Staying ahead of the opposition

What do you do when you're facing a determined opponent; one inside your organisation intent on defeating and outsmarting any risk management and harm prevention controls you introduce?

I opened a talk to the Australian Institute of Food Science and Technology yesterday with the quote below from Vincent Doumeizel at Lloyd’s Register. It's a long quote but one that set the scene before I went on discussing ways how an organisation could respond to a food fraud incident

“In the next 50 years or so, in order to feed 9 billion people with a diet richer in calories, the food industry will have to produce as much food as we have produced over the last 10 000 years. The food industry is highly globalized and fragmented and by far the most complex supply chain with various sub-products, ingredients and streams. Transparency in such a complex supply chain is just a dream so far but, in the meantime, we are the first generation that really knows the risk of this food system, including emerging pathogens, growing antibiotic resistance, climate change, waters scarcity, deforestation and biodiversity degradation. Today’s consumers are savvy; they know what they want to eat and what is good for them.”

The quote describes an environment loaded with risks, including the potential of food fraud - counterfeiting, adulteration, theft, substitution - with profit motivations and the opportunity to commit fraud very obvious. As discussions covered yesterday, increased demand plus scarcity of resources and increased costs means food fraud is a very real issue in every country, affecting virtually every commodity and food product and most likely increasing in scale. The intentional nature of food fraud means that there will be a person (or group) designing and executing a plan to target a product to commit the fraud and they will be adapting to any counter-measures that producers and manufacturers deploy to prevent that fraud. This is the 'conscious opponent'.

It was very much front of mind for the food industry later in the day with reports emerged of fresh strawberries being laced with sewing needles; a number of which made it to market and were discovered by consumers. Reports almost immediately alleged that a disgruntled (ex-) employee was responsible.

Food Defence

Food defence relates to protecting a product from the intentional tampering or contamination of a food product to cause some type of harm whether it be a financial loss, public health issue or a degree of public alarm and reputational damage to a brand or industry.

A lot being done to ‘harden’ products to prevent counterfeiting, tampering and similar harms in the supply chain, however businesses need to remember the issues are similar to food fraud. Where there is potential opportunity and benefit (including revenge), fraud and other offences like contamination and tampering will be attempted and, unfortunately, will most likely succeed from time to time. Absolute prevention is near impossible to guarantee but risk control measures can provide a high level of protection to reassure consumers, regulators and the organisations themselves - think x-ray scanning of products and tamper-seals as well as simple measures as camera surveillance of production and packing areas.

The biggest issue you face with both food fraud and food defence is that you are dealing with a 'conscious opponent'.

What is the implication of having a 'conscious opponent'?

A 'conscious opponent' is essentially the 'brain' behind the attempt to intentionally contaminate, tamper with or otherwise affect the product. It is a person, or group, intent on executing a plan to circumvent the food defense measures (if any exist) to cause a harm through food recalls, reputational damage or public alarm. The 'conscious opponent' concept isn't unique to food defence and food fraud - it applies to all types of offences and 'harms' that require some level of planning and design to bypass measures intended to prevent the offence or harm.

The seminal work in this area of dealing with 'conscious opponents' in my mind is Malcolm Sparrow's "The Character of Harms" where he says that the 'conscious opponent' concept creates a number of challenges for risk managers:

1 - Reliance on probabilities and history isn't sufficient

Often risk assessment relies on historical data of incidents and contributing factors to determine the likely probabilities of recurrence and the subsequent need and level of intervention to manage that risk.

What you have seen in the past provides no reliable indication of what may occur in the future according to Sparrow in this scenario.

Sparrow encapsulates the difference a conscious opponent makes to the situation as the difference between roulette (with probabilities as the opponent) versus chess (with an adaptive human brain opposing you). You might identify the likelihood of a disgruntled ex-employee doing something but you're less likely to know when, where and how they might cause the harm and in fact they may most likely be looking for ways to ensure a 'surprise' element to their plan.

2 - Alternate risk management tools are necessary

Continuing Sparrow's chess analogy, the risk manager needs to be running their eyes over the chess board to identify possible attacks by the opponents and their own weaknesses to then devise their plan.

The exchange of information with peers (which can be difficult in commercial operations), establishing focus groups or 'tiger teams' to purposefully identify and target vulnerabilities as well as intelligence gathering activities to identify organisational and market issues and trends are important to be ahead of the conscious opponent. At a deeper level, debriefing offenders to better understand their motivations, behaviours and even other plans they considered but did not utilise as well as increased surveillance and even 'covert' informants is not unrealistic if the stakes are high.

3 - The way problems are defined, and success is measured, changes

In addressing one threat or vulnerability, it is not sufficient to rest on your laurels as a conscious opponent, including one that may not exist currently but emerges in the future, will be adapting to those measures. Risk management needs to be agile and adaptive themselves; one step ahead of the conscious opponent and have to avoid having a comfortable routine of risk identification, assessment and management.

4 - Managing 'values' in risk management activities

Risk management is normally a very transparent, inclusive and predictable process; especially at the point of implementing the management activities with a workforce. With a conscious opponent of course, being transparent can be self-defeating to some extent and can reduce the effectiveness of the measures. Sparrow provides the argument that to ensure effectiveness against conscious opponents risk managers need to operate with less transparency, a higher degree of unpredictability and randomness as well as have the ability to deliver unexpected 'shocks' to the system from time to time. This can challenge organisational values and social norms and requires balancing the erosion of those values against the need to prevent a particular harm. The maxim 'the end justifies the means' comes to mind to create an ethical question for those deciding which, and to what scale, values may be compromised. 

Evolution of risk management to deal with conscious opponents

By chance next week I'm presenting to government regulators and investigations staff on the factors that underpin non-compliance - why does non-compliance occur and how can regulators act to tackle those factors to try and prevent a harm; whether it is preventing a biosecurity or food safety risk or even more mainstream issues such as corruption, property crime, assaults that traditional law enforcement agencies normally deal with. With conscious opponents you are facing a potentially dynamic and adaptive person (or persons) who will examine the safeguards and measures in place to prevent the harm and look for ways to circumvent them. Risk assessments need to evolve to include more thought of how these risks can be managed and often adopting the thought processes of a 'saboteur' is necessary to look for how a conscious opponent could find ways to outsmart existing controls and cause a harm will be the first step in assessing what changes need to be made to protect the organisation.

Whilst the investigation into the tampering of the strawberries mentioned above is still in progress; it may not be unreasonable to assume that there were limited controls in place to prevent this offence or detect it before the product reached the market. Many larger producers do have x-ray scanning of product in place as this is an expensive option both in terms of the equipment required and the maintenance costs as well as the training of staff.

It means that they've accepted the probability of the risk even though the consequences are high. Traditional risk management approaches would possibly support that decision. Perhaps it is a measure more reasonable to be employed further along the supply chain in distribution centres or in a co-op situation where a group of growers combine to share the costs. This problem-solving approach is much more effective, especially when considering the agility needed to combat a conscious opponent, and it's one that organisations need to be considering.