What Compliance Teams Miss About Third-Party Risk

Someone set fire to a Kimberly-Clark distribution warehouse in California, caused $600 million in damage, and livestreamed the whole thing. The part that got less attention: he didn't work for Kimberly-Clark. He worked for a third-party logistics company they'd hired. Kimberly-Clark had a supplier code of conduct. They had compliance standards. They'd commissioned third-party audits. And it still happened. That's the reality of third-party risk management — you can build a solid program and still get blindsided by something you couldn't have predicted. But that doesn't mean programs aren't worth building. It means they have to be built well, and most aren't. In this episode, host Bill Coffin sits down with Emily Miner, Director on the Data & Services team at Ethisphere, to talk about where ethics and compliance programs fall short on third-party risk — and what strong ones actually look like. Emily draws on her work evaluating E&C programs across industries and her deep involvement in Ethisphere's World's Most Ethical Companies assessment process. They cover: Why third-party risk management tends to be less mature than other E&C program elements — and what that gap looks like in practice How E&C should be involved across the full third-party lifecycle, from due diligence and onboarding through ongoing monitoring and offboarding Why 90% of FCPA enforcement cases over the past 15 years have involved a third-party intermediary What supplier codes of conduct typically miss — including a lack of specificity in key prohibitions, weak enforcement language, and treating the code as a checklist rather than a values statement What companies like JLL and Microsoft are doing right in their third-party codes Emily also discusses her article, "What Makes for a Good Third-Party Code of Conduct?" published in Ethisphere Magazine. Link below. Read Emily's article: https://ethisphere.com/magazine/what-makes-an-effective-third-party-code-of-conduct/ Learn how Ethisphere can help you measure and strengthen your ethics and compliance program: https://ethisphere.com/solutions Subscribe for new episodes every week on YouTube, Spotify, and Apple Podcasts. Follow Ethisphere on LinkedIn for more on ethics, compliance, and what it means to do business with integrity. Chapters (00:02:17) - The Kimberly-Clark warehouse fire and what it reveals about third-party risk(00:08:30) - What E&C teams are most commonly trying to manage through TPRM(00:13:57) - What third-party codes of conduct tend to miss or underemphasize(00:21:42) - Wrap-up and where to find Emily's article