this assessment allows for comparability and regular updates of information across diverse countries and commodities. It evaluates risks across three main domains: Labor, Human Rights, and Environment, further subdivided into 11 sub-areas and 55 components, each targeting specific unethical or illegal practices within the supply chain. Utilizing an Excel tool, risk scores for individual indicators and cumulative risk scores for distinct risk areas can be generated, enabling insightful comparisons among different countries and commodity supply chain´s.
If a company wants to prioritize origins for risk management interventions or quantify their risk exposure and capacity of control in a supply chain within a specific country or region, the Supply Chain Mapping tool provides a standardized framework for organizing and displaying key information. Combining the information of the Macro Risk Assessment and the Supply Chain Mapping tool can provide valuable insights on differential types of risk exposure and entry points for risk management. The Supply Chain Mapping Tool includes an Excel file for data collection and inputting, and a supplementary Excel file with a template for comparing multiple countries.


Figure 1: Flow of supply chain risk assessment


After selecting countries and sites for more in-depth analysis, the Micro Risk Assessment allows for a detailed and site-specific risk evaluation, validating macro-level findings, and enhancing the understanding of supply chain risks at a granular level, with a particular focus on individual farms and practices. For the Micro Risk Assessment, the team will conduct on-site visits, in-depth surveys, key informant interviews, and focus group discussions to identify operational practices, labor conditions, environmental impacts, and compliance with relevant regulations and standards, among others. The tool also includes a guideline for conducting a rapid GIS assessment for key environmental risks when the relevant geographic information is available. This thorough analysis provides an encompassing comprehension of day-to-day operations and practices at the ground level, elucidating their potential influence on the overall supply chain's integrity and sustainability. Some risks, especially unethical or illegal practices, may be well-hidden and challenging to detect at a macro level. The micro assessment's aims at systematically unearthing some of these hidden risks by combining multiple data sources. 
The Micro Risk Assessment includes a Word file with the general data collection guidelines, instruments and recommendations for data analysis, an Excel file for entering the field work findings and computing the risk scores, and a supplementary Excel file with an example of how to process and input the raw data from focus groups and other instruments.
Embracing Transparency and Collaboration

The Prioritization and Action Planning Tool constitutes the final component of the assessment process, integrating the information collected in the previous stages to inform and facilitate the development of a risk mitigation action plan. 
This final stage is initiated by identifying and prioritizing risks based on their severity, likelihood of occurrence, and potential impact on the supply chain. This is achieved by presenting and discussing the findings from the previous assessments with key company officials of relevant departments in a structured workshop. 
Derived from insights gained through company sustainability programs, labor policies, and focus group discussions among various departments, a set of mitigation strategies and measures is defined to preempt or minimize the negative consequences associated with identified risks for the prioritized risk areas. The tool includes suggestions of specific mitigation strategies and measures to facilitate this process, and additional optional sections to assign responsibilities to relevant stakeholders or teams, ensuring accountability and effective implementation across the organization. It aims at fostering a proactive and organized approach to address challenges, empowering every department to work cohesively towards supply chain resilience.
The Supply Chain Risk Assessment and Management Toolkit provides a step-by-step guideline that enables companies to develop a more proactive and systematic stance towards risk management, better decision-making, and alignment with sustainability objectives, positioning them for enduring success amidst an ever-evolving business landscape. 














Incorporating the Supply Chain Risk Assessment and Management Toolkit in the company´s Standard Operating Procedures

This toolkit has been designed to help strengthening a company´s risk management strategy, by providing a systematic approach for addressing risks of unlawful or unethical practices in their supply chain.

The different instruments in each tool should be reviewed and adapted to the company´s, procedures, origins, and supply chain characteristics. In particular, the Micro Assessment Tool has been designed to cover a wide range of risks and practices that may not be relevant in some scenarios, but we recommend keeping the structure and rationale of the methodologies and tools, as this will facilitate a consistent comparison and categorization of risks, a more robust and reliable risk identification, and a logical and conceptual flow which will facilitate internal and external communication.

The following suggestions are aimed at helping to incorporate and streamline the risk assessment and management process in the companies SOP:

Frequency of application: These tools have been designed to be applied in a reduced timespan, nevertheless, due to company´s time and resource constraints, its important to adjust the frequencies of application of the tools according to the nature of the information and the company´s needs. Below we provide some suggested frequencies of application and its rationale.

Supply Chain Mapping and Macro Risk Assessment: These two tools are closely connected and should be updated together. The information involved in the Supply Chain Mapping tools is continuously monitored by the company, making it relatively easy to collect. Nevertheless, The Macro Risk Assessment is a considerably more time-consuming process, which requires reviewing publicly available reports and indicators. Many of these indicators and reports are only updated once every few years, and since the results of the Macro Risk Assessment provide a general overview of structural conditions that should not vary in the short term, we recommend reviewing and updating the information of both tools every two to three years. 

Micro Risk Assessment: This can be the most time and resource demanding process in the toolkit, as it requires primary data collection, qualitative data analysis, and the scope of work can increase depending on the number of sites and producer typologies of interest. On the other hand, the instruments and data collection activities can be adapted and incorporated in other monitoring procedures, reducing the specific demand for this process.

The Micro Assessment aims at revealing risks of unlawful and unethical behaviors in the areas of interest, as well as conditions that increase the likelihood of these practices. These risks and conditions intensify in the short term in the face of external shocks, but the trends and structural conditions tend to be consistent in the medium term. 
Therefore, we recommend conducting this assessment every 12 to 18 months, adjusting the frequencies, sites, and relevant research topics according to the company´s demands.

Prioritization and action planning: The first iteration of the prioritization and action planning requires the results of the Macro and Micro Risk Assessments, but once the risk mitigation plan is under implementation, a more frequent monitoring of the actions and results is required.
We recommend a general review of the execution, challenges and outcomes of the action plan every 6 to 12 months, and conducting a rapid review and update of the risk prioritization every time a Micro Risk Assessment is completed. 

Knowledge management and internal communication: Risk management is a continuous and iterative process that requires the participation and perspective of various departments both at the origin and at global levels. As all relevant representatives can’t be available at every different stage of the risk assessment and management process, we recommend the creation of a steering committee conformed by one or two focal points at the origin and one focal point at the global level, which will allow a more streamlined flow of ideas and information between the teams. Additional information about the suggested roles and responsibilities of this steering committee is included in the Prioritization and Action Planning tool.