RFID risk management: although there are many benefits to using the new RFID technology, careful thought must be given to the possible risks that come with it

Internal Auditor, April, 2005 by John Kopalchick, III, Christopher Monk

BUSINESS ENVIRONMENT RISKS

Issues pertinent to the current business environment include the development of a standard and open architecture or standard protocols, unknown costs, and return on the technology. Organizations such as the International Organization for Standardization and EPC Global are working on developing standards. Standardization is key to interoperability, or the ability of tags and readers from different vendors to communicate, which is critical for a high rate of adoption. As the adoption rate increases, more will be spent on research and development related to ultra-high-volume manufacturing processes, which will drive the costs of chips down even further.

The absence of common standards and interoperability poses a critical risk to organizations investing in RFID. Internal auditors can play a key role in assessment and identification of these key risks and monitor the business environment for changes that will impact their organization.

PROCESS RISKS

Once RFID becomes more mainstream, its vast capabilities will impact many processes that are currently handled manually, such as inventory replenishment and control, distribution, shipping, planning, and retail category management activities, to name a few. Transaction processing and validation will become more automated and need little-to-no human intervention. Real-time changes in production and distribution cycles will be possible.

At the same time, the technology's impact on current processes may not be understood, clearly defined, documented, or communicated throughout the organization, resulting in inconsistent execution and data integrity issues. All processes and exception processing affected by RFID must be considered, including handling receiving issues and returns--such as quantity, quality, and part discrepancies--and overages and shortages. Ultimately, these changes will have a significant impact on processes integrated with financial reporting systems, which will--at least in the United States--have to be addressed in the context of compliance and control efforts related to the U.S. Sarbanes-Oxley Act of 2002.

Business and information technology (IT) strategy around RFID technology, selection of RFID hardware and software, and process reengineering associated with RFID implementation may not be clearly defined or aligned with overall supply-chain and business strategies. The alignment of strategies, policies, processes, organizational skills, and related capabilities is a critical success factor when reengineering processes and implementing any major new system or technology. Information requirements for decision-making, measurement, and control, as well as supporting systems, tools, and data are also important. As in all major changes, the level of knowledge, buy-in, and commitment of the human participants determines most successes or failures. Therefore, training and staff acceptance are integral to the change-management effort.

In addition, strategy regarding controlled usage (all products/distribution channels versus limited scope) may not be effectively employed to balance infrastructure costs with associated revenue and benefits. The value proposition and scope of rollout or process automation may not be appropriately balanced and understood.