Procurement Risk Management

Supplier risk is assessed at various points during the supplier lifecycle in order to identify and manage risks associated with the supplier.
For example, supplier risk assessments are completed with the relationship manager. During the assessment, risk scores are assigned. These scores provide guidance on whether risk mitigations are required.
The output of this activity feeds into Roche’s internal supplier governance structure such as account plans and may be discussed further at business and/or performance review meetings.
Roche leads special initiatives in collaboration with service providers to strengthen its proactive risk management capabilities. The most important programs are described below:

As a supplier, what can I expect?

• At qualification & onboarding, due diligence on a supplier is completed and it is at this point where the supplier relationship manager may need to request information from the supplier, for example; minimal amount of financial information to assess financial risk.

• The supplier relationship manager may need to discuss, agree on and implement risk mitigations with the supplier 

• Additionally the relationship manager may follow up on the progress of risk mitigation actions with the supplier

• Discussion and follow up on risk mitigating actions and risk scores at performance business and/or performance review meetings

Supplier risk is assessed at various points during the supplier lifecycle in order to identify and manage risks associated with the supplier.
For example, supplier risk assessments are completed with the relationship manager. During the assessment, risk scores are assigned. These scores provide guidance on whether risk mitigations are required.
The output of this activity feeds into Roche’s internal supplier governance structure such as account plans and may be discussed further at business and/or performance review meetings.

As a supplier, what can I expect?

• The supplier's relationship manager may reach out to the supplier to confirm supplier impact and may potentially need to obtain further information. For example, if there is a cybersecurity or data breach, further details on the impact would be requested

• For some risk events, stakeholder networks may need to be established to ensure a rapid response, as a result the supplier relationship manager would rely on your prompt cooperation to follow up on sharing information during a risk event

Business continuity planning can also be addressed during both proactive and reactive risk management activities. This activity ensures suppliers have a robust business continuity plan for critical activities in place and perform scenario testing to ensure plans are effective.

As a supplier, what can I expect?

• Your relationship manager may request findings from business continuity tests and rely on your openness with sharing corrective action/project plans, which address outstanding issues identified from business continuity scenario testing

During proactive and reactive risk management activities, the risk manager can nominate the supplier for a Supplier Sustainability Assurance Visit Audit. Read more about SSAV

The SSAV program aims to:

• Strengthen collaboration between Roche and its suppliers, regardless of the level of cooperation and division

• Minimize the risk of cooperating with suppliers not following legal obligations, or our core principles and values

• Meet the legal requirements of proper due diligence of our supply chain, in particular regarding sustainability aspects and human rights

High-risk suppliers are identified and scored through a risk-based assessment. This assessment evaluates both external and internal criteria:

External criteria:

1. Human Rights Risk uses risk ratings from respected external social and human rights risk indices such as KidsRights Index, Global Slavery Index, OECD country classification, and Global Rights Index

2. Other Sustainability Risk such as country CAHRA index (conflict minerals), Minamata, Basel and Stockholm convention status are considered to assess external sustainability parameters

Internal business criteria such as industry segmentation, spend, and audit history are also considered during the audit planning phase.

The risk assessment score determines whether or not a supplier is subject to an SSAV.

The SSAVs are performed by a third party service provider that has been added to the list of approved audit service providers according to the PSCI protocol. The process steps are described below and involve close coordination between Roche, the supplier and our third party audit service provider.

1. The external audit service provider contacts the supplier to start the audit planning process on behalf of Roche. 

2. The supplier receives

   • request to confirm some general information such as: company name, locations, services or products supplied to Roche and number of employees. 

   • a Self-Assessment Questionnaire (SAQ) - a template document to help suppliers prepare for the audit. This document contains all the questions that may be asked during the audit and the supplier must provide details and complete the SAQ to the external audit service provider.

3. The external audit service provider will propose an audit date and schedule it with the supplier. At least two weeks before the audit, the supplier should receive the audit agenda and the list of documents that may be required during the audit.

4. The supplier hosts the audit and the external auditor performs the audit activities. 

5. At the end of the audit, the external auditor presents the findings and the supplier must agree with them and propose the Corrective Action Plan (CAP).

6. The final report is prepared by the auditor within 2 weeks after the audit and sent to Roche and the supplier for final approval. 

7. The supplier must approve and sign the final audit report and implement the corrective actions to close the CAP. If there are critical or major findings, the follow-up audit will be planned according to the steps described above.

If the risk assessment score determines that the supplier is subject to an SSAV, the supplier will be contacted by the audit service provider and asked to cooperate.