regulatory risk supply chain