Risk management for supply chain 202169 1 Risk

Risk management for supply chain 2021/6/9 1

Risk • Risk in supply chain • Risk management for supply chain 2021/6/9 2

Risk Management …is systematically setting the best course of action under uncertainty by identifying, assessing, understanding, acting on and communicating risk issues (source: TBS Integrated Risk Management Framework) 2021/6/9 3

Resiliency Resilience is seen as the ability to accommodate abnormal threats and events, be they terrorist attacks, or perturbations from climate change, or natural disasters such as earthquakes or floods, or economic shocks. Most definitions, particularly those involving individuals, communities and organizations also refer to identifying, assessing and communicating the risk from such threats and events. http: //torrensresilience. org/resilience-and-risk 2021/6/9 4

Risk & Resiliency The traditional definition of risk is a measure that reflects the probability and the magnitude of an adverse effect. More recently a broader and more balanced definition has been adopted by the risk management community which recognizes that individuals and organizations take risk to achieve potential benefits. Individuals, communities and organizations which are prepared and ready for an abnormal event, tend to be more resilient. Understanding the probability and the magnitude of potential threats enables an organization to make decisions on how best to reduce the probability and/or impact of such threats, to transfer the risk by taking out adequate insurance, or indeed to do nothing and be ready to accept the potential consequences. http: //torrensresilience. org/resilience-and-risk 2021/6/9 5

Risk Mitigation It will never be possible to completely remove the probability of a disruptive event. Supply Chain leaders are expected to have processes which aim to identify, analyse and evaluate risks and through consultation, agree upon levels of residual and tolerable risk, and to take decisions on mitigating the risks. If risk mitigation is conducted in a formal and open manner, organizations are much more willing to accept the consequences of a disruptive event as people are then aware that all reasonable action was taken to reduce the probability and/or impact. In such circumstances, businesses/organizations will more readily recover and return to normality. They are more resilient. http: //torrensresilience. org/resilience-and-risk 2021/6/9 6

Simple Graphical Representation of Resilience 2021/6/9 7

Pw. C Risk Response Strategies 2021/6/9 8

Supply Chain Risks 1. Natural Disasters • Epidemics • Earthquakes • Tsunamis • Volcanoes • Weather disasters (hurricanes, tornados, storms, blizzards, floods, droughts) 2021/6/9 9

Kirov’s Risk Register External, End to End Supply Chain Risks 2. Accidents • Fires • Explosions • Structural failures • Hazardous spills 2021/6/9 10

Kirov’s Risk Register External, End to End Supply Chain Risks 3. Sabotage, Terrorism, Crime, and War • Computer attacks • Product tampering • Intellectual theft • Physical theft • Bombings • Biological and chemical weapons • Blockades 2021/6/9 11

Kirov’s Risk Register External, End to End Supply Chain Risks 4. Government Compliance and Political Uncertainty • Taxes, customs, and other regulations • Compliance issues • Regulatory financial reporting (e. g. , Sarbanes-Oxley) • Operations • Logistics / Trade • Regulatory Approvals - Marketing Approvals 2021/6/9 12

Kirov’s Risk Register External, End to End Supply Chain Risks 4. Government Compliance and Political Uncertainty • Public Health • Environmental requirements • Trade restrictions (e. g. , Buy American Act) • Regulatory Audit history • Currency fluctuations • Political unrest • Boycotts 2021/6/9 13

Kirov’s Risk Register External, End to End Supply Chain Risks 5. Labour Unavailability and Shortage of Skills • Availability • Quality • Cost • Unrest • Strikes and slowdowns 2021/6/9 14

Kirov’s Risk Register External, End to End Supply Chain Risks 6. Industry-wide (i. e. , Market) Challenges • Capacity constraints • Unstable prices • Lack of competition • Entry barriers • Capital requirements • Specific assets 2021/6/9 15

Kirov’s Risk Register External, End to End Supply Chain Risks 6. Industry-wide (i. e. , Market) Challenges • Process patents • Shrinking industry • Low supplier profitability • Certification • Cost trends • Recessions/Inflation 2021/6/9 16

Kirov’s Risk Register External, End to End Supply Chain Risks 7. Lawsuits • Environmental • Health and safety • Intellectual property 2021/6/9 17

Kirov’s Risk Register External, End to End Supply Chain Risks 8. Technological Trends • Emerging technologies (pace/direction) • Obsolescence • Other technological uncertainty 2021/6/9 18

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 1. Physical and Regulatory Risks • Key Suppliers Located in High Risk Areas • Material Unavailability/Poor Planning • Raw materials • Other materials • Legal Noncompliance / Ethical practices • • • 2021/6/9 Labour practices Safety practices & performance Environmental practices History & outcomes of lawsuits Tax practices 19

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 1. Physical and Regulatory Risks • Regulatory Noncompliance Customs/trade Security clearance requirements History & outcomes of regulatory audits Regulatory certification requirements (e. g. , Food & Drug Administration, Federal Aviation Administration) • Critical disclosure – International Traffic & Arms Regulations • • 2021/6/9 20

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 2. Production Problems • Capacity Too little, too much, or diminishing Order and shipping times Out of stock (i. e. , no/low inventory) Performance history, equipment age & downtime (manufacturing & testing equipment) • Repair cycle time • • 2021/6/9 21

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 2. Production Problems • Inflexible Production Capabilities (Long setup times) • Technological Inadequacies or Failures • Incompatible information systems • Slow adoption of new technology 2021/6/9 22

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 2. Production Problems • Poor Quality • Defects / contamination in manufactured product • Mislabeling of items • Lack of training or knowledge • Lead Times • • 2021/6/9 Backlogs Unresponsive Unreliable Variable 23

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 3. Financial Losses and Premiums • Degree of Competition/Profitability • Downstream integration or too much competition • Little/no competition - sole source • Mergers & Acquisitions • Financial Viability • Inability to sustain in a downturn • Bankruptcy • Withdrawal from the market 2021/6/9 24

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 4. Management Risks • Inadequate Risk Management Planning • Lack of business continuity plans • Lack of requirements for supplier's supplier business continuity plans • Management Quality • • 2021/6/9 High turnover Dishonesty Poor labour relations Poor metric scorecards 25

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 4. Management Risks • Substituting inferior or illegal materials/parts • Failing to perform required treatments/tests • Submitting inaccurate/false invoices • Lack of Continuous Improvement • • 2021/6/9 Unwillingness Cost escalation Opaque processes Opportunistic behavior 26

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 4. Management Risks • Inflation of purchase costs • Dependence on One or a Few Customer(s) • Poor Communication • Internal • External • Transparency of data & operations 2021/6/9 27

Kirov’s Risk Register Supplier Risks: External, Contract Manufacturers or Internal Business Unit 5. Upstream Supply Risks (i. e. , Subcontractors and their Subcontractors) • Any of the above external/supplier risks • Lack of visibility into subcontractors • No or poor relationships with subcontractors • Diminishing sources of supply • Transition “costs” for new suppliers 2021/6/9 28

Kirov’s Risk Register Distribution Risks/Disruptions: Inbound or Outbound 1. Infrastructure Unavailability • Roads • Rails • Ports • Air capacity/availability 2021/6/9 29

Kirov’s Risk Register Distribution Risks/Disruptions: Inbound or Outbound 2. Assets - Lack of Capacity or Accidents • Containers • Trucks • Rail cars • Ships • Airplanes 2021/6/9 30

Kirov’s Risk Register Distribution Risks/Disruptions: Inbound or Outbound 3. Labor Unrest/Unavailability • Truck drivers • Rail operators • Longshoremen • Pilots 2021/6/9 31

Kirov’s Risk Register Distribution Risks/Disruptions: Inbound or Outbound 4. Cargo Damage/Theft/Tampering • Physical damage • Theft and other security problems • Tracking the damage • Environmental controls (e. g. , temperature, humidity) 2021/6/9 32

Kirov’s Risk Register Distribution Risks/Disruptions: Inbound or Outbound 5. Warehouse Inadequacies • Lack of capacity • Inaccessibility • Damage • Environmental controls (e. g. , temperature, humidity) • Lack of security 2021/6/9 33

Kirov’s Risk Register Distribution Risks/Disruptions: Inbound or Outbound 6. IT System Inadequacies/Failures 7. Long, Multi-Party Supply Pipelines • Increased chance of all problems above • Longer lead time 2021/6/9 34

Kirov’s Risk Register Internal Enterprise Risks 1. Operational Risk • Loss of Inventory (damage, obsolescence) • Equipment loss, mechanical failures • Process Issues • • 2021/6/9 Process reliability Process robustness Lead time variability Inflexible Production Capabilities (long set up times, etc. ) 35

Kirov’s Risk Register Internal Enterprise Risks 1. Operational Risk • Capacity • Too little, too much, or diminishing • Order and shipping times • Out of stock (i. e. , no/low inventory) • Performance history, equipment age & downtime (manufacturing & testing equipment) • Repair cycle time 2021/6/9 36

Kirov’s Risk Register Internal Enterprise Risks 1. Operational Risk • Poor Quality • Defects in manufactured product • Failure to maintain equipment • Lack of training or knowledge • Environmental performance to permits / other 2021/6/9 37

Kirov’s Risk Register Internal Enterprise Risks 2. Government Compliance and Political Uncertainty • Taxes, customs, and other regulations • Currency fluctuations • Political unrest • Boycotts 2021/6/9 38

Kirov’s Risk Register Internal Enterprise Risks 3. Demand Variability/Volatility • Drawdown of the stockpile • Exceeding maintenance replacement rate • Shelf life expiration • Surges exceed production, repair, or distribution • Shortfalls 2021/6/9 39

Kirov’s Risk Register Internal Enterprise Risks 4. Personnel Availability/Skills Shortfalls • Sufficient number • Sufficient knowledge, skills, experience • Union contract expiry • High turnover rate 2021/6/9 40

Kirov’s Risk Register Internal Enterprise Risks 5. Design Uncertainty • Changes to requirements • Lack of technical detail • Lack of verification of product • Changes to product configuration • Poor specifications • Reliability estimates of components • Access to technical data • Failure to meet design milestones • Design for supply chain (e. g. , obsolescence, standardization, and commonality) 2021/6/9 41

Kirov’s Risk Register Internal Enterprise Risks 6. Planning Failures • Forecast reliability/schedule availability • Planning data accuracy • Global visibility of plans & inventory positions • Competition/bid process • Acquisition strategy • Manufacturability of a design • Program maturity • Subcontracting agreements 2021/6/9 42

Kirov’s Risk Register Internal Enterprise Risks 7. Financial Uncertainty/Losses • Funding availability • Work scope/plan creep • Knowledge of supplier costs • Strategic risk 2021/6/9 43

Kirov’s Risk Register Internal Enterprise Risks 8. Facility Unavailability/Unreliability/ Capacity • Facility breakdown • Mechanical failures • Sites located in high risk areas • Adequate capacity 2021/6/9 44

Kirov’s Risk Register Internal Enterprise Risks 9. Testing Unavailability / Inferiority / Capacity • Unreliable test equipment • Operational test qualifications • Operational test schedule • Integration testing • Transition from first test to mass production 2021/6/9 45

Kirov’s Risk Register Internal Enterprise Risks 10. Enterprise Underperformance/Lack of Value • Customer satisfaction/loyalty • Liability • Cost/profit • Customer demand • Uniqueness • Substitutability • Systems integration • Other application/product value 2021/6/9 46

Kirov’s Risk Register Internal Enterprise Risks 11. Supplier Relationship Management (SRM) Use • Contract/supplier management availability and expertise • In-house SRM expertise • Lack of internal and external communication/coordination • Supplier development and continuous improvement 2021/6/9 47

The Five Sources of Supply Chain Risk (Internal and External) Demand Risk • Loss of major accounts • Volatility of demand • Concentration of customer base • Short life cycles • Innovative competitors Supply Risk Process Risk • Dependency on key suppliers • Consolidation in supply markets • Quality and management issues • Manufacturing yield variability • Lengthy set-up times and arising from off-shore sourcing • Potential disruption at 2 nd tier level • Length and variability of replenishment lead-times Network/Control Risk • Asymmetric power relationships • Poor visibility along the pipeline • Inappropriate rules that distort demand • Lack of collaborative planning and forecasts • Bullwhip effects due to multiple echelons 2021/6/9 inflexible processes • Equipment reliability/theft • Information security breach • Financial controls • Outsourcing / Monitoring key business processes Environment Risk • Natural disasters • Terrorism and war • Regulatory changes • Tax, duties and quotas • Strikes 48

Supplier Partnerships • More organizations are seeking to establish partnerships with others in their supply chain: • Fewer suppliers, long term relationships, sharing of information (forecasts, sales data, problem alerts), cooperation in planning • Benefits: • improved operations: higher quality, increased delivery speed and reliability, lower inventories, lower costs, higher profits. Higher supplier flexibility in accepting changes (delivery schedules, quality, quantity), suppliers can help in identifying problems and offer suggestions 2021/6/9 Aspect Adversary Partner Number of suppliers Many; play one against the others One or a few Length of relationship May be brief Long-term Low price Major consideration Moderately important Reliability May not be high High Openness Low High Quality May be unreliable; buyer inspects At the source; vendor certified Volume of business May be low due to many suppliers High Flexibility Relatively low Relatively high Location Widely dispersed Nearness is important for short lead time and quick service 49

21 st Century Supply Chain Risk Model Identify, Assess, Mitigate & Manage Risk Supply Chain Maturity Sustainability Resiliency Predictability Visibility Sustainable Supply Chain “Sense & Respond” Risk Management Supply Chain Visibility Source: Supply Chain Risk Consortium Competitive Advantage As your Supply Chain Maturity Grows –– Your Supply Chain Inherent Risks Decrease 2021/6/9 50

Risk Management • Risk management • Involves identifying risks, assessing their likelihood of occurring and their potential impact and then developing strategies for addressing those risks. • Key elements of successful risk management include: • Know your suppliers • Provide supply chain visibility • Develop event-response capability 2021/6/9 51

Risk Management 1. Risk identification 2. Risk analysis 3. Response to risk 2021/6/9 52

Breakdown into Sub-processes 1. 2. 3. 4. 5. 6. 2021/6/9 Risk management planning Risk identification Qualitative risk analysis Quantitative risk analysis Risk response planning Risk monitoring and control 53

Risk Management Planning • Like any other planning process • Must ensure that the necessary resources can be applied in a timely manner • It is a continuous process • The factors that cause uncertainty change over time 2021/6/9 54

Supply Chain Integration Upstream Tier 3 Tomato suppliers Downstream Tier 2 Tier 1 Tomato grading stations Tomato paste factories Ketchup factory Retail sales Consumers Information flows Cash flows Figure 14. 1 Copyright © 2016 Pearson Education, Limited. 14 -55

Supply Chain Disruptions • External Causes – Environmental Disruptions – Supply Chain Complexity – Loss of Major Accounts – Loss of Supply – Customer-Induced Volume Changes – Service and Product Mix Changes – Late Deliveries – Underfilled Shipments Copyright © 2016 Pearson Education, Limited. 14 -56

Supply Chain Disruptions • Internal Causes – Internally Generated Shortages – Quality Failures – Poor Supply Chain Visibility – Engineering Changes – Order Batching – New Service or Production Introductions – Service or Product Promotions – Information Errors Copyright © 2016 Pearson Education, Limited. 14 -57

Supply Chain Dynamics • Bullwhip Effect – The phenomenon in supply chains whereby ordering patterns experience increasing variance as you proceed upstream in the chain. Copyright © 2016 Pearson Education, Limited. 14 -58

Supply Chain Dynamics Consumers’ daily demands Order quantity 9, 000 Retailers’ daily orders to manufacturer Manufacturer’s weekly orders to package supplier Package supplier’s weekly orders to cardboard supplier 7, 000 5, 000 3, 000 0 Day 1 Figure 14. 2 Copyright © 2016 Pearson Education, Limited. Day 30 Day 1 Day 30 Month of April The Bullwhip Effect 14 -59

Integrated Supply Chains First-Tier Supplier Service/Product Provider Support Processes Business-tobusiness (B 2 B) customer relationship process New service/ product development process Supplier relationship process Order fulfillment process Business-toconsumer business (B 2 C) (B 2 B) customer relationship process New service/ product development process Supplier relationship process Order fulfillment process External Consumers External Suppliers • External Supply Chain Linkages Figure 14. 3 Copyright © 2016 Pearson Education, Limited. 14 -60

FMEA for SC example 2021/6/9 61

Risk Analysis Scoring System 2021/6/9 S = Severity 1. 2. 3. 4. 5. No direct effect on operating service level Minor deterioration in operating service level Definite reduction in operating service level Serious deterioration in operating service level Operating service level approaches zero O = Likelihood of occurrence 1. 2. 3. 4. 5. Probability of once in many years Probability of once in many operating months Probability of once in some operating weeks Probability of weekly occurrence Probability of daily occurrence D = Likelihood of detection 1. 2. 3. 4. 5. Detectability is very high Considerable warning of failure before occurrence Some warning of failure before occurrence Little warning of failure before occurrence Detectability is effectively zero 62

The Risk Management Priority Challenge High Consequence/ Impact Low High Probability of Occurence • Where can we reduce the probability? • How can we reduce the consequence? • How should we segment supply base? 2021/6/9 63

The Five Sources of Supply Chain Risk (Internal and External Examples) Demand Risk • Drug shortages • IV Solution shortages Process Risk Supply Risk • Dependency on key suppliers • Consolidation of suppliers in certain markets (operating room, cath lab, ortho) • Manufacturing yield variability • Equipment reliability or theft • IT/Cyber security breaches • Embezzlement, False Claims • Outsourcing / Monitoring key business processes (copiers, biomed, etc. ) Network/Control Risk • Merger Integration: Supply Chain, Accounts Payable/Accounts Receivable • Inappropriate rules that distort demand (think regulations) • IT/Cyber security breaches • Lack of collaborative planning and forecasts 2021/6/9 Environment Risk • Natural disasters • Terrorism and war • Regulatory changes • Tax, duties and quotas • Strikes 64

Identifying Strategic Suppliers to Reduce Risk & Cost in the Supply Base • http: //www. industrystarsolutions. com/blog/2018/08/identif ying-strategic-suppliers-reduce-risk/ 2021/6/9 65

building these relationships • A supplier is strategic if its greatest risk to supply and profitability is a disruption with its ability to fulfill orders. • identify strategic suppliers by segmenting the supply base. • how effectively they understand their supply bases through segmentation 2021/6/9 66

Supplier Relationship Process • Design collaboration – Early supplier involvement – Presourcing – Value analysis • Negotiation – Competitive orientation – Cooperative orientation Copyright © 2016 Pearson Education, Limited. 14 -67

Supplier Relationship Process • Buying – Electronic Data Interchange (EDI) – Catalog Hubs – Exchanges – Auctions – Locus of Control Copyright © 2016 Pearson Education, Limited. 14 -68

Supplier Relationship Process • Information Exchange – Radio Frequency Identification (RFID) – Vendor-Managed Inventories (VMI) Copyright © 2016 Pearson Education, Limited. 14 -69

Supply Chain Risk Management • Supply Chain Risk Management – The practice of managing the risk of any factor or event that can materially disrupt a supply chain, whether within a single firm or across multiple firms. Copyright © 2016 Pearson Education, Limited. 14 -70

Supply Chain Risk Management • Operational Risks – Threats to the effective flow of materials, services, and products in a supply chain – – – – – Strategic Alignment Upstream/Downstream Supply Chain Integration Visibility Flexibility and Redundancy Short Replenishment Lead Times Small Order Lot Sizes Rationing Short Supplies Everyday low pricing (EDLP) Cooperation and Trustworthiness Copyright © 2016 Pearson Education, Limited. 14 -71

Supply Chain Risk Management • Financial Risks – Threats to the financial flows in a supply chain, such as prices, costs, and profits. – Low Cost Hopping – Hedging • • Copyright © 2016 Pearson Education, Limited. Production Shifting Futures Contract 14 -72

Supply Chain Risk Management • Security Risks - Threats to a supply chain that could potentially damage stakeholders, facilities, or operations. – – – Access Control Physical Security Shipping and Receiving Transportation Service Provider ISO 28000 Copyright © 2016 Pearson Education, Limited. 14 -73

Performance Measures Customer Relationship § Percent of orders taken Order Fulfillment § Percent of incomplete Supplier Relationship § Percent of suppliers’ § Time to complete the order placement process § Percent of orders shipped on-time § Suppliers’ lead times accurately orders shipped deliveries on-time § Percent defects in services and purchased materials § Customer satisfaction § Time to fulfill the order with the order placement § Percent of botched services § Cost of services and process or returned items purchased materials § Customer’s evaluation of § Cost to produce the service § Inventory levels of firm’s environmental or item supplies and purchased stewardship components § Customer satisfaction with § Percent of business lost the order fulfillment process § Evaluation of suppliers’ because of supply chain collaboration on § Inventory levels of work-indisruptions streamlining and waste process and finished goods conversion § Amount of greenhouse § Amount of transfer of gasses emitted into the air environmental § Number of security breaches technologies to suppliers Copyright © 2016 Pearson Education, Limited. 14 -74

5 Major Supply Chain Disruptions & How to Reduce Their Impact • http: //www. industrystarsolutions. com/blog/2018/09/5 -supply-chain-disruptions -reduce-impact/ 2021/6/9 75

• • • 1. 2. 3. 4. 5. 2021/6/9 Natural Disasters Transportation Failure Geopolitical Instability Price Hikes Cyber Attacks 76

1. Natural Disasters • Mitigation Tactic: Global Diversity – In different geographic regions is a great way to protect against natural disaster risk – Contingency plans – Distribution networks should be set up to easily move items through varying global regions. 2021/6/9 77

2. Transportation Failure • Mitigation Tactic: Cargo Carrier Assessments – Research, Analyze, Contract, Source, Monitor, Manage, and Record 2021/6/9 78

3. Geopolitical Instability • Mitigation Tactic: Cultural Research – Conduct research to understand the historical and current political climates of the geographic area where you plan to source from. – Any news? – A strong contingency that accounts for worst-case scenarios. 2021/6/9 79

4. Price Hikes • Mitigation Tactic: Market Exploitation – Understand the market’s trends, then take advantage of them. 2021/6/9 80

5. Cyber Attacks • Mitigation Tactic: Employee Training – Educating your employees with best practices. – Teaching employees how to watch out for suspicious behavior or strange emails is key to ensuring supply chain data is secure and these issues don’t arise. 2021/6/9 81

Deloitte’s Risk Model 2021/6/9 82

Strategic Approaches: Creating a Resilient Supply Chain Design Visibility 4. Agility Velocity Supply Chain Continuity Teams 2021/6/9 Supply Chain Understanding 1. Supply Chain (re)engineering The Resilient Supply Chain 3. Supply Chain Risk Management Culture Supply Base Strategy Collaborative Planning 2. Supply Chain Collaboration Supply Chain Intelligence Consider risk in decision making Board level responsibility & leadership 83

Developing a Risk Assessment Program 1. Decide on scope. – Do you plan to analyze all materials? How do you rank materials based on critical nature to process? 2. Decide on tools for analysis – Fishbone, FMEA templates 3. Involve the appropriate people. – Purchasing, materials planning/management, process development, quality, manufacturing, company leadership 4. Determine goals and timeline 5. Setup frequency of assessment and monitoring program 2021/6/9 84

Cause and Effect Analysis (Fishbone Diagram) No Stock Available Materials Supply Problem Lead-Time Too Short Failure to Achieve Plan Inflexible Systems Forecasting Problems Capacity Constraint Failure to Deliver on Time Inadequate Communications Poor Scheduling Inadequate Supplier Management Carrier Performance 2021/6/9 Poor Process Control Quality Problems 85

2021/6/9 86