Understanding E-commerce Risk

Internal Auditor, April, 2001 by David Mcnamee, Sally Chan

At a time when companies are conducting business at the speed of thought, it is prudent for internal auditors to keep risk management in their thought process.

IN A RECENT TELEVISION commercial, a small group of employees is huddled around an office computer. The person at the keyboard raises his arm and pointedly strikes the enter key. Everyone waits, staring at the computer screen and holding their breath. "Click," and the first sale registers. The employees issue an audible sigh of relief. Then "clickety-click" as more sales register. The small crowd cheers. Then the counter spins wildly as tens of thousands of sales are registered. Without a spoken word, expressions change from elation to panic as the small group realizes that they have just been buried by success.

The advertisement holds a powerful message for internal auditors: Without adequate planning and risk management, even a successful e-commerce project can wreak havoc and ruin. There are several issues for internal auditors and managers to keep in mind when developing an e-commerce risk management plan. Three critical areas are customer expectations, reputation, and information integrity.

CUSTOMER-EXPECTATIONS RISK

E-commerce is a high-speed marketing channel. With each sale comes a customer expectation that the order will be filled accurately and that the product will be of high quality. In the blink of an eye, sales demand can overwhelm a support and service function that is not properly scaled to meet it. Customer-expectations risk is the very real threat of failing to provide advertised or expected customer service. The consequence, illustrated so vividly by the television commercial, is that the business will lose customers and ultimately fail if the support and service functions are not properly matched to the new marketing channel.

Quality customer service has always been the trademark of highly successful companies, and the e-world is no exception. When customers send e-mails, their level of expectation to receive a response is the same as waiting for a return phone call. The company's challenge is to respond with a personalized message within the same day, even the same hour. Unfortunately, current reality often doesn't match expectations. In a survey of 60 top e-tailers by e-business magazine, Business 2.0, 18 percent of e-mail inquiries went unanswered, 72 percent of the customer service representatives took no action or provided no further assistance, and nearly 25 percent of orders arrived late.

Added to the challenge of fulfilling customer expectations is the accelerated rate of change. Relationships tend to become more temporal in an e-commerce environment, and long-term brand loyalty is harder to sustain. Customer-expectations risk will surface in those companies that fail to sense and respond to changing expectations as or before they occur.

The internal auditor should monitor projects under development and assess as high risk those with the potential to affect customer service and support. Audit management should assign staff members with an understanding of both marketing and information systems to these high-risk projects. Questions to raise with project developers, in addition to those about normal system controls, include:

* How does this new marketing channel affect our finished goods inventory and distribution logistics?

* Do we need to make adjustments to our procurement process and materials inventory to reflect a higher speed of customer order and delivery?

* Will our new process be dependent on a sole or primary service provider? Remember the effect of the United Parcel Service strike on e-commerce.

* Will we have enough telephone lines and data ports to handle increased customer traffic?

* Will a sufficient number of trained customer service representatives be available by the time the system is running?

* Do we need to make any advertising changes -- including on public Web sites -- to achieve a coherent customer interface?

It is clear from reading the business news that e-business is the most competitive form of marketing. With no restrictions as to time or place and complete information available to all customers, those e-commerce companies that falter on customer service are bound to fail quickly.

REPUTATION RISK

Damage to a company's reputation can erode customer goodwill and devalue brand equity. Meta tags -- indexing information placed on a Web site to make it more readily accessible by Internet search engines -- have added a new dimension to reputation risk. Companies can use meta tags to imply affiliations that don't exist. For example, a small company can use meta tags to embed a large, established company name or product in its Web site. "When an Internet search is performed for the large company, the small business will appear among the search findings. The small business will further benefit by having it appear as if its practices are tied to the more established company's name.

A search for the Royal Bank Financial Group on About.com, for example, yields links to shoppinglist.com and eBay.com, both of which cite themselves as Royal Bank's "search partners." Shoppinglist.com greets users with the headline: "Final sales and coupons for Royal Bank at stores near you." Another click at AltaVista.com and the following phrase appears: "Set your own price for Royal Bank at uBid.com." Royal Bank Financial Group's reputation may be at risk. Did the bank authorize these Internet companies to be associated with them? Are there any legal implications to these tags? The danger is that one visible mistake or public embarrassment created by these so-called "search partners" could cause immeasurable damage to Royal Bank's name.