Society of Risk Management Consultants Spring Conference March

Society of Risk Management Consultants Spring Conference March 24, 2012 Business Impact Analysis It Can Happen to You: The Blind Spot in Supply Chain Risk Alma College, Ontario - 2008

the event is a surprise (to the observer) and has a major impact. After the fact, the event is rationalized by hindsight. Thailand Flooding (October/November) Joplin, MO Tornadoes (May) Christchurch Earthquake (February) Tuscaloosa, AL Tornadoes (April) Brisbane Flooding (January) Honshu, Japan Earthquake (March) Hurricane Irene (August) Pharmaceutical Packing Facility Fire (March) Tropical Storm Lee (September) Dallas Hail Storm (May) U. S. Snow and Ice Storms (February) Cyclone Yasi (February) Southern USA Tornadoes (April) Missouri River Flooding (June) Mississippi Flooding (April) Net Est. Impact $ 300 m 270 m 180 m 160 m 130 m 125 m 75 m 60 m 40 m 30 m 20 m 15 m 10 m $ 1, 500 m 2

One 2011 Black Swan Thailand Floods 2011 Estimated Losses: 4 th costliest disaster ever More than $50 billion economic losses Up to 80% supply chain-related How much will be Recoverable? ? ?

Market analyst: “Seagate stands to make the most out of the crisis by gaining market share at the expense of Western Digital ” 4

Financial Executive Concerns ü Property and supply chain risks represent 2 of the top 3 risks to top revenue drivers, according to financial executives ü Roughly 50% of surveyed executives believe their firm was at least somewhat negatively impacted by their supply chain, often due to propertyrelated risks

Executive Goals & the Blind Spot Executives acknowledge the risks, but don’t make it a high priority to deal with it? How many incorporate property-related risk evaluation into supply chain risk management efforts?

Pressures lead to increasing risks and accountability to manage risk

And yet…

The Evolving Landscape ü Internal risks – Traditionally covered ´ External risks? – Do risk management efforts match that for internal risks? ⇒ Increasing importance / blurred distinction ⇒ The property risk and resiliency blind spots

Tackling the issue: The need for information… Understanding risks in quantifiable terms provides the roadmap

Business / Supplier Impact Analysis Measures the enterprisewide impacts to an organization in the event of a major disruption to key business processes ð Financial $ quantification of specific exposures, leveraging engineering risk data ð Applied to internal as well as external processes / facilities

Information sharing is critical Operations Finance Purchasing Risk Management to create a prioritization map

Quantification approach • Dependency mapping – identify ultimate revenue / variable margin streams directly & indirectly impacted • Interdependencies include ‒ Operational (plant to plant) ‒ Product or associative (hardware / service) ‒ Supportive (data center, logistics, etc. )

Quantification approach • Assumption needed for recovery / replacement time – worst case scenario • Assess mitigation capabilities – 2 stage process – Internal: Inventory, supplier alternatives, etc…net against incremental expenses anticipated – External: In-depth supplier analysis to evaluate resilience • Consider market share impacts (post-recovery) – Estimate initial loss of customer base & recovery curve

BCP Assessment

Output

Risk evaluation – physical & financial Consider the relationship between physical risk and impact to the business when evaluating risk mitigation strategies

Evaluation summary 1) 2) 3) 4) 5) 6) Business segment selection Identify key suppliers and categorize Quantification process Physical risk evaluation Apply to other supply chain threats Consider mitigation / transfer issues and solutions

Directional Options Cost / benefit comparisons

Some examples… ü Carpet manufacturing chemical supplier ü Medical device supplier exposures ü Computer manufacturer outsourcing decision ü Sr. management / BOD support for BCP / RI efforts ü Properly focusing RM resources (RI, BCP, transfer, …) > $400 M + Reputation + Market Share + Shareholder Value

In short… • BCM more critical; internal and external application • BIA provides prioritization to make manageable – Quantifications with assessment of physical risks – Optimizes mitigation strategy selection – Framework includes loss prevention Does the management of internal and external risks match?

The next “Black Swan”?

Eric Jones, CPA, CVA, CBCP, CBCA FM Global AVP, Manager Business Risk Consulting eric. jones@fmglobal. com 972 -731 -1613 24