But because no single party owns the whole supply chain process it makes it hard to establish where the risk lies and how to measure it, particularly in areas such as cyber where there are multiple layers of ownership.” — Gary Lynch, founder and CEO, The Risk Project