BDO recommendations

We recommend these key practical steps to mitigate foreign interference risk:

Executive and management level

• Encourage executive-level discussion and board-level visibility of foreign interference risks through their Enterprise Risk Management program
• Regularly revisit foreign interference risk mitigation strategy to align with evolving government advice and changes to organisational conditions
• Build relationships with relevant government departments and agencies as a valuable source of guidance and advice (e.g. Department of Home Affairs, Australian Signals Directorate, and Critical Infrastructure and Security Centre).

IT delivery and vendors

• Procurement teams should assess vendors not only for capability and cost, but also for ownership structures, jurisdictional exposure, and geopolitical risk
• Ensure that technology dependencies on foreign jurisdictions are fully understood and regularly updated, and that there is real visibility of fourth and fifth parties
• Understand how IT delivery partners manage access to the organisation’s most powerful user profiles, and whether they are accessing it on a need-to-know basis. Organisations should also consider whether arrangements apply to redundant data stores or test systems that may have sensitive data
• Identify whether logging and monitoring arrangements consider anomalous access patterns, data exfiltration, and indicators of compromise linked to foreign actors
• Conduct regular threat and exposure assessments, which include consideration of the extended enterprise, i.e. delivery partners, outsourced providers and contractors
• IT staff in critical or high-risk positions (e.g. those with administrator-level access, access to critical data or key cyber security positions) should be subject to increased vetting and background checks. In many cases, these staff may be employed by external vendors and trading partners. Organisations should ensure minimum vetting requirements are met by delegating this responsibility.

Organisational culture

• Train HR and personnel teams to identify insider threats, coercion attempts, or undeclared foreign affiliations
• Encourage a culture of vigilance and personal responsibility where staff can safely raise concerns or suspicions that may be indicative of foreign interference.

When the supply chain becomes invisible

The rise of generative AI is shaping supply chain risk to become increasingly opaque. AI systems now generate code, process sensitive data, and simulate human interactions. Amid this growing complexity, organisations should consider these critical questions when adopting AI:

• Who trained the model?
• What data was used and who influenced it?
• Where is the model hosted and managed?
• Do we understand the potential exposure to ‘data poisoning’ attacks? This is a situation where an adversary may push harmful, inaccurate or biased data to influence the output of the model.

These questions are often unanswerable when using third-party or open-source AI tools, creating a ‘black box’ risk in the supply chain.

To mitigate this, organisations should:

• Establish governance frameworks for AI procurement and deployment
• Audit AI generated outputs for integrity and bias
• Vet AI vendors for transparency, jurisdiction, and data handling practices
• Ensure that data lineage and model provenance are understood.

Ultimately, AI can enhance decision making, but there should always be human intervention to critically evaluate automated outputs as part of a decision-making process.

Summary

Foreign interference is not a new threat – it is one that some sectors have been widely familiar with, particularly across research, defence, electoral integrity, and critical infrastructure. However, the complex nature of our supply chains and associated technology delivery means that the challenge is more multifaceted than ever, driving the need for thorough risk management.

In a world where digital competitive advantage is increasingly critical, the ability to anticipate, mitigate, and respond to foreign interference will be integral to being a trusted and resilient business.

How BDO can help

Organisations may easily overlook the risk of ‘nth party’ suppliers in their supply chain, increasing the threat of compromised key company data and falling victim to foreign interference. Our team of experts support organisations in risk mitigation, security, forensics and data privacy protection. Contact us to learn more.