A defence maintenance contract in 1998 and a detained shipment in 2026 are the same problem. The procedure does not change when the domain does.
David Shillingford tagged me in a post this week about an article by Dr. Rizwan Manzoor in Supply Chain Management Review, on how forced labor, carbon reporting and supply chain due diligence regulations have turned risk management from a legal function into an operational imperative.
David’s framing of why this belongs to the COO and CSCO is the clearest I have read. Stranded inventory does not generate revenue. Stranded goods hold up production. Proof of compliance is becoming a condition of market access. And the regulatory slice of disruption cost is growing.
He then makes an observation most people will read past:
Most companies have separate teams and separate processes for assessing risk to their own facilities, direct suppliers, regulations, tariffs and emissions. This no longer works.
And he closes with an instruction:
Start where risk and impact are highest and work back from there.
That last sentence is the backward trace. He has arrived at it from supply chain risk; I arrived at it from a defence maintenance contract in 1998. Same starting point, different route.
So this post does two things. It takes his instruction seriously and shows what following it actually looks like. And it makes a claim I want tested rather than believed: the procedure does not change when the domain does.
The part that is not a data problem
David identifies “beyond direct suppliers” as the challenge and the unlock, and he is right that it is hard and takes years.
But there is a second problem underneath the first, and it does not get solved by better data.
Business Continuity, Risk, Legal, Trade, Sustainability and Procurement can all have access to the same information and still act on it through separate mandates, separate incentives, separate escalation paths and separate definitions of success. Shared data does not produce shared accountability.
Worse: if the data was collected inside the same predetermined boundary, five functions can share it and remain collectively blind. Stranded inventory, forced-labor exposure, embedded carbon and lost market access can look like four functional problems while originating in one operating relationship that nobody’s map contains.
How the trace actually runs
Here is the distinction that matters, and it is a distinction of starting point, not of rigor.
The designed map begins with the regulatory requirement. It assigns responsibilities, collects supplier declarations, builds a compliance framework and expects compliant market access at the other end. Every arrow points at the goal. It contains only what someone thought to put in it.
The backward trace begins with a shipment sitting at the border.
Not “improve supply chain compliance.” One detained container, and one question: what specific evidence failed?
That question does not stay in Trade. It pulls into Procurement, because the declaration came from somewhere. Beyond Procurement into the sub-tiers, because the input came from somewhere before that. Then across into Risk, Sustainability and Operations, because each holds a piece of the same relationship and none holds the whole.
⚠ And this is an illustrative hypothesis, not a diagnosis. A real trace takes one detained shipment, identifies the exact document or attestation that failed, and lets each finding determine the next question. The actual path might lead somewhere entirely different — which is precisely why it cannot be designed in advance. If it could be designed in advance, it would be a forward map.
This is not hypothetical. Here is one that happened.
In October 2022 an engine designed by the Austrian company Rotax — a subsidiary of Canada’s Bombardier Recreational Products — was found installed in an Iranian-made Mohajer-6 drone that went down over the Black Sea. EU sanctions prohibit the shipment of such equipment to Iran and Russia. Rotax opened an investigation.
I wrote about it at the time, and the question I asked then is the one David is asking now: how deep into the supply chain should procurement’s responsibility extend?
Trace it backward and the shape is familiar.
Illustrative traceback hypothesis. The 2022 post asked the question; it did not establish the path.
The sale itself was lawful — a commercial light-aircraft and recreational powerplant, not a controlled military item at the point of purchase. Title passed to an authorized distributor, and the obligation to know the end user stopped at a boundary the product did not respect. The dealer channel beneath it was built to move units, not to ask what a buyer intends to fly. Re-export through a third country can be individually compliant in the jurisdiction where it happens. And the regulatory frame itself attaches sanctions to the shipper and the destination, not to the component’s lifetime — so a lawful sale in year one becomes a violation in year three, and no record connects the two events.
⭐ Nobody did anything wrong at any single step. The sale was lawful. The distributor was authorized. The dealer was compliant. Each transfer reconciled cleanly on its own.
The exposure exists only in the relationship between a consumer sales channel and a dual-use capability — and no function owns that relationship.
That is four departures from the manufacturer’s own map: distribution, the dealer channel, a third country, and the regulatory frame. And note the loop on the right of the diagram — every unit sold into an open channel regenerates the exposure. It does not get resolved by the last investigation. It reproduces.
Why this is the same problem as 1998
In 1998 a national defence maintenance operation was delivering next-day parts 51% of the time against a 90% contractual requirement, and was about to lose the contract.
The forward map was obvious and everyone had it: order received → supplier sourced → parts ship → next-day delivery. Optimize that line and you get a faster version of 51%.
I started from the failure and asked a question that was nowhere on the map: what time of day do orders come in?
Four o’clock. And why four o’clock took the trace straight out of procurement into the service department, where technicians were rated on calls answered, so they cleared calls first and submitted parts orders last. Back into procurement, where the late-day queue pushed roughly eighty percent of the work to small US suppliers with no cross-border experience, against delivery dates those suppliers had never confirmed. Out again to the border, where each of those suppliers used its own courier, so nothing cleared customs together. And finally into finance, where purchase orders captured part cost while courier charges arrived separately on the invoices — and the contractual markup was calculated on part cost alone.
Four departures from the process I had been hired to examine. Every individual measure accurate. Finance had done nothing wrong; they had separated two line items, each reconciling cleanly on its own. The loss existed only in the relationship between the two lines.
Delivery moved from 51% to 97.3% within three months and held for seven years. The technology came afterward.
Now read David’s problem again. A detained shipment. An attestation that came from a supplier, which came from a sub-tier, which came from a source nobody in the reporting organization has ever seen. Five functions, each managing its piece correctly. And the exposure living in a relationship between them that no single function owns.
Different century. Different regulation. Different continent. Same structure.
The frame has an edge, and the cost can cross it
This is not a new observation in this archive, and the progression is worth stating because it arrives at exactly where David’s post lands.
In 2011, writing on the greening of procurement, the collision was already visible: sustainability objectives meeting financial imperatives, competing interests, and winners and losers that were not evenly distributed.
In 2023, responding to a David Loseby post on COP28, the question sharpened. You cannot assess an ESG benefit without tracing where its cost was displaced — the silent victims outside the immediate transaction. The minerals in the battery. The gas-powered cars exported to countries that finally had access to affordable transport.
In 2026, the point became structural. A widened framework — a Triple Bottom Line, a balanced scorecard — can contain entirely accurate data and still exclude the condition determining the real-world outcome.
Which is what “beyond direct suppliers” actually means. Beyond the reporting organization’s field of vision. The organization can record the benefit while the cost lands on a supplier, a worker, a community, a country or a future market that never appears on its scorecard.
What this demonstrates about the method
I want to be precise about the claim, because it is the one worth testing.
The backward trace is not a procurement technique that happens to be useful elsewhere. It is a procedure for finding a determining condition that sits outside a declared frame — and frames have edges regardless of what is inside them.
A defence parts contract. A corporate balance sheet. A detained container at an EU border. A data governance stack. In every case the same three things hold: the forward map contains only what someone thought to include, the failure is evidence of something the map could not contain, and the determining condition is usually in the space between functions that nobody owns.
That is not a claim about procurement. It is a claim about how organizations see.
And for all the current talk about AI and loop-back learning, what I am describing is not a technology. It is a loop-back learning process — one that optimizes resilience and response to how the real world actually operates, rather than to how it was declared to operate.
Feedback improves an answer against the existing model. Loop-back allows new outcome evidence to reopen the model itself. A detained shipment, a missed delivery, a supplier who cannot answer a question about their own sub-tier — each is new evidence entering at the start, not an exception to be logged and tuned away.
It has never been a technology issue. It has been an operations mindset issue.
The question for David’s thread
He asks where a company should start if mapping the full value chain takes years, and answers it well: triage by revenue importance and by risk at each point.
I would add one refinement.
Do not begin by designing the complete map. Begin by selecting one known failure — a detained shipment, a rejected attestation, a supplier that could not answer — and trace it backward until you discover where your existing map ends.
That boundary, wherever it turns out to be, is the thing worth knowing. And you cannot find it from inside the map, because the map does not contain its own edge.
When the same evidence crosses five functions, who owns the collective outcome?
And the harder version: how do you know the collective outcome includes everyone and everything carrying its consequences?
-30-
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
Jon W. Hansen, FCIPS — Procurement Insights | Hansen Models™
Related
David Shillingford Just Described the Backward Trace. Here Is What It Looks Like Applied.
Posted on September 17, 2026
0
A defence maintenance contract in 1998 and a detained shipment in 2026 are the same problem. The procedure does not change when the domain does.
David Shillingford tagged me in a post this week about an article by Dr. Rizwan Manzoor in Supply Chain Management Review, on how forced labor, carbon reporting and supply chain due diligence regulations have turned risk management from a legal function into an operational imperative.
David’s framing of why this belongs to the COO and CSCO is the clearest I have read. Stranded inventory does not generate revenue. Stranded goods hold up production. Proof of compliance is becoming a condition of market access. And the regulatory slice of disruption cost is growing.
He then makes an observation most people will read past:
And he closes with an instruction:
That last sentence is the backward trace. He has arrived at it from supply chain risk; I arrived at it from a defence maintenance contract in 1998. Same starting point, different route.
So this post does two things. It takes his instruction seriously and shows what following it actually looks like. And it makes a claim I want tested rather than believed: the procedure does not change when the domain does.
The part that is not a data problem
David identifies “beyond direct suppliers” as the challenge and the unlock, and he is right that it is hard and takes years.
But there is a second problem underneath the first, and it does not get solved by better data.
Business Continuity, Risk, Legal, Trade, Sustainability and Procurement can all have access to the same information and still act on it through separate mandates, separate incentives, separate escalation paths and separate definitions of success. Shared data does not produce shared accountability.
Worse: if the data was collected inside the same predetermined boundary, five functions can share it and remain collectively blind. Stranded inventory, forced-labor exposure, embedded carbon and lost market access can look like four functional problems while originating in one operating relationship that nobody’s map contains.
How the trace actually runs
Here is the distinction that matters, and it is a distinction of starting point, not of rigor.
The designed map begins with the regulatory requirement. It assigns responsibilities, collects supplier declarations, builds a compliance framework and expects compliant market access at the other end. Every arrow points at the goal. It contains only what someone thought to put in it.
The backward trace begins with a shipment sitting at the border.
Not “improve supply chain compliance.” One detained container, and one question: what specific evidence failed?
That question does not stay in Trade. It pulls into Procurement, because the declaration came from somewhere. Beyond Procurement into the sub-tiers, because the input came from somewhere before that. Then across into Risk, Sustainability and Operations, because each holds a piece of the same relationship and none holds the whole.
⚠ And this is an illustrative hypothesis, not a diagnosis. A real trace takes one detained shipment, identifies the exact document or attestation that failed, and lets each finding determine the next question. The actual path might lead somewhere entirely different — which is precisely why it cannot be designed in advance. If it could be designed in advance, it would be a forward map.
This is not hypothetical. Here is one that happened.
In October 2022 an engine designed by the Austrian company Rotax — a subsidiary of Canada’s Bombardier Recreational Products — was found installed in an Iranian-made Mohajer-6 drone that went down over the Black Sea. EU sanctions prohibit the shipment of such equipment to Iran and Russia. Rotax opened an investigation.
I wrote about it at the time, and the question I asked then is the one David is asking now: how deep into the supply chain should procurement’s responsibility extend?
Trace it backward and the shape is familiar.
Illustrative traceback hypothesis. The 2022 post asked the question; it did not establish the path.
The sale itself was lawful — a commercial light-aircraft and recreational powerplant, not a controlled military item at the point of purchase. Title passed to an authorized distributor, and the obligation to know the end user stopped at a boundary the product did not respect. The dealer channel beneath it was built to move units, not to ask what a buyer intends to fly. Re-export through a third country can be individually compliant in the jurisdiction where it happens. And the regulatory frame itself attaches sanctions to the shipper and the destination, not to the component’s lifetime — so a lawful sale in year one becomes a violation in year three, and no record connects the two events.
⭐ Nobody did anything wrong at any single step. The sale was lawful. The distributor was authorized. The dealer was compliant. Each transfer reconciled cleanly on its own.
The exposure exists only in the relationship between a consumer sales channel and a dual-use capability — and no function owns that relationship.
That is four departures from the manufacturer’s own map: distribution, the dealer channel, a third country, and the regulatory frame. And note the loop on the right of the diagram — every unit sold into an open channel regenerates the exposure. It does not get resolved by the last investigation. It reproduces.
Why this is the same problem as 1998
In 1998 a national defence maintenance operation was delivering next-day parts 51% of the time against a 90% contractual requirement, and was about to lose the contract.
The forward map was obvious and everyone had it: order received → supplier sourced → parts ship → next-day delivery. Optimize that line and you get a faster version of 51%.
I started from the failure and asked a question that was nowhere on the map: what time of day do orders come in?
Four o’clock. And why four o’clock took the trace straight out of procurement into the service department, where technicians were rated on calls answered, so they cleared calls first and submitted parts orders last. Back into procurement, where the late-day queue pushed roughly eighty percent of the work to small US suppliers with no cross-border experience, against delivery dates those suppliers had never confirmed. Out again to the border, where each of those suppliers used its own courier, so nothing cleared customs together. And finally into finance, where purchase orders captured part cost while courier charges arrived separately on the invoices — and the contractual markup was calculated on part cost alone.
Four departures from the process I had been hired to examine. Every individual measure accurate. Finance had done nothing wrong; they had separated two line items, each reconciling cleanly on its own. The loss existed only in the relationship between the two lines.
Delivery moved from 51% to 97.3% within three months and held for seven years. The technology came afterward.
Now read David’s problem again. A detained shipment. An attestation that came from a supplier, which came from a sub-tier, which came from a source nobody in the reporting organization has ever seen. Five functions, each managing its piece correctly. And the exposure living in a relationship between them that no single function owns.
Different century. Different regulation. Different continent. Same structure.
The frame has an edge, and the cost can cross it
This is not a new observation in this archive, and the progression is worth stating because it arrives at exactly where David’s post lands.
In 2011, writing on the greening of procurement, the collision was already visible: sustainability objectives meeting financial imperatives, competing interests, and winners and losers that were not evenly distributed.
In 2023, responding to a David Loseby post on COP28, the question sharpened. You cannot assess an ESG benefit without tracing where its cost was displaced — the silent victims outside the immediate transaction. The minerals in the battery. The gas-powered cars exported to countries that finally had access to affordable transport.
In 2026, the point became structural. A widened framework — a Triple Bottom Line, a balanced scorecard — can contain entirely accurate data and still exclude the condition determining the real-world outcome.
Which is what “beyond direct suppliers” actually means. Beyond the reporting organization’s field of vision. The organization can record the benefit while the cost lands on a supplier, a worker, a community, a country or a future market that never appears on its scorecard.
What this demonstrates about the method
I want to be precise about the claim, because it is the one worth testing.
The backward trace is not a procurement technique that happens to be useful elsewhere. It is a procedure for finding a determining condition that sits outside a declared frame — and frames have edges regardless of what is inside them.
A defence parts contract. A corporate balance sheet. A detained container at an EU border. A data governance stack. In every case the same three things hold: the forward map contains only what someone thought to include, the failure is evidence of something the map could not contain, and the determining condition is usually in the space between functions that nobody owns.
That is not a claim about procurement. It is a claim about how organizations see.
And for all the current talk about AI and loop-back learning, what I am describing is not a technology. It is a loop-back learning process — one that optimizes resilience and response to how the real world actually operates, rather than to how it was declared to operate.
Feedback improves an answer against the existing model. Loop-back allows new outcome evidence to reopen the model itself. A detained shipment, a missed delivery, a supplier who cannot answer a question about their own sub-tier — each is new evidence entering at the start, not an exception to be logged and tuned away.
It has never been a technology issue. It has been an operations mindset issue.
The question for David’s thread
He asks where a company should start if mapping the full value chain takes years, and answers it well: triage by revenue importance and by risk at each point.
I would add one refinement.
Do not begin by designing the complete map. Begin by selecting one known failure — a detained shipment, a rejected attestation, a supplier that could not answer — and trace it backward until you discover where your existing map ends.
That boundary, wherever it turns out to be, is the thing worth knowing. And you cannot find it from inside the map, because the map does not contain its own edge.
When the same evidence crosses five functions, who owns the collective outcome?
And the harder version: how do you know the collective outcome includes everyone and everything carrying its consequences?
-30-
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
Jon W. Hansen, FCIPS — Procurement Insights | Hansen Models™
Share this:
Like this:
Related