hello everybody and welcome to this live on Surface now webinar so our topic for today is the changes in the supply risk regulation and how organizations can really prepare for it so today joining me Islam from servicenow I'm Stephen Graham program thank you for being here so bully Hospital service now since 2019 in multiple Sales Management roles and is now responsible for the risk portfolio here in the dark region and Stephen uh is a privacy and compliance consultant and apart from being an attorney he's also a fellow at the center for internet and human rights and my name is James dick I'm a sales manager at rangu so just before we start um a few household things so we are recording this session and the recording will be shared with you after the session um we have a short question and answer um section in the end so ask our experts here in the room and but please feel free to already ask those questions in the Q a section which is on the bottom of your screen so with regards to the agenda so we will start with um with Stephen and Stephen will introduce us to this supply chain regulations that are already in place supply chain regulations that are about to come so for example the German supply chain due diligence act and also explain a little bit what that will mean for organizations going forward then I'll have a little discussion with Uli about so how what does that mean for our customers what do you see with your customers and really make it all very tangible I think um third point is that we're gonna show you how a solution on service now looks like so it's a solution that is using so it's now standard risk management and service Mouse irm together with a solution package that we built for the supply chain due diligence Act and as I said last but not least there is a chance to ask your questions and with having that set I would like to hand over to Stephen please Stephen take it away and tell us a little bit about what that lens date looks like yeah super well thank you for that uh kind introduction Jenny I want to begin kind of just by laying out the context and and the landscape or due diligence obligations in the supply chain I'm looking at the EU as well as the United States of course at the moment you know much of the focus is on the German supply chain due diligence act that comes into fours at the beginning of next year for large companies but it is by no means the only law in place so in 2015 to start with um kind of this modernization and due diligence in the supply chain we had the United Kingdom enacted modern slavery act in 2017 Fran uh published at the duty of vigilance in 2019 the Netherlands introduced their child labor due diligence act and then there is a scattering or fragmentation of laws that cover many aspects of due diligence in the United States and you know at the beginning of this year we had the publication of the draft EU due diligence law so something to look towards perhaps at the end of this year or early into the next year and really um and no I'm going to look a little bit into these other laws before turning a little more in depth into the German law because the juvenile really provides a comprehensive scope for organizations you might not be in one of these other countries but are looking also towards the future of compliance with with due diligence in the supply chain and so I wanted to go a little bit uh in depth into these other laws because the scope of application is different as well as the areas uh that are are being regulated so again this UK modern slavery act covers uh companies who meet a certain monetary threshold so who have annual turnover of 36 million or more pounds and Supply goods and services in the UK the expectation there is that organizations will publish an annual statement on steps to deal with modern slavery in the supply chain and so that's something that we will go back to when we look at the German law there's a reporting and documentation aspect of that law French Duty and vigilance law on the other hand applies to really large companies so companies in France with 5 000 or more employees or companies that have a branch in France and have 10 000 or more employees worldwide and there is a similarity between the French law and the German supply chain law in that it's bifurcated and covers both areas of Human Rights and environmental risks and requires the risk assessment and implementation of a risk strategy and again publishing that strategy and kind of giving notice to the broader community the Dutch child labor due diligence act on the other hand doesn't have a monetary or employment threshold and applies to all companies that sell goods and services in the Netherlands but the scope of application is really narrow covering child labor um as the law suggests and we have um but I want to mention also in in the Netherlands there is an ongoing discussion over a broad due diligence block and similar to the German law that would expand that scope of coverage even further to companies with 250 or more employees as I've mentioned in the United States the framework is really kind of fragmented focusing piece-med meal on certain areas uh of coverage so for example what we could forced labor prevention act covers products and services that originate in xinjiang in China there is a rebuttable presumption that uh that those products and services are are prohibited from entering the United States we also have an executive order on well the United States has an executive order on child labor and uh just this this year the Securities and Exchange Commission published a proposal on climate related reporting for investors kind of trying to create a standardized metrics um for for investors around sustainability to kind of Channel funds towards those types of projects so similar to what we see in the corporate reporting a financial reporting directive forthcoming as well in the EU and speaking of another law that is forthcoming in the EU we have this direct draft directive on on due diligence again this was published at the beginning of this year and would uh broaden the scope if we are thinking about the German law from uh 3 000 employees you know to to companies with 500 employees uh and annual turnover of 150 million in Euros or companies with 250 employees with 40 million uh in annual turnover coming from high impact sectors uh like textiles and and Forestry I get this EU law again uh would have a bifurcated focused on on human rights and environmental impacts so before we turn to the the German law just want to you know kind of make this case that it's uh more than just German companies who have to uh comply with the law but this law can serve as a really good model as we look towards the future in the EU likely in the United States while also making that business case of the importance of complying with a sustainable uh initiatives so turning to the German supply chain due diligence act it comes into Force at the beginning of next year January 2023 four really large companies companies with at least 3 000 employees and this will likely affect the 900 companies at least directly that at the beginning of the following year that scope of application expands uh with the threshold limit being lowered to companies with 1 000 employees where those companies directly affected uh would be sit somewhere around 5 000 companies and other states in the heads these are only the companies that are really directly affected because you can imagine that other companies also have to do something similar to be able to provide their services or products to those larger companies right yeah that's right we see this um distinction in the law between uh for example direct suppliers and indirect suppliers and those companies having an obligation to that parent company in Germany so we have this scope of direct application um as as Jenny and I have suggested uh but nonetheless there is also this form of self-regulation where these companies are going to be policing in some sense their supply chain and and uh the another thing because we have some International attendees today also uh so far as I understood the law it's not only for German uh customers or companies it's also for international companies with subsidiaries in Germany and when they hit the 3000 employee life right yeah that's uh that's exactly right so it's not just those companies with their administrative headquarters in Germany it is also as it has suggested those companies with branches and subsidiaries in Germany who hit that employment threshold and the purpose of the law again is really to think about and incorporate human rights and environment Environmental Protection into an organization's entire supply chain and so we kind of had this carrot or stick mechanism of course on the one hand it is um it is really worthwhile for businesses to present themselves sustainably um because you know we have this emerging idea of conscious consumers uh individuals want to put their money towards uh Brands products and services that they think are um you know in some sense facilitating uh social good but on the other hand we also have employees who want to work for companies who are also you know working towards sustainable uh initiatives initiatives to make the world a better place and really to invite individuals value in the work that they do with that said there are also penalties so we have the fines uh listed up to 8 million uh Euros for really large companies um and then there's kind of a piecemeal of fines depending on what provisions of the law uh are violated and if you reach a certain threshold then there is also the possibility to be well no not the possibility you'll be also excluded from public contracts um So within the German supply chain law there are a number of uh due diligence obligations that are really laid out um really nicely really clearly there's nine or ten uh depending on on how you on how you count them um and they begin with you know this creation of a risk management uh system so I'm gonna highlight what you see on the screen at the moment is kind of trying to lay out or I'm not trying to lay out it is laying out a comprehensive way to comply with those due diligence obligations um within our our product that Jenny will demo for you in just uh just a moment but nonetheless I will I will talk you through uh kind of the ideas that go go that have informed um how we've how we've looked at developing uh um this this due diligence product um and so you know it really begins with looking at like the life cycle of your of your supplier so beginning you know with that supplier uh selection process um and assessing those risks and doing this in a really broad manner so beginning looking at uh the risks of the geographic location um so for example many companies get products and services uh from China China had that no covet policy which really made it um you know kind of created a bottleneck that we saw during that coded period and that organizations that need to be able to Pivot um quickly to identify uh suppliers who can supply them with those products and services that they need to reach those end consumers so from looking at that Geographic risk then we look at tiering potential suppliers potential and actual suppliers to create this and look at this distinction again between these direct and and indirect suppliers um because as I've mentioned there are differing obligations as it relates to to these organizations from there we look at the individual supplier assessments so really drilling down on that company that supplier uh that vendor to see how they manage their human rights and environmental risks and then putting in place those contractual assurances to ensure these organizations are also complying with your organization's human rights and environmental initiatives then we have the basic risk management and Analysis thinking about the probability of violations the severity of the consequences and the degree and ability to influence these uh these suppliers from that um from that beginning supplier selection aspect and we think about preventive measures um to as it suggests prevent any um violations and limit the risks uh throughout your your supply chain um and that starts with issuing a policy statement and and the the German law lays out what specifically needs to be within that within that policy statement identifying those priority risks and then having this mechanism of training employees and suppliers to comply with those programs and I've come across actually um quite a lot of companies that do that supplier training that help their suppliers as well to be compliant with it because yeah I guess it's an obligation for you but um then you at least can make sure that your supplier again does the right things too for those trainings it's pretty important yeah yeah and building those relationships is uh yeah as you suggested that are really important and it creates an understanding what's going on I really can't completely and allows you to work with those companies and those organizations to facilitate a program that works um really uh on both ends from those preventive measures you know there are instances of violation so then we think about remedial actions um so if violations are discovered for example in your own business area uh in Germany you have to put those um immediately to to an end um and then there are differing aspects of response depending again if it's a direct supplier or an indirect supplier um the obligation is often not to end that business relationship but really to try to work with those organizations um to stop those violations and mitigate those those possibilities and then there is also the requirement to implement a complaints procedure you know we can be organizations can only do so much about creating in kind of an understanding of what's going on in the supply chains the complete procedure really gives a mechanism for employees foreign for suppliers to create a holistic uh understanding around risks and violations uh Andrew and rights and environmental risks and then lastly there is this opportunity for organizations who have to document what they are doing throughout the year so kind of this idea of know what's going on in your supply chain and then be able to show it in these reports in this documentation it has to be published annually um and made available at the end of four months after the end of the financial year and this is a again another example for organizations to kind of in some sense Market what they are doing around around sustainability yeah I love that you call it an opportunity because I think it is I think most especially the consumer market for example you'd rather work with somebody but also to be business of course with somebody you know is doing the right thing and and when a company already is uh impacted by this law or this supply chain due diligence act they can't work with anyone who does not comply yeah yeah yeah exactly exactly and so again I think this kind of this the German law really gives you a holistic skill to look at managing due diligence obligations uh throughout your supply chain um you know even if you are outside of the of the country and you know it's also important to keep in mind uh Forest suppliers and German company definitely great well thank you very much for this week and really appreciate that um I think that gives everybody hopefully a very good understanding of that there are quite some obligations that um yeah all organizations now have to meet actually so um really what do those regulations really mean for our customers for for companies right now not in Germany but also outside Germany of course so yeah so so first of course um we have right now from Stephen okay they need to comply by first of January so the bigger ones and threshold right now is three thousand employees right uh next year or the year after next year and 24 it's coming down to 1 000 so many many uh companies are impacted uh we already spoke about International or subsidiaries of international companies so to be honest we got the first inquiries from outside Germany where customers asking hey where for subsidiary in Germany what is with the supply chain utilities Act was what does it mean for our subsidiary Germany how can we work here with and especially we talk about big accounts big companies with thousands and ten thousands of vendors and suppliers so how should they manage and handle all this uh my answer at the end of course it's a digital solution you need a solution to manage all this because we are in a very complex supply chain World everyone is connected around the whole globe and you need to know also your not only your tier one but also afterwards the tier 2 and Q3 going on and get transparency what happens there and what I also experienced since we have all these crisis beginning with the pandemic then we have the Ukraine war in Europe very strong the energy crisis now which is a broken supply chain is a disruptions in the supply chains and this is also what customers are caring for on the end to be honest much more the one thing is to become compliant the other thing is how can I keep my business up and running uh when I need supplies from all over the world and Logistics is no longer work yeah cost aspect of that as well yeah because yeah what was it I think organizations say that they estimate that the broken supply chain can cost the religion up to 180 million dollars per disruption so that's but a lot of money to yeah to not invest in it and not try to at least map the supply chain as good as possible get opportunities to offer Alternatives and all of that so do they do companies think about that Financial impact too now of course of course we are from the Bonsai you met with the fines uh on the compliance side but shutting down a factory for example uh not able to deliver products or to sell products because of a growing supply chain this is our company our customers much more and they need and this is a sea level topic right now and they need transparency what happens in the supply chain and they don't need an assessment like they did over the past years quality how does my vendor perform based on price reliability and so on and they needed in real time now yeah they want to see what happens How Could An shutdown somewhere in Asia impact my own business yeah on the on the supply chain side but also on the market side yeah this is at the hottest line currently with our customers so not only optimizing supply chain but also having that Brazilian is the supply chain to be able to react if something goes right so um but it's very difficult of course to get that Insight in the supply chain I mean it's you guys figure out um it's like 10 000 20 000 or more suppliers that companies have so how could the best do that so how do companies deal with it now for example what do they do of course I I work in college for transformation company so we helping customers to get this transparency to get uh and fuel on their supply chain and together with partner like you rangu and Uber an excellent solution based on our vendor risk management and uh integrated risk management tools and I think we will get some insights on the solution afterwards but uh the sheer amount of vendors you can't manage this without a digital solution and of course we have something uh which helps our customers yeah because very often is a point in time right I mean we had that conversation I think it's 11 continuously monitor their suppliers which is yeah it's just because it's such a big effort I think to do right and and you need to uh help your procurement departments your CEOs and so on and to stay productive and uh on the one side we have Bellows but on the other side the threat in the logistic and supply chain and you need to help them to stay productive and as you're saying of course we have a joint solution we have developed a joint solution actually that is built on servicenow's vendor risk management on the integrated risk management and on a um if you want to content success pack um for the supply chain due diligence act and let's just talk through it because it's kind of around what's even said earlier of course the whole process that you have to follow with uh the legislation coming and the first thing is of course that you need that transfer transparency what does my supply chain look like you know your first your direct suppliers you normally know but under that it's already getting quite difficult and if you then have an obligation to even look further down in the supply chain is getting more and more difficult of course yeah and sometimes our customer finds out that the third or fourth here uh they have this uh no backup anymore yeah and then it's the same vendor yeah products to volunteers exactly so the raw material provided for everything in the end yeah exactly so um the thing that we have to develop is actually really following those steps that Stephen laid out so the first thing is that we assess our direct suppliers on business criticality because we care more about those that are really crucial to our value chain in the organization or us or a specific supply chain than the one that might deliver pencils to us or something because it's also much easier to find a replacement for somebody who delivers pencils but if it's something that is really crucial to us as a company we need to know that so that is really the first thing to assess that internally so who are really my business critical suppliers and then we can of course communicate with those suppliers because Services Vendor Portal actually gives you the ability to then send out questionnaires digitally to those suppliers ask them to provide more information or some Travelers some information for example and what we've done is that based on the outcome of that first hearing assessment you get different questionnaires that are sent automatically to those suppliers because you don't want to bother that pencil supplier with uh 50 000 questions but you want to make sure that the business critical ones are really answering the questions that are important to you as an organization and important for you to be compliant yeah and and the good one is we speak about digital questionnaire not on PDF sentence and attachment via email and then you get something handwritten back uh no we talk about the digital world yet exactly exactly and the other thing that we're also capturing in it is who are actually your suppliers my supplier so I'm asking that supplier so but who supplies those services or Goods to you so that already gives us more insight in what does the supply chain onto these look like that's really documenting that and giving you that audit Trail about you to see where you've been and you know where you are going exactly exactly because that portal also then gives you the ability to um as an internal person in the organization as a Vendor Manager to flag any issues and that can be also automatically for example it might be that because I'm dealing you were talking about geographical risks because I got a sub supplier that is working in a specific Geo I might raise a risk already yeah it might already be a bit more critical I'd have to have to look at it so I can flag all those things or they can be flagged automatically and I can ask my supplier again digitally to kind of react to it I can work with the supplier as they said we have to work with those suppliers to really solve any possible issues or to make sure that they know what they have to do make sure that they have to change a policy maybe or make sure that specific controls are in place at this as well yeah in the user interface it's also pretty nice it's easy to understand for everyone so it's not very complex and not a very complicated this is I think it need to be easy also for for both sides for for the supplier but also for me as a responsible guy in the procurement uh definitely because it's a lot of effort that is coming to companies so we have to make sure that it's as easy as and um then when we're talking about um risk there are of course also organizations and companies that provide data already so provide insight and risk ratings of companies um so for example in Terrorist has something like that big side is valuable information but there are also loads of Open Source uh pages that show us risk up to you Graphics or specific Industries in specific countries and so we can actually use that to enrich the data that we have about us with bloggers and and the guys like in Heroes for example you mentioned it are easily to be connected to service now so it's out of the box available yeah exactly and then of course apart from the process that we support with our solution with the joint solution we also brought in actually the regulation itself because um from a compliance perspective we now have of course to measure do we comply with regulation and that is for example do we as an organization have the minimum wage policy do we have a gender equality policy um carbon neutral so how practical policies you know there's all kinds of things that we have to do internally as well and by bringing that into the integrative risk management module we can then really measure compliance with the um corporate due diligence act actually I would say we have also in german yes yes definitely um but the names of course really long so yeah and of course um transparency and we talked about that before very important the different stakeholders in the organization need to know what's going on in real time need to be able to drill down so we have new roles head of sustainability and so how do those people really get inside so we have loads of different dashboards where they can see possible violations can zoom in and yeah and this is really what uh also receivable laughs dashboards to see where I am where I am today so it's real time and uh by fingertip you can drill down on the different vendors different risks what's popping up and human sustainability manager for example and this is also the first step so the the whole law also gives customers a first step to do a proper environmental and social governance management called ESG where we as service now has a so everything connects to each other yeah to manage your suppliers that you are proactive if something happens so for example all that data that we then capture in the solution also gives you the ability to have the data for your annual report available so what Stephen was talking about uh April you have to provide a report if you already capturing a system what kind of if you had any violations what you have done and you have 100 audit trial with it you only need to get it on paper or publish it on your website as a company and you got everything in place and the other thing is if then really a crisis happens in case something happens I want to know which of my suppliers are really affected by that and that's where we're going to bring in or where we're bringing in business continuity management actually because if there is an event and that can be all kinds of external feeds that come into the system we know exactly what suppliers are affected we know we need to notify we know who can be our alternative suppliers for that and we can really have a very quick reaction to it and make all of that really actionable so then you can solve two topics one is this compliance thing with the due diligence act and then the other one which is disruption of Supply chains uh great love to see this cool so um that was just an overview of how with servicenow's um Federalist management integrated risk management and our supply chain solution from right Google how we can then really help you to manage the risk of the supply chain in a very effective and efficient way so um we're of course very happy to have further conversations with you so please just Reach Out and now it's time for questions do we have any questions the audience let me just check this one so please feel free to ask any questions and if there are no questions right away um I would say please reach out to us we're very happy to have further conversations to have more in-depth conversations of what we can do for your specific organization um yeah believe Stephen anything from your site from my side I think uh what I saw uh based on our Solutions and products we have excellent solution which helps customers to overcome challenges with on one side the law but on the other side also everything what happens uh with all the crisis around us uh thank you for this uh thank you for inviting me also and it's a was a great pleasure for me yeah we do have time and we have the question if the solution is available yes the solution is already available so we can show this in much more detail and yeah so I hope that answers the question and we have another question here the due diligence Slide the penalty for public contrast was not within the scope could you please explain why I think that's a question for you Stephen yeah um let me I'm just trying to get the other set in the duty slide that the penalty for public contract was not within the scope could you please explain why I'm so I think perhaps this is referencing that that threshold where there's the exclusion from public contracts and so you know there are particular fines that relate to the the due diligence obligations uh within the law so you know if you don't have like a risk management system in place okay the bind is at a certain threshold if you don't have it conducted your risk analysis again a certain threshold if you haven't done it on an annual basis okay you have a fine of a certain of a certain level and that threshold where there's the exclusion from public contract is 175 000 Euros um so you know when you aggregate all of those fines and it adds up to that then there's the exclusion from from public contracts so it could be there very quickly yeah or rectified within a certain time okay you are being fined um further and further okay interesting that's an interesting one yeah thank you and I think one interesting really interesting aspect too to highlight about this this German mall is really the the scope of the human rights obligations you know it's really expanding um what how we are thinking about about human rights you know access to clean water clean air this is all really falling under that stove of Human Rights and there's things that we need um to to put to yeah to proliferate to continue to live a happy and healthy life um for now and you know into into the future and I think that's a really interesting and another approach from the German Regulators actually a very nice way to I think finish the discussions it's something we really need to yeah for the future so I think um yeah I hope um that was an interesting webinar we were able to give you a bit of insight on what's coming but also how we can really help you so and of course happy to talk with you if you have any further questions or interest also in the solution and the irm and we are and our ESG products and so on so uh please please don't be shy we want to pick up this reach out to anybody here on the panel or reach out to your service now account manager and yeah yeah thank you very much for your time today bye