biotech risk webinar presentation

© 2007 RMC Project Management, Inc.

Risk Identification Mistakes to Avoid

Rita Mulcahy, PMP

2

About Rita Mulcahy, PMP• Founder and CEO of RMC Project Management, Inc.,

one of the fastest-growing project management training companies in the world

• Founder and CEO of RMC Publications, Inc.

• An internationally recognized expert on project management

• 15 years and $2.5 billion worth of hands-on project experience

• Products and classes have helped hundreds of thousands of project managers world wide

© 2007 RMC Project Management, Inc.

Do Something Now!For More Free Tips on How Risk Management Can

Protect Your Business log on to our Web site: www.rmcproject.com/risk

- AND -

Purchase Rita’s Book

Risk Management Tricks of the Trade®

for only $38 (List Price $69)Visit our Web site and use this Coupon Code:

(BIOSUPPLY5)Free Tips on Risk at www.rmcproject.com/risk:

•Tricks for Avoiding Risk Stumbling Blocks •How to Use the Risk Book to Help You Pass the PMP® Exam •Top Five Risk Errors That Can Ruin Your Career•Is Your Lack of Risk Management Knowledge Hurting You?

- 10 -

Biotech Supply Chain Academy

Risk Identification: Improving the Health of your Supply Chain

June 18, 2009

- 11 -

Recognizes and manages the full spectrum of risks the organization faces

Minimizes “siloed” behavior that can obscure an integrated view of risk

Allocates proportionally more resources to the most strategic and pertinent risks

Considers effective risk management to be an organization-wide responsibility

and competency

Anticipates and prepares integrated responses to risks

Manages risk with a view toward maximizing the upside of strategic decisions

while minimizing the downside

Acknowledges the need to take intelligent risks to create value

A Risk Intelligent Approach

- 12 -

Deloitte’s Risk Intelligence Map

- 13 -

Scope of Supply Chain Risks

Compliance

Risk Intelligence

GovernanceOperations /

InfrastructureStrategy &

PlanningReporting

Supply Chain

Planning Sourcing Production Delivery Returns

Inaccurate demand / supply forecast

Inadequate capacity planning

Inaccurate costing considerations

Inability to determine and maintain optimal safety stock

SKU proliferation

Inability to procure goods / raw materials cost effectively and constrain volatile material costs

Inadequate supplier selection process

Inadequate quality of goods and raw materials

Over-reliance on sole source vendors

Inability to manage contract compliance and sustain sourcing savings

Inefficient production planning process

Inadequate quality control measures

Inability to control variations in production

Inability to manage third party manufacturers

Lack of operational uniformity across production facilities

Inefficient warehousing / inventory management processes

Lack of manufacturing flexibility to react to disruptions

Unreliable 3PL service providers

Failure to optimize lead time for supplies / distribution

Inappropriate network design

Inefficient order management and verification process

Inefficient inventory and channel management processes

Breakdown in cold chain integrity

Product diversion

Poorly defined / unenforceable return and credit policies

Inefficient return handling processes

Poor forecasting / trend analysis of returns

Inadequate planning for reverse logistics

Inefficient recall management processes

Inadequate chargeback reconciliation processes

- 14 -

Impact of Life Events on a Company’s Risk Profile

* 6. Unexpected Occurrences

2. Product Commitment

1. Search and Development

3. Scale Manufacturing Capability

4. Commercialization

5. Merger, Acquisition & Divestiture

Pipeline

GrowthStage

Lif

e E

ven

ts

Cold chain integrity6

Supply chain integration5

Supply Chain Risk

1 Clinical supply risk

2 Raw material quality

3 Managing contract manufacturers

4 Forecast accuracy

Cold chain integrity6

Supply chain integration5

Supply Chain Risk

1 Clinical supply risk

2 Raw material quality

3 Managing contract manufacturers

4 Forecast accuracy

- 15 -

Supply Chain Risk Assessment Approach

Interview / survey key stakeholders across the organization

Compile data for each supply chain risk category

Identify risk themes across categories

Develop mitigation strategies to address high risk areas

Define scope of implementation strategies

Estimate cost of risk mitigation / management

Develop initiative roadmap

Administer Supply ChainHealth-Check

Identify Areas of High Risk

PopulateRisk Dashboard

Develop Mitigation Strategies

Key Activities

Output

Assess the impact of key risks to the organization

Evaluate the vulnerability for key risks and understand the speed of onset

Prioritize supply chain risks for each theme

Completed health-check questionnaire

Risk mitigation recommendations

Mitigation RecommendationsMitigation Recommendations

Assess performance across risk categories

Define performance issues for key risks

Provide risk summary and areas requiring mitigation measures

7Copyright © 2008 Deloitte Development LLC. All rights reserved.

Supplier Risk Dashboard: Sample Company January 23, 2009

Confidential <Firm Name>

Firm Supplier Selection and Management Supplier Financial and Operational Performance

Supplier Risk Summary

Dimension Performance Summary Rating

Supplier Selection and Qualification

Supplier selection does not include detailed financial review

Supplier InformationSystems

Supplier DB does not include financial performance info

% of Supply Base from LCC

20% of materials are sourced from LCCs

% of Supply that is Single-Sourced

Very limited single-source components

Supplier Monitoring Programs

Supplier monitoring is limited only done for engineered parts

Supply Base Location Risk

Despite being in LCCs supply base is in large cities

Supply Base Geopolitical Risk

Geopolitical risk is high for Indonesian suppliers


Late or Missed Shipments

3 of 2000 supplier have had late shipments in 12 months

Supplier-relatedDisruptions in past 12 months

1 delayed shipment resulted in assembly line stoppage

Capacity Utilization Supplier cap utilization is between 50% and 80%

Process Compliance (Manufacturing, Safety, Storage, etc)

LCC suppliers are not following safety and storage processes

Supplier Quality Issues (Defects,Recalls)

2 major recalls in past 12 months

Financial Health (Profit and Z-score)

Some exposure associated with automotive industry

A/R and A/P Performance

Suppliers are paying and receiving payment on time

High Risk Supplier Summary At Risk Commodity Summary Overall Supplier Risk Needs

20% of the supply base is located in distant geographies (LCCs) from which transportation costs are increasing

3 electronics suppliers are closely affiliated with the automotive industry and at risk for bankruptcy if one of the Big 3 declare bankruptcy (outstanding A/R)

1 critical sole-source supplier has a Z score of less than 1.8

Wiring harnesses are at high risk for shortage due to supplier affiliation with automotive industry

Hydraulic cylinder capacity utilization in supply base is at 98%, additional demand will not be accommodated by existing supply base

Improvement needed in supplier monitoring across all suppliers

Process compliance issues in LCCs as well as quality issues

Review supplier delivery failure root cause analysis process and buffer inventory levels












































Supply chain risk dashboard(s)

Risk assessment matrix

Imp

act

(In

her

ent

Ris

k)

Vulnerability (Residual Risk)

MediumLow

Hig

hM

ed

ium

Lo

w

1

3

4

2

- 16 -

Supply Chain Health-Check

Sourcing Health-Check Survey:

Supply base profile- To develop baseline spend and

supplier profile data- Identification of risk factors, nature,

and degree of risk factors- Historical supplier failures

Supplier management practices- Gain an understanding of existing

supplier selection, tracking, and control mechanisms

- Identify weaknesses and areas of “risk leakage”

Risk management practices- Risk ownership and organizational

structure- Existing risk controls and monitoring

practices

ILLUSTRATIVE

- 17 -

Risk Assessment MatrixILLUSTRATIVE

Size reflects Speed of Onset:Low

Medium

High

Stakeholder Group ImpactVulner-ability

Speed of Onset

1 Executive Team 72 68 60

2 Business Unit / Product Lead 65 51 57

3 Supply Chain Manager 79 71 83

4 Legal / Compliance 70 59 55

Stakeholder Group ImpactVulner-ability

Speed of Onset

1 Executive Team 72 68 60

2 Business Unit / Product Lead 65 51 57

3 Supply Chain Manager 79 71 83

4 Legal / Compliance 70 59 55

Imp

act

Vulnerability

Medium HighLow

Hig

hM

ediu

mL

ow

4

2

3

1

Managing Contract Manufacturers

- 18 -

Supply Chain Risk DashboardILLUSTRATIVE












































- 19 -

Questions

Marsh- All Rights Reserved www.marsh.com

Best PracticesSupply Chain Risk Identification

Webex Document

Gary S. Lynch, CISSPMarsh

Global Leader & Managing Director

Supply Chain Risk Management Practice

212 345 6053

[email protected]

21Marsh

Today’s Discussion focuses on one element of Supply Chain Risk Management - Risk Identification

Risk Pricing, Measurement,

&Modeling

Risk Prevention,Mitigation,

&Financing

Risk Identification,

Analysis, & Evaluation

Alignment Priotization Impact Modeling

Manufacturing & Service Products

Ser

vice

s

Ele

ctro

nics

Mac

hine

ry

Risk Segmentation/

SKURationalization

22Marsh

Supply Chain Risk Identification has traditionally been performed on a static and/or historical view…

Consumer

Wholesaler

Distribution

Center

Filling & Packaging

Supplier failures (financial,

production, design, etc.)

Natural hazards

Work stoppages

Labor disputes

Infrastructure outages (fire in

plant, power grid down, etc.)

Unanticipated demand surge

or drop-off Political upheaval

Price, currency, and interest rate fluctuations

Unanticipated supply

constraints, allocation,

price increases

Spoilage

Improper handlingor cargo

placement

Theft

Diversion/ gray market

Poor packaging

Manufacturing

Raw Materials

Pandemic

Counterfeiting/diversion

Delivery delays

Source: Marsh

23Marsh

…and typically applied to the latest event (Risk De Jour) Volatility

– Energy– Foreign exchange– Commodity pricing

Trade credit issues

Pandemic threat

Regulatory change– Nationalization– Customs

Information and cyber-based

CHANGE…COMPLEXITY…SPEED…VARIABILITY

24Marsh

Economic & Financial

• Economic collapse

• Currency devaluation

• Labor disputes, strikes or unrest

• Labor shortage

• Major decline in stock price, earnings or significant volatility

• Major market fluctuations

• Decline in major earnings

• Cash flow/liquidity crunch

• Hostile takeover

• Bankruptcy

• Other financial: derivatives, investment, credit, interest rates, transfer velocity, collateral

Political & Social

• Government policy and/or attitude change

• Confinement or imprisonment of employees/family

• Lawlessness & hostile demonstration

• Regulatory change

• Civil unrest

• Government expropriation or renegotiation of royalty streams

• Government change in tax regime

• Unfavorable dividend & share sale proceed transfer

• Military coup

• Unilateral expropriation

• Nationalization

Brand/Org Reputation

• Product & service

• Liability, recall & failure

• Obsolescence

• Counterfeiting

• Organization

• Government or regulatory investigation

• Special interest group (NGO) protest or inquiry

• Community action as a result of organization’s product, people and/or technology

• Human rights abuses

• Rumors, gossip & hoaxes

• Libel & slander

• Poor customer satisfaction

• Marketing blunder

Weather

• Hurricane, typhoon, tropical cyclone

• Rising water, wind, projectiles

• Earthquake

• Tornado & waterspouts

• Rising water (flood, tidal wave, tsunami - non hurricane caused)

• Wildfire

• Mudslides

• Extreme heat

• Extreme cold

• Climate change

Environmental &

Man-Made

• Chemical, biological, radioactive, and/or nuclear

• Fire and/or explosions

• Water/soil contamination

• Public utility failures

• Asbestos & mold

• Emissions levels & waste clean-up

• Noise/dust pollution

• CO2 and/or other hazardous gas and liquid emissions

• Liquefaction

• Building, mine, facility collapse or condemned

• Water leaks and/or floods

• Insect infestations

Psychopathic, Criminal & Terrorist

• Product tampering

• Terrorist acts

• Arson & explosion

• Industrial/economic espionage

• Sabotage

• Kidnap

• Extortion

• Fraud

• Theft

• Terrorist using product or materials as weapon

• Workplace violence

• Suspicious mail/package

• Counterfeiting

Informational

• Loss of proprietary and/or confidential data (e.g. privacy, trade secrets)

• Information integrity and quality issues

• Loss of key customer, supplier, marketing, production, and/or financial data

Technology

• Technology hardware failure

• Technology software failure (rogue code, viruses, poor quality)

• Capacity issues

• Performance issues

• Other malicious acts

• Technology obsolescence and/or lack of relevance

Operational

• Project management failure

• Out of stock

• Sourcing failure

• Pricing misalignment

• Change control failure

• Transportation/logistics accident

• Walkouts, slowdowns & strikes

• Disruptions, delays (piracy, seizure)

• Leakage

• Restricted access

• Infrastructure deterioration or obsolescence

Compliance & Governance

• Non-compliance (labor, environment, security, safety, quality, etc.)

• Legal

• Regulatory

• Statutory

• Contractual

• Class action or mass tort lawsuits

• Corporate governance issues and whistleblowers

• Executive misdeeds, bribes, offenses, security and/or code of conduct violations

• Oversight, over-extended authority, accidents, errors, & commissions

Health

• Epidemic or pandemic (e.g. TB, SARS, Avian Flu)

• Long-term health issues

Source: Gary S. Lynch, “Single Point of Failure”, Wiley 2009

Strategy

• Unanticipated competition

• Product misplacement

• Disintermediation

• Poor marketing strategy

• Poor sales strategy

• Failure to innovate

Labor

• Human resource failures

• Defections & resignations

• Inability to attract/retain talent

• Labor & skills shortage

• Sexual harassment, workplace discrimination, wrongful dismissal

Many organization’s risk identification process is about looking for a particular threat in a complex supply chain network

25Marsh

However, this approach can be quite challenging, limiting and inefficientRisks are identified:

Based on what’s known and/or past performance

Usually within narrow boundaries instead of across the entire scope of the supply chain

And impacts are usually presented quantifiably rather than a combination of quantified and qualified

But the identification is only as good as the “third party” that conducted review

But a provision for the impact of constant, rapid change is not considered

26Marsh

Best practices today are moving away from the static or historical view…

Static methods (today)– Audit– Assessment– Simulation– Actuarial and similar quantitative techniques– Benchmarking– Monte Carlo

27Marsh

… and evolving into a more proactive and integrated model

Predictive(collective intuition)

Static

Intelligencebased (learning)

Trigger &Demand Driven

Dynamic & Integrated

Passive

Reactive

Proactive

Anticipatory,

Instinctive &

Transparent

28Marsh

These risk identification are then applied to the extended supply chain, at a detailed (resource) level

T1

T1

T1

T2

T2

T2

T2

T3T3

T3

T3

T3

T3

T3

Mill

Mill

Mill

Mill

Mill

S

SS

S

S

S

S

MiningCo.

MiningCo.

S

AutoOEM

OE

M B

uy/S

ell

Source: Marsh, Inc.

PeopleTechnology &

ProcessingRelationships

Physical

Assets

T2

29Marsh

But all identification techniques must support and feed the entire risk management “system” Preparation, risk management, before the risk is triggered

Reaction, risk management, when the risk is realized

Maintenance, risk management, when the risk is being monitored, measured or validated

Optimization, risk management, when measuring the efficiency and effectiveness of the program

biotech risk webinar presentation

Documents

effective risk management

risk book

risk errors

ceo of rmc project management

integrated view of risk

risk identification

risk stumbling blocks

production inability