Supply Chain Risk and Continuity Planning

George A. Zsidisin, Ph.D., CPSM, C.P.M John W. Barriger Professor of Supply Chain Risk and Resilience

Director, Supply Chain Risk and Resilience Research (SCR3) InstituteUniversity of Missouri - St. Louis

May 4, 2020

Objectives

1. Defining supply chain risk and resilience2. Assessing supply disruption risk3. Supply continuity planning4. Honda Canada case

Defining Supply Chain Risk and Resilience

Risk DefinitionVariability of returns Firm performance evaluated in terms of

return and growth criteriaMarket risk The use of the capital asset pricing model

to measure risk.Risk as innovation Risk conditions equated with conditions

characterized by newness, uncertainty, and lack of information.

Risk as lack of information

Information scarcity as a key facet of uncertainty in terms of important resources and commitment duration.

Risk as entrepreneurship

Independence of action in venturing into the unknown.

Risk as disaster Strategies that could result in corporate disaster, bankruptcy or ruin.

Risk in Business

Risk Definition

Downside of risk Risk being associated with a negative outcome.

Magnitude of possible losses compared to its probabilities

At least one possible outcome of an uncertain situation having a bad outcome.

Distinction between risk taking and gambling

Risk taking is associated with using skills, judgment, and control, while gambling is not.

Risk as a multi-faceted construct

Risk cannot be captured with a single number, since multiple facets such as financial, technical, marketing, production and other risk aspects exist.

Perceiving Risk (General)

Shapira (1995)

Model of Supply Risk Management

Map supply network

Identify risk and its current location

Assess Risk

Manage Risk

Form collaborative supply network risk strategy

Implement supply network

risk strategy

Adapted from Harland et al. (2001)

Defining Supply Chain Risk

•The potential occurrence of an incident within a firm or its supply chain in which its outcomes result in a financial loss for the firm

•Detrimentally affects product, financial, and information flows

LuLuLemon• Yoga inspired athletic clothing retailer known for quality• Recalled 17% of all pants sold in its stores as the fabric used in

the making of those pants did not meet quality standards and was see-through.

• Store’s staple product• Disruption occurred in March 2013; stores still did not have fall

product to sell in August 2013• Production of luon is a complex process with a number of

different inputs, with the fabric is the key factor. • Product met testing standards at the global manufacturing • Low end of tolerance standards

• When combined with subtle style changes in pattern, the resulting end product had an unacceptable level of sheerness

http://online.wsj.com/article/SB10001424127887324755104579071432344920974.htmlhttp://investor.lululemon.com/releasedetail.cfm?ReleaseID=754181

LuLuLemon Effects

• Resulted in a significant hit to financial earnings ($20 million below expected forecasts for the fiscal quarter ending in October)

• Brand reputation suffered damaged• Chief Product Officer and the CEO stepped down• Lululemon implemented factory oversight by stationing

employees in the factories to monitor and test products and to educate the manufacturing partner on new testing standards in hope to prevent future disruptions

Samsung Galaxy Note 7• Battery cell issues resulting in “exploding” batteries during or

after charging• Sold 2.5 Million before recall September 2, 2016• At least 35 instances• Permanently stopped production Oct 11• Estimated $9.5B loss in sales; $5B loss in profit

https://www.theguardian.com/technology/2016/oct/11/samsung-galaxy-note-7-exploding-battery-safety-concerns

VW Supplier Dispute

• August 2016 - Supplier feud over a contract with German subsidiaries of Bosnia-based Prevent Group caused VW to halt production of its best-selling Golf and Passat after the parts maker took the unprecedented step of cutting off deliveries of transmission and seat components

• According to Prevent, Volkswagen was seeking to pass on the costs of the crisis by squeezing suppliers, and the parts maker was forced to take a stand to secure its survival

• Commerzbank AG estimated the stoppage cut profit by 70 million euros a week

http://www.bloomberg.com/news/articles/2016-08-22/vw-restarts-talks-as-supplier-feud-expands-to-golf-production

COVID-19 Pandemic

• Varied effects in supply chains• Employees/Human resources• Demand volatility and shortages• Loss of business• Highlight need for flexibility

Supply Chain Risk Categories

• Processes – value added activities inside the firm• Controls – application or misapplication of rules (order

quantities, batch sizes, asset and transportation management)

• Demand – between firm and market• Supply – between supply base and firm• Environment – predictable and unpredictable

Source: Christopher, M., & Peck, H. (2004). Building the resilient supply chain. The International Journal of Logistics Management, 15(2), 1-14.

Top Supply Chain Risk Sources

Factors Contributing to Disruptions

• Globalized supply chains• Specialized factories• Increased outsourcing• Reduced supplier base• Increased volatility of demand• Technological innovations

Cranfield University (2002)

Defining Supply Chain Resilience

“The capacity for an enterprise to survive, adapt, and grow in the face of turbulent change” (Fiksel 2006)

Vulnerability FactorsFactor Description

Turbulence Frequent changes in external factors beyond your control

Deliberate Threats Intentional attacks to disrupt operationsExternal Pressures Influences creating barriers or constraints

(i.e. political)Resource Limits Constraints due to limits of productionSensitivity Conditions influencing product and

process integrityConnectivity Interdependence and reliance on outside

entitiesSupplier/Customer Disruptions

Susceptibility of suppliers and customers to disruptions

Source: Pettit et al., (2010)

• Inability to meet customer requirements Loss of customer business Detrimental affect on revenues and/or profits

• Threats to customer life and safety Product integrity Durability Reliability

• Increases in Costs Resourcing Lost production time

Supply Risk Outcomes

Model of Supply Disruption Risk Effects

Market/ Industry

Suppliers

GeopoliticalEnvironment

Customers

Internal

IntellectualProperty

PurchasePrice Increases

SupplyDisruptions

RevenueReduction

ProductLiability

PROFITEROSION

Sources Intermediate Effects

Assessing Supply Chain Risk

Assessing Supply Risk

• Probability and Severity• Company Processes and Examples• Stand-alone and Integrated Techniques

Risk Assessment

Organizational risk assessments involve:

1) identifying potential losses

2) establishing the extent of losses

3) understanding the likelihood of potential losses

4) assigning significance to potential losses

Adapted from Yates and Stone (1992)

Supply Risk Assessment

•Provides purchasing professionals early warning indicators of potential supply problems

•Estimates for guiding supply decisions

•Stand-alone and secondary tools

•Utilize information to create supply strategies that 1) reduce the probability that supply risk occurs, and/or 2) reduce the detrimental outcomes that supply risk can

have on the purchasing organization

Probability

Outcome/Impact

Profit Inhibitors

Low Risk Catastrophic

Supply Risk Model

Low

Minor Significant

High

Risk Assessment AttributesSemiconductor Manufacturer

Risk DefinitionDesign Ability to complete the design, follow design for manufacturing goals, validate

the design, assess the materials interactions, and manufacture the item. Thisrefers to both company and supplier design as well as statements for work forservice to outsourcing suppliers.

Quality The direct and indirect materials, service, or product consistently meetsrequirements, and supporting processes are in place to ensure control.

Cost Determined by target costs from the customer, industry benchmarking, should-cost models, and make-or-buy decisions where appropriate.

Availability Assessing the risk of the sourcing, unit volume requirements, and the materialtooling (where applicable).

Manufacturability Risk associated with manufacturing’s ability to produce when materialspecifications are met. If the material has not yet been received, this may entailanticipating potential future problems, such as materials that meet specificationsbut do not meet design for manufacturing goals.

Supplier Assessing and choosing suppliers of good financial health and manufacturing inpolitically stable or low-risk natural disaster areas. It also refers to instanceswhen Semi becomes too large a percentage of a supplier’s business, eitherthrough capacity or corporate revenue.

Legal Risk associated with the substantive legal status of the material, product, orservice, such as import/export restrictions and tax issues. Additional risk factorsinclude legally enforceable restrictions or commitments relating to the use of thematerial, product, or service.

Environmental,health and safety

Issues such as the handling and use of hazardous materials and compliance withEPA, OSHA, and other governmental agency policies by suppliers as well as thisfirm.

Zsidisin and Ellram (1999). http://www.capsresearch.org/practix.htm

Risk Assessment StepsSemiconductor Manufacturer

Step Activity1. Identify the materials/services to be assessed2. Identify the owner of the material/service who will be responsible for the risk assessment3. Start the Risk Assessment Scorecard4. Review success criteria for each of the risk factors5. Collect data6. Determine risk level by comparing data to criteria on the risk assessment scorecard7. Conduct impact analysis8. Document risk level analysis and risk reduction plans9. Track progress

10. Determine when to cease performing risk assessments

Zsidisin and Ellram (1999) http://www.capsresearch.org/practix.htm

“Availability” ExampleRisk Factor: Availability

Show Stopper High Risk Medium Risk Low Risk Qualified

Incoming Materials

No source identified.

Raw material scarcity.

Sole sourced with multiple production operations in close proximity.

Sole sourced, with multiple production operations separated by 50 miles.

Multiple sources with no supply shortages.

Source Process Capability

Unknown, new technology or supplier.

Manufacturing capability only proven on pilot scale.

Manufacturing or services capability demonstrated for a similar material.

Data demonstrates process is in specification.

Source process is stable and capable.

Volume Capacity

Availability requirements not supported with existing sources.

Supplier identified. Plans to support volumes not in place.

Capability plans developed by supplier and implementation in process.

Capacity mostly in place. No known issues.

Capacity fully in place.

Technologically Capable

Industry moving toward different “standard.”

Industry movement toward different “standards” known with no plans to address.

Industry movement toward new “standard” understood with plans to address.

Industry adopting multiple “standards.”

Technology chosen is “standard.”

Supplier Leadtime

No quick turn capability exists at supplier.

Quick turn capability for new design is greater than leadtime.

Supplier lead-term reduction plans on track.

Quick turn capability for new design lead-time or meets goals.

Supplier and supplier tooling meets leadtime goals.

Secondary Risk Assessment Tools

• Instruments and activities primarily used for other purposes

• Quality:– MBNQA– Supplier interlock matrices– Supplier scorecards– Supplier self-assessments– Designated quality representatives

• Supplier Improvement:– Process maturity path analyses– Developing and certifying suppliers– Communication – Communication - Communication

• Risk exists in our supply chains• Focus on detrimental events that have financial

implications• Risk assessment is a necessary precursor to risk

management

Summary of Risk Assessment

Supply Continuity Planning

Definition

• “The business management practices that provide the focus and guidance for the decisions and actions necessary for a business to prevent, mitigate, prepare for, respond to, resume, recover, restore, and transition from a disruptive (crisis) event in a manner consistent with its strategic objectives” (Shaw and Harrald, 2004; p. 3)

• Supply Continuity planning (SCP) is an important facet of business continuity planning

SCP/SC Framework

Awareness Prevention Remediation KnowledgeManagement

Internal External

Identification Assessment TreatmentMonitoring

Plan – how to minimize:• Impact• Duration• Resources

Execution

Track results Things gone

right Things gone

wrong Future action

list

Disruption

Awareness

• Recognition of exposure to risk within the supply chain

• Awareness of•Probability• Impact

• Recognition of effects of risk on:•Physical assets• Information

• Orientation:• Internal•External

Prevention

•Reduce likelihood and/or impact of supply chain disruptions

•Key ProcessesRisk IdentificationRisk AssessmentRisk TreatmentRisk Monitoring

Key Questions

• Do you understand your core supply chain vulnerabilities or potential failure points

• How do we redirect production and or distribution capacity?

• What capacity is available and how quickly can we redirect?

Key Questions

• How do we procure direct and indirect materials? Manually? How are supply chain disruptions accounted for?

• Who is responsible for business continuity and crisis management at your site?

• What immediate action do we need to take to minimize loss and liability?

Key Questions

• Do we need to prioritize customer demand? If so, which customers will be prioritized?

• What is the worst case financial loss and legal exposure? Do you have a key contact list for individuals required to respond to the crisis?

• How long will it take to resume operations?

Remediation

•Identify “a priori” procedures for managing the four stages of a disruption Interruption, response, recovery,

restoration of operations•Minimize adverse impact on: Time Cost

•Determine most effective allocation of resources

Major Stages of a Disruption

Interruption Response Recovery

Output

Cost

Time

Prod

uctio

nQ

uant

ity

Knowledge Management

• Learn from experience Things gone wrong Things gone right Results of remediation efforts

•Modify current procedures and systems to reflect lessons learned

• A SCP “post mortem”

• Formalized activity

Critical Elements of a Continuity Plan

• Executive management support• Training• Risk Assessment• Suppliers

Executive Management Support

• Resources• Internal and external data collection• Training• Metrics

• Dissemination of information• Organizational structures

Training

• Practice drills• Simulations• Manual access

Risk Assessment

• Likelihood and impact• Cross-functional• General impacts• Details previously discussed

Moving Forward

• Mitigating risk and creating resilience is a prevalentchallenge in supply chains

• Cross-industry problem• Local, national, and global in scope• Reorienting Center (Institute) to focus on research

examining mitigating risk and creating resilience insupply chains

SCR3

• “Supply Chain Risk and Resilience Research Institute”

• Mission Statement:The purpose of the Supply Chain Risk and Resilience Research Institute (SCR3) at the University of Missouri-St. Louis (UMSL) is to be the premier global institute for advancing knowledge and practice in mitigating risk and creating resilience in supply chains.

SCR3

• Currently recruiting corporate members• Benefits/activities include:

• Annual member seminars• Emerging practice workshops• Benchmarking• Large-scale member driven research studies• Training/Educational programs

Examples of SCP/Assessment Documents

Risk No. Title Initial Risk Prob

Initial Risk

Impact Business process Risk Owner

Residual Risk Prob

Residual Risk

Impact

1 If suppliers are in financial distress then delivery will be impacted H M Supplier Network Purchasing

Directors M M

2 If suppliers have quality problems then delivery will be impacted H M Supplier Network Supplier Quality

Director M M

3 If key suppliers become totally incapacitated then delivery will be impacted L H Supplier Network Purchasing

Directors L H

4 If there are volatile movements in base materials and alloys then cash will be affected H M Manage Cash Finance Director M M

5 If there are Market imperfections then there will be uncontrollable price movements H M Supplier Network Purchasing

Directors M M

6 If key suppliers fail to generate sufficient cost reduction then profit and cash levels will not be achieved.

M H Dev Supp Chain Performance

Purchasing Directors M H

7 If SAP / ERP data is incorrect, then we will be unable to manage our tasks and meet our commitments H H Fulfill Orders VP Supply Chain M M

8 If there are skill shortages within Purchasing then the FYC will be impacted H H People & Knowledge Human Resources M M

9 If we do not pay suppliers on time then the FYC will be affected. H M Manage Cash Finance Director M M

10 If there are sudden changes in load then supplier performance will be impacted M H Plan the Business VP Supply Chain M H

11 If the supply base is not restructured and parts transfers not correctly managed then financial returns will be impacted.

M M Create Customer Solutions

Purchasing Directors M M

12 If design changes are not implemented correctly then supplier cost reduction performance will be impacted. H H Create Customer

Solutions Purchasing Directors H H

13 If we fail to align reward to business and personal performance then objectives will be less likely to be met

M M People & Knowledge Human Resources M M

14 If supplier Diversity goals are not achieved, we will not be awarded government contracts. H H Manage Cash

Purchasing Directors M H

Purchasing Risk Register

Probability L: < 5% chance Impact:

L: < $8 million

M: 5% - 25% chance M: $8 - $16 million

H: > 25% chance H: > $16 million

Purchasing Risk Register Criteria

Risk Action Example Risk 1. Actions Initial Residual Risk Description – If suppliers are in financial distress then delivery will be impacted.

Probability: Impact:

High Medium

High Medium

Background - Changes in economic factors, supplier capability, or in workload from our firm or other key customers, may increase the risk of suppliers becoming insolvent. This may expose us to ransom demands or disruption should the supplier go into receivership / Chapter 11.

Actions / Control Measures Owner Date Status

Identify high risk suppliers (using D&B ratings and intelligence from supplier visits.)

Supplier Intelligence Ongoing Green

Supplier risk assessments of top 100 suppliers, private companies and suppliers difficult to switch.

Purchasing Executives Ongoing Red

Bi-Annual financial appraisals of top 100 suppliers plus ad-hoc as needed.

Supplier Intelligence Ongoing Green

Consolidation of supply base. Purchasing Director Ongoing Amber Quarterly Risk meeting V.P. Supply Chain Quarterly Green

Risk Assessment Process ExampleClasses of Risk Exposure:

Class 1: The product is currently sourced from more than one approved source Class 2: The product is currently sourced from one approved source. Other sources are

approved and available, but not used. Class 3: The product is currently sourced from one approved source. Other sources are

available and approved, but tooling and/or equipment is limited. Class 4: The product is currently sourced from one supplier. No additional source is

available.

Risk Assessment

ProbabilityOf Event

Impact of Event(Interruption Time)

High

Low

Minor Major

“Acceptable Risk”Frontier

Risk Assessment Process (continued)Measurement scales for Probability and Impact: Impact (Interruption Time) Class 1: < 3 months to get deliveries from alternate source Class 2: 3 – 8 months to get deliveries from alternate source Class 3: 9 – 12 months, redesign only alternative Class 4: > 12 months, redesign of a complex unit or product

Probability 0 – 25 Very unlikely 25 – 50 Unlikely 50 – 75 Likely 75 – 100 Very likely

Supplier Disaster Recovery Audit

Element: Disaster Recovery Program

Requirements Status Evidence &

Location Action Plan

Y/N Score 0/10

Is there an emergency Disaster/Business Recovery/Business continuity plan established in the Supplier Company?

Is this plan deployed according to all existing sites?

Is this plan addressing management succession and identification of key staff?

Is this plan identifying, for all products delivered to our firm, a primary source and a back-up source?

Is this plan identifying all "strategic" materials and equipments and their identical sources of replacement?

Is there an off-site storage of vital records?

In case of disaster are there procedures to restart minimum service level and to organize transport to a back-up site?

Supplier Disaster Recovery Audit Scoring Method

Description Score Supplier is not familiar with the requirements of the element and has no relevant source documentation (flow charts, forecasts, plans, procedures, strategies, etc.) in this area.

0

Supplier is familiar with the requirements of the element but there is no evidence of source documentation, planning or implementation.

1

Supplier is familiar with requirements of the element and has preliminary source documentation with incomplete plans for implementation.

2

Source documentation is available. Implementation (with assigned responsibilities) has just started, (0-30% complete).

3

Source documentation is available and implementation is in progress (30-60%). Deficiencies have been identified but improvements are not quantifiable.

4

Implementation has progressed (60-80% complete) and there is preliminary evidence of relevant results.

5

Implementation is nearly complete (80-95%) and documented evidence of implementation effectiveness exists.

6

Full implementation of source documentation for the requirement and complete confirmed evidence of implementation effectiveness. The supplier has met minimum requirements.

7

Analysis of results and on-going continuous improvement can be demonstrated in Key areas linked with customer satisfaction.

8

Supplier has reached world-class performance and is able to show growth beyond QS-9000 requirements and continuous improvement in all areas.

9

Supplier is best-in-class and is able to demonstrate significant innovation in new ways to show relevant results beyond the customer requirements. The supplier sets the industry benchmark.

10

A MINIMUM SCORE OF SEVEN IS REQUIRED ON EVERY APPLICABLE QUESTION.

Summary

•Supply risk differs by its sources and dimensions

•Awareness and knowledge are the first steps

•Not all supply risk should be managed the same

•Risk is a fact of life and business

•If you don’t plan for the worst, then you will get the worst

Thank you