You Can’t Manage What You Can’t See: Traceability as the Foundation of Supply Chain Risk Management
GENUTRACE INSIGHTS SERIES
This article is part of GenuTrace Insights, an ongoing series exploring the forces reshaping supply chain traceability, risk and compliance, featuring perspectives from GenuTrace's team and expert contributors.
2026 has been a hell of a year for supply chains. From record-breaking weather events across the world, to economic instability, increasing sanctions, conflict and physical risk; we have seen a huge range of threats affecting businesses and the networks they rely on. And sadly, it is unlikely to be over.
As physical, social, environmental, economic and political risks increase and become more interconnected, understanding your supply chains is becoming critical to business resilience. It is no longer enough to understand what could go wrong within your own four walls. Businesses need to understand what is happening across the networks they depend upon, and how those risks could affect their people, products, operations and bottom line.
Risk assessments are fundamental to business resilience. Imagine any major business or organisation that didn’t have a financial risk assessment or risk register?
They would not get very far. Supply chain risk assessments, particularly around ESG issues, have grown significantly over the last 20 years. Regulation has accelerated this further, requiring many businesses to identify, assess and report on risks within their supply chains. But the world in which those assessments are being conducted is changing. The risks businesses face are becoming more complex, interconnected and unpredictable. Climate change, geopolitical instability, conflict, resource scarcity, changing regulation and social risks can all affect the same supply chain, sometimes at the same time.
This means businesses need to move beyond simply identifying whether a particular ESG risk exists. They need to understand where they are exposed, how different risks interact, and what those risks could mean for business continuity. None of this is possible without reliable visibility.
You cannot manage risks you cannot see
Most businesses conduct some form of supply chain risk assessment, whether demanded by law, required for financial due diligence, requested by stakeholders, or embedded into sustainability and risk management processes. However, the quality and depth of these assessments can vary considerably.
Many businesses have limited visibility beyond their tier-one suppliers, while the range of risks assessed can be restricted to a relatively small number of ESG criteria. In some organisations, ESG risk assessments are also conducted separately from other forms of business risk assessment, such as product safety, operational or
financial risk, because different departments own different parts of the process. The result can be a fragmented picture of risk.
A supply chain also needs to be understood as more than the finished physical product. Risk can sit within its component parts, raw materials, production
processes, transportation, storage, packaging and other stages of its journey to the shelf.
A study from McKinsey [1] suggests that only around 30% of businesses hold any data on their supply chains below tier one, with meaningful visibility into tier three and
beyond falling to just 2–6%. That is a significant business resilience issue: if something happens somewhere in your supply chain, how quickly can you identify
whether you are exposed, and where? Can you identify which products are affected? Which suppliers? Which raw materials? Which locations? Which customers?
And, critically, can you act before a relatively contained problem becomes a much bigger business disruption? This is where traceability becomes much more than a compliance requirement.
Traceability is the foundation of effective risk management
We already know that traceability and proof of origin are becoming increasingly important for regulatory compliance. Legislation such as the EU Deforestation Regulation and the UFLPA require businesses to understand and demonstrate the origin of relevant goods and materials, while other legislation like EUCSDDD and Canadian Bill S2-11and emerging requirements place increasing emphasis on supply chain due diligence, risk assessment and remediation.
But the value of traceability extends far beyond compliance. If you know where your goods, materials and inputs come from, you can begin to understand the risks attached to them.
If you know where they have been produced, processed, stored and transported, you can identify where disruption could occur. And if you have reliable, assured traceability data, you are in a much stronger position to respond when something does go wrong. The events of 2026 provide some useful examples.
You need to know where your products have come from
Take the outbreak of Salmonella in the EU and UK in summer 2026. Hundreds of people were diagnosed with Salmonella linked to egg and poultry products, with fatalities reported.
In a situation like this, traceability is critical. Businesses need to be able to identify the origin of affected products and understand where they have travelled through the supply chain. The more precise that information is, the more precisely businesses can identify and isolate potential exposure and stop the problem in its tracks.
The alternative for the business is potentially much wider disruption: broader recalls, more waste, greater investigation, increased operational costs and potentially significant reputational, legal financial consequences.
A similar lesson can be seen in the ongoing spread of Cyclospora in the United States. As of September 2026, more than 11,000 people had been infected, with almost 500 hospitalisations and two fatalities linked to the illness, according to the CDC [2].
The source was eventually identified as a specific lettuce imported from Mexico by one retailer, causing the business an array of damages.
Recently, consumer concerns about contamination and subsequent reductions in purchases of salads and fast-food products containing salad were estimated to reduce consumer spending by around $280 million [3] per month. This shows us that business risk does not disappear when the immediate source of a problem is identified. A crisis can create knock-on effects across consumer behaviour, operations, reputation, revenue and supply.
The better your traceability, the better positioned you are to understand your exposure, respond quickly and reduce the scale of the disruption.
Resilience isn’t just about responding to crises
Businesses need to take proactive and reactive action to risk. Traceability helps you understand where you are exposed. Risk assessment helps you understand what that exposure means and what you should do about it before it becomes an issue.
Consider the extreme weather being seen around the world due to climate change. This summer Europe and the UK have seen record breaking high-temperatures and drought, causing deaths, wildfires and infrastructure damage.
From a business perspective, the ESG risks associated with an agricultural supply chain in the UK might traditionally be assessed as relatively low compared with some other regions of the world. But what happens when extreme weather becomes more frequent or severe?
Crop growing and productivity can be affected. Working conditions can become more hazardous for workers exposed to extreme heat. Transportation can be disrupted. Longer transportation times can affect shelf life. Refrigeration requirements can increase as temperatures rise. Infrastructure can be damaged.
What initially looks like a climate risk can quickly become a worker safety risk, operational risk, product risk, logistics risk and financial risk, all of which are dangerous and costly to your business and everyone involved.
The same applies to water scarcity, flooding, wildfires, conflict, sanctions and geopolitical instability. A risk occurring hundreds or thousands of miles away can ultimately affect your ability to source materials, manufacture products, transport goods or meet customer demand.
From reactive risk management to proactive resilience
Reports from King's College London [4] suggest that climate change could cost global supply chains up to $25 trillion in damages by 2050, with immediate environmental risks imposing costs of up to $120 billion annually. The OECD [5] has also estimated that productivity falls by 0.3% annually due to rising temperatures. Both of these eventualities are significant threats to business.
And while it is tempting to think that climate change or other ESG risks primarily affect sectors such as agriculture, food and beverage, fashion and textiles, almost every supply network relies on two fundamental things: water and human labour. Both are increasingly affected by environmental and social change, and no supply chain is completely isolated from these risks.
The question is therefore not whether businesses should assess ESG risks. It is whether they are assessing them deeply enough, across enough of their supply chain, and in a way that connects them to wider business risks.
What does good supply chain risk management look like?
Firstly, businesses need reliable traceability. Not simply a supplier declaration or a spreadsheet showing where a product is supposedly from, but traceability that has been tested and assured. You need to know whether you can trace products and materials through your network, identify their origins and understand the different stages they have passed through.
Secondly, businesses need deeper and more dynamic risk assessments. These should consider the ESG risks within the supply chain alongside the wider risks those issues create for the business, including operational, financial, product, logistical, geopolitical and reputational risks. Those assessments need to extend beyond tier one wherever possible, because you cannot properly assess a risk if you don't know where it exists.
The business resilience opportunity
Investing in traceability and supply chain risk assessment can therefore be seen as an investment in resilience, rather than simply another compliance cost.
Risk assessment isn't about predicting the future perfectly, it’s about understanding where you are exposed, identifying where risks could intersect, and reducing the cost of being surprised. If you don't know where your supply chain is, you don't know where those risks are. If you don't understand those risks, you cannot proactively manage them.
Businesses that want to remain resilient in an increasingly uncertain world need to invest in both: better traceability of their goods and materials, and deeper, more comprehensive risk assessments of the networks they rely upon.
The question is no longer simply whether you can comply; it is whether you know enough about your supply chain to be prepared when the next crisis arrives, or avoid it altogether?
If this raised doubts about your own supply chain's gaps, don't wait for an outbreak, sanction or storm to force the answer. Closing the gap between what you assume
and what you can prove doesn't take a multi-year program. It takes one honest conversation about where your visibility ends.
References
1 McKinsey & Company, Future-proofing the supply chain. https://www.mckinsey.com/capabilities/operations/our-insights/future-proofing-the-supply-chain
2 CDC, Cyclosporiasis Outbreak Investigation, July 2026. https://www.cdc.gov/cyclosporiasis/outbreaks/07-26/index.html
3 The Independent, Cyclospora survey on US household salad-buying habits. https://www.independent.co.uk/news/health/cyclospora-cyclosporiasis-salad-survey-us-households-
b3039075.html
4 Kings College London, Climate disruption to global supply chains could lead to $25 trillion net losses by mid-century. March 2024 https://www.kcl.ac.uk/news/climate-disruption-to-global-supply-chains-could-lead-to-25-trillion-net-losses-by-mid-century
5 OECD, The Heat is on: Heat stress, productivity and adaptation among firms.
https://www.oecd.org/content/dam/oecd/en/publications/reports/2024/12/the-heat-is-on-heat-stress-productivity-and-adaptation-among-firms_07b86e8b/19d94638-en.pdf
ABOUT THE AUTHOR
Bex Hall is an international expert practitioner in sustainability and human rights, specializing in international legislation, supply chain due diligence, and human rights due diligence. She runs her own consulting and coaching practice, working with organizations worldwide to design and implement effective programs, set and achieve goals, and embed regulatory compliance.
With 16 years of experience, Bex has founded, designed, and led a successful global consulting team, and continues to bring her expertise to wider audiences through public speaking, guest lecturing, and thought leadership. Her clients span national governments, SMEs, and FTSE100 companies across agriculture, health, fashion and apparel, manufacturing, chemicals, FMCG, and finance. She has guest lectured on human rights due diligence and sustainability at institutions including the London Stock Exchange, Columbia University, and the Chartered Institute of Procurement and Supply Chain.
Website: https://www.bexhallsustainability.com/l
LinkedIn: https://www.linkedin.com/in/bex-hall/
ABOUT GENUTRACE
GenuTrace's mission is simple: move companies from marketing claims to verified reality with independent, science-based traceability, origin verification, and risk assessment and due-diligence solutions built to withstand scrutiny.
No greenwashing. No guesswork. We bring the science. The data. The strategy. You bring the supply chain.
GenuTrace combines forensic testing, digital traceability, and strategic consulting to deliver real clarity and control over complex supply chains.
We don't just test. We design and help to build tailored systems around your materials, your risk profile, and your goals. It's the question we ask in every episode of the GenuTrace Insights video series: If you claim it, can you prove it?®
