Risk management: ESG and cybersecurity

Summary

The supply chain and its associated industries are evolving rapidly in response to increasing containerisation, globalisation, consolidation, decarbonisation and other ESG developments. This is being accelerated by the decrease in agents in response to AI and the increased use of electronic portals. All of these issues create both opportunities and challenges for those in the supply chain industry. This ranges from the trader involved in international transactions, the carriers and their subcontractors to the underwriters of all of these parties. 

It is said that we are all becoming tech companies due to the massive changes being introduced by AI. Although AI falls outside the scope of this address, in brief, at this stage, it is mainly being used in two areas. The first is through cyber portals and automated processes that can simplify and shorten the time within which repetitive processes are carried out. This extends from purely administrative functions to the simple exchange of data between interested parties that results in the creation of contracts. The second is with large language models that are capable of analysing vast swathes of data to extract trends, risks and other issues that affect the industry and the management of risk. 

Because the rate of change is accelerating, companies that do not engage now in all of these issues, will become redundant. Those that are ahead of the curve will see massive growth and consolidation. This requires all companies to be alive to the forces that are driving change and, more importantly, to be able to analyse the risks created by those forces and mitigate those risks.

Eternal triangle

The fundamentals of international trade have not changed for millennia. All of them include the contracts that form the eternal triangle, being the contract of sale, the contract of carriage and the contract of insurance. To this triangle can be added that of the contract of finance which may affect all three of the underlying eternal triangle contracts. 

It is the contract of sale which determines the relative obligations of the seller and buyer. These in turn affect the contracts of carriage and of insurance. The contract of sale has to deal with all of the obligations arising out of an international transaction which includes the supply of the goods, their transport and their insurance. This contract has to deal with the passing of risk and ownership, payment, delivery, documentation and responsibility for subcontracting various aspects of the transaction.

Risk Matrix

All prudent members in the supply chain would be advised to draw up a risk matrix which is based on determining the risks from their own point of view. This may be from the point of view of the seller, the buyer, the financier, the logistics service providers or of the underwriters. Each of those parties will have a different perspective of the risk involved in that particular transaction. 

In determining their risks, each party needs to look at a number of features including: the nature of the cargo; the types of carriage/storage and distribution; geography; contractual relationship with the various parties; international conventions and local laws; costs; dispute resolution; and insurance.

Once these factors have been assessed, a risk matrix can be drawn up dealing with each particular party’s contract role in the contract of sale; logistics contract; finance contract; and/or insurance contract.

Incoterms mainly misunderstood

Apart from the contracts of carriage and insurance, one of the other significant legal regime that appears to be misunderstood or ignored, are the Incoterms. The Incoterms have been developed and updated every ten years by the International Chamber of Commerce. They are designed to be incorporated into contracts of sale for the international sale of goods. They are not designed to replace a contract of sale. They only deal with certain issues and this means other issues have to be dealt with in the contracts of sale, carriage and/or insurance.

In brief, Incoterms deal with:

• Determining when risk of loss in and to the cargo passes from the seller to the buyer (and possibly through intermediaries’ hands);
• The responsibility for arranging the contract or contracts of carriage;
• The responsibility for insuring the goods; and
• The responsibility for documentation and other import and export requirements.

There are a number of different Incoterms which are broadly speaking, divided into the so-called “wet” and so-called “dry” terms. Certain of these terms such as FOB, are simply not designed to be used for containerised trade, but constantly appear in contracts of sale relating to containerised cargo. There are numerous summaries of the various terms available and all that the buyer and seller needs to be alive to is that there are a range of Incoterms which would suit their particular needs. These range from ex-works where the buyer picks up the cargo from the seller’s warehouse and arranges and pays for everything required to transport it to the buyer’s premises overseas. At the other end, are the delivered terms, where the seller delivers the goods to the buyer’s premises.

Cybercrime the growth industry

Cybercrime is now the largest criminal activity in the world despite attempted competition from the narcotics trade. Many of the forms are simply electronic versions of “traditional” financial crime such as: multiple sales of single commodities; multiple insurance of single commodities; documentary fraud such as amending bills of lading; multiple bills of lading for a single commodity; under or over invoicing; and blackmail. The cyber portals have however allowed the development of other forms of cybercrime which include ransomware and malware attacks for financial, political or economic goals. 

We have a large international team dedicated solely to dealing with cybersecurity and receive instructions on a daily basis from national, regional and global companies whose systems have been attacked. 

Cyber risk management requires a risk matrix to be drawn up to assess every aspect of each companies’ exposure and take steps to mitigate that exposure. 
The International Maritime Organisation has provided guidelines on maritime cyber risk management dealing with every aspect of maritime transport from bridge systems, machinery management, passenger servicing to communication systems and crew administration systems. 

The guidelines provide a number of steps to assist in developing awareness and countermeasures.  These are: identify the threat; identify the vulnerability; assess the risk exposure; develop protection and detection measures; establish contingency plans; and respond to a cybersecurity incident.

Conclusion

Space and time constraints mean that this talk does not address issues such as social governance and environmental issues, but these have become as important in many areas. One issue that all parties must be alive to when engaged in any part of an international supply chain is that they are not only governed by local law. A requirement by the EU to reduce carbon emissions will affect all companies in the EU and they in turn will pass on portions of that obligation to their suppliers in South Africa and those involved in the supply chain between South Africa and the EU. It is not enough, unfortunately, to be aware of the legislation in your own country. 

The reality is that urgent proactive steps have to be taken by everybody involved in the supply chain to ensure their survival in the face of an industry dealing with more and more risks every day.