Creating a ‘Risk-Aware Culture’ Through Contract Intelligence

By Vivek Bharti, VP of Product Management at contract intelligence company, Icertis

Managing business risk is a top priority for today’s companies. Risk can emerge from any part of a business and must be handled proactively to avoid devastating impacts. Often, these risks originate in an organisation’s contracts, either from an external party or the business and regulatory environment in which the entity operates.

However, most organisations still manage their supplier relationships, customer obligations, and regulatory compliance either manually or with tools that have limited capability. This leaves them without adequate visibility into their organisation-wide obligations and entitlements, resulting in difficulty identifying and handling risks.

The Challenges

Three main challenges arise in managing risk proactively, the first being today’s business climate. The volatility of the post-pandemic business environment leaves companies struggling to assess and manage risks to their business continuity, regulatory compliance obligations, financial stability, and more.

The second challenge organisations must deal with is the limitation of traditional tools. Most Governance, Risk, and Compliance (GRC) tools are not able to roll up risk insights from across business processes, and hence are good only at reporting and analysing risks in isolation and mostly in hindsight.

Finally, lack of visibility into an organisation’s obligations to its customers, suppliers, and regulatory authorities is a hurdle that must be overcome. Since most, if not all, of these obligations are enshrined in contracts, a limited view of an organisation’s contract details can lead to substantial risks for businesses—and even cause a catastrophic event if not surfaced at the appropriate time and monitored at an adequate organisational level. Far too many organisations do not have a unified view of their contracts, which hampers their ability to effectively manage risks inherent in their business relationships.

4 Key Areas of Risk

In some ways, it’s very easy to say where risk lies in your organisation: It’s everywhere! That said, drilling down we find that there are four main areas to look at within your business to understand most of the risk triggers and their consequent impact:

1. Procurement contracts and supplier reliability.Begin by looking at your supplier relationships and their contracts. Do they have all the terms and capability needed to address supply-chain disruption? This is especially important for companies that rely very heavily on outsourcing to fulfill customer commitment. Note: It’s not enough that these contracts fix who bears the impact of a supply-chain failure; a company must plan for alternative service or supply continuity so business can continue.
2. Sales contracts and customer profiles.Your customer profiles and contracts should also be examined. To manage risk properly, you need to know the credit-worthiness of your customers and how customers of a similar profile (industry, region, size) have performed against contracts. Based on that information, you can include the contract language needed to protect your company to ensure you receive timely payment.
3. Internal operations.Much of a company’s operation risk comes from the various obligations and entitlements that must be delivered to customers. There must be ownership for each step of the delivery chain. Assess your internal processes and also consider your industry and company’s regulatory compliance requirements. One must also design “risk sensors” to be embedded in internal governance processes. For example, frequent delivery breaches are often an indication of a supplier’s deteriorating capability to supply the committed volume/quality.
4. External environment.Typical risk-area examples include natural disasters, wars, social unrest in certain geographies, etc., that cause disruption to the supply chain. Keep a finger on the pulse of the areas where business is being conducted. This typically means having transparency into your full supply chain, not just tier-one partners.

Risk Management the Old Way

Most organisations, even ones that consider themselves risk-savvy, still use manual or stand-alone applications and isolated risk-management processes in their effort to mitigate risk. For example, an organisation may have a software tool that specialises in data privacy compliance, but which is used in isolation, not integrated with other applications or the rest of the business. Because point solutions do not span the enterprise or connect to other related business processes, these applications can’t adapt to fit your company’s unique needs or provide a holistic view of risk. When risk is organised as a separate function, it can’t serve the purpose of protecting your entire business in real time.

A New Approach – Creating a Risk-Aware Culture

Moving to a process that prevents the injection of risk organisation-wide will better protect your business. This means embedding risk assessment and mitigation in transactional business processes across the board and not as a separate task to be performed. Gaining participation from all stakeholders will form the basis of a successful risk-aware organisation.

Take the example of a supplier onboarding process where the supplier must first be qualified to do business with the organisation. It sounds simple, but multiple people and departments are involved in completing this process, all of whom must be aware of the potential risks of the deal and empowered to address them. With a traditional approach to risk, a supplier is registered, then the risk assessment process follows separately. The new approach delivers a process and system design that proactively assesses various aspects of risk (financial strength, quality of product/service, capabilities, etc.) during the registration process itself and blocks the onboarding if the risk assessment is beyond expected thresholds. Such intertwined process design creates the necessary pervasive risk-aware culture across the enterprise.

Advanced Technology Solutions That Can Help

How can companies achieve this level of risk awareness? It starts with contracts. Contracts define whom a company is doing business with and on what terms, thereby making them the single source of truth for third-party risk in an organisation.

Leveraging today’s artificial intelligence (AI) technology in combination with contract management software can provide extremely valuable visibility into risk and effective risk management capabilities.

Take, for example, cognitive detection, a powerful capability that can interpret intent. When reviewing contract redlines, AI with cognitive detection mitigates risk by helping you accurately pinpoint which of the proposed redlines could cause a deviation from your intended obligations, entitlements, or standard positions—thereby carrying material impact. This catches risk before it is injected into the business.

AI-infused negotiation playbooks are another powerful tool now available to companies. With configured playbooks, companies can identify which standard clauses need to be tracked for deviations. If a redline is made to one of these clauses during negotiations, AI technology can update the “risk score” of the contract based on the new language; meanwhile, the playbook can provide negotiators’ suggested revisions that can decrease the risk score.

At Icertis, we’ve built our contract intelligence platform with this advanced technology to automatically detect specific details, show risk trends, trigger associated risk processes, federate data, and more. Our AI-enabled Risk Management application brings a paradigm shift in the management of business risks, capable of adapting to any risk model in the world and driving actionable insights.

Moving to Proactive Risk Management

Managing risk proactively doesn’t happen overnight. But it is a journey well worth taking.

Risk assessment can no longer be a stand-alone process performed by a single risk specialist or even a risk management department. A risk management department can govern the process, but typically cannot effectively or accurately assess the entire business risk. Sharing the responsibility to manage the consequences of a risk event is key to preventing risk in the first place.

Start moving towards proactive risk management today by embedding assessment and detection into your core business processes so that it is unified across your organisation. A centralised, integrated, and intelligent solution will transform your business transactions by embedding them with risk detection and mitigation capabilities.

Seek out an advanced solution that is designed to run an embedded risk detection capability across your contract lifecycle management, procurement, sales, and governance processes. This will empower you to protect your organisation in a comprehensive, efficient, and highly effective way. Your contracts are the ultimate source of commercial truth, and identifying risks proactively based on what is enshrined in the contracts is the key to keeping your business out of harm’s way.