Resiliency Track Readout August 2009 Objective and Scope

Resiliency Track Readout August 2009

Objective and Scope • Objective: – To share best practices in supply chain resiliency • Track Scope: Product, Supplier and Physical Network Resiliency – Planning and Implementation for: Existing and New Products, Existing and New Suppliers, Existing and New Networks/Network Design • Out of Scope: – Product Quality Process – S&OP (sales and operations planning)

Resiliency Planning • Understand your supply chain

Resiliency Planning • Setting Objectives, Targets and Establishing Resiliency Metrics 1. BP firms have a method to determine which elements of the supply chain and the product pose the most risk • • BP firms utilize supply chain ‘value stream mapping’ to understand the node-network BP firms have the ability to map their locations, supplier locations, customer locations globally

Resiliency Planning Item 1 Examples: • • • CISCO: Leverage the BCP Program to collect Time To Recover for Partner Manufacturing and Logistics sites and for single/sole sourced components. GE Energy Infrastructure: Determine single/sole source suppliers, identify which of those components are critical to the product/customer, identify components with unique/rare raw materials. Launch a Risk Assessment questionnaire for internal suppliers. External suppliers get a BCP questionnaire that ranks their Resiliency. This information is used to identify suppliers both internal and external that are at high risk. Genentech:

GENENTECH 3 Identify Product Contingency Options and Network Risk Inventory Step 1: Calculate network risk inventory needed per each manufacturing process in the event of an outage at the primary site: Bulk Outage Start-Up Time Primary Site 18 weeks outage 6 w Bulk Cycle Fill/Pack Time Cycle Time 10 wks 7 wks Network Risk Inventory for bulk outage: 41 weeks DS or DP 41 weeks Fill Outage Primary Site Fill/Pack Start-Up Cycle Time 15 wks outage 4 w 7 wks Network Risk Inventory for fill outage: 26 weeks DP 26 weeks Pack Outage Start-Up Primary Site 13 w outage 19 weeks 4 w Pack Cycle Time 2 Network Risk Inventory: 19 weeks DP Definitions: • DS: Drug substance / DP: Drug product (packaged units) • Start-Up: Time needed to change over equipment, modify schedule, and/or seed train development time

CISCO BCP Program

Resiliency Planning 2. Best Practices firms can identify the consequences of making optimal risk choices and acceptable mitigations for known risks. – Revenue, brand impact, or market value – Proven methodology for choosing what to mitigate – Regular management review and approval of risk mitigation investments – Budget allocated for risk mitigation and manage a portfolio of risk mitigation projects and programs to improve resiliency – Consistent method of measuring resiliency across their organization.

Resiliency Planning Item 2 Example: • CISCO: Resiliency Index

Implementation and Operation 1. Process and program to drive resiliency projects across Products/Services, Suppliers and the Supply Chain – Program ownership of risk mitigation projects (both internally and externally) – Process in place to validate supplier responses (Validate Site Time to Recover, Validate Part Time to Recover) – Partnerships with customers to ensure demand signals are comprehended into capacity planning Ø Visibility and influence the Product Lifecycle • Ability to know if past mitigation strategies are changing as part of the routine Engineering Change Control or a Supplier’s decision

Implementation Example • Fed. Ex: – Resiliency is enabled through excess capacity/redundancy to account for operational and non operational issues. – Capacity Planning to include further levels into the supply chain (mother’s day flower delivery). Partner with the customers shipping to ensure there is resiliency by sharing and having an understanding of the customers demand needs and Fed. Ex’s ability to deliver.

Final Thoughts • Interdependencies – BCP, Risk Measurement • Tiered Approach to Implementation – Different sets of minimum requirements depending on the complexity and size of the business; Example: Tier 1 = Self BCP, Tier 2 = Self BCP and Vendor BCP • Phased Implementation – Choose which products or elements of the supply chain apply for certification, i. e. new products