Supply chain issues expose loopholes in measuring ESG risks