Resilience Requires Risk Management

In this article, part of a 4-article series, we discuss the fourth pillar of action to building a resilient supply chain: risk management.

Make sure to read the entire series, subscribe to our newsletter.

Resilient Supply Chain

Emanating from the supply chain visibility that technology can provide (read previous article), it is now possible to start mapping our supply chain. First, identifying our main suppliers, their primary and secondary suppliers, our logistics partners and carriers, and our customers. Second, identifying our products and their importance to our business will lead to identifying the critical components in our supply chain and their suppliers. Once we overlap these two maps, we can see where our most critical components are come from and how many suppliers we have for the same component. Another important element to review is our customers and their sales so that we can identify markets or categories where the same customer holds a large portion of the volume. Risks are not only at the supplier level, they could also manifest at the carrier levels and at customer level, so reviewing the entire supply chain will raise the potential points of vulnerability.

Identifying the risks

Once the vulnerabilities are raised, we can start identifying the kinds of risks that we could face. It could be elements outside of our control (such as shifts in customer demand, geopolitical issues, natural disasters and pandemics), deliberate threats (theft, sabotage, cyberattacks), governmental (tariffs, regulations), and resource limits (capacity of production). Once we have a better understanding of the potential risks and their geographical locations, we can start creating mitigation plans. One such example named since the beginning of the pandemic is to make sure to increase diversity of suppliers. It will potentially reduce economies of scale but having two suppliers from two different parts of the world, can help reduce the risk of stopping supplies because of any type of vulnerability. Of course, this is not always possible, and other solutions must be developed to compensate.

The exercises mentioned above are as good as the effort we put in creating them and maintaining them. They require constant revision and upkeep. They also need to be challenged with different scenarios, with what-if analysis. It’s impossible to think of everything so using the tools and techniques that are available to make us think outside the box will help in covering more options. Tools such as the FMEA, vulnerability map, SWOT, PESTEL, 5 forces, probability/impact matrix, and others will all provide ways of thinking about risks and potential mitigation plans to identify and face them. Don’t limit the reflection to known situations, think well outside the box, it’s the only way to gather as many ideas as possible so that we are better prepared for any eventuality. For example, a few years ago to improve their resilience, the Quebec public safety offices organized an exercise of a zombie attack!

“Supply chains are these dynamic, complex systems [that] are vulnerable to numerous risks. Because of their interconnectedness, even small, localized events can escalate rapidly and cause significant disruptions”. (WEF, 2013)

Response team for resilient risk management

Finally, we also need to establish the response to a crisis. Even though we can’t predict with certainty what will happen, we can make plans and high-level processes establishing how, when and by whom the disruption will be handled. Creating a task force to handle these situations is a step towards a rapid reaction time. This team is then separate in three specific groups:

1. the “watchers”: active prior to the disturbance, they are tasked with looking at the different set of data available from which they can identify signals that can help anticipate that a crisis may be coming, they confirm the event which sends the signal to put in action the second team,
2. the “crisis management” team is then a dedicated task force per type of event and who manages the impacts and know what they need to look for, react to, and plan in the short-term to get over the crisis, and finally,
3. the last task force, “future looking”, whose responsibility is to look toward the future, past the recovery, and to create the necessary processes and mid to long-term plans for surviving the crisis and coming out of it stronger.

These three teams know their responsibilities and where they cross paths because they practiced, they rehearsed, and they learned together. Much like we all do in our organizations when, at -20C, we perform fire drills to make sure that no one is left behind.

No one has a crystal ball that accurately predicts 100% of events, the best we can do is look at the data we have and make the right decisions for that moment. And accept that sometimes the decisions we make will have been the wrong one, even if they were made with the best intentions and following our organizational culture and strategy.

CONTACT US TO FIND OUT MORE!

To receive all the articles, please register for our newsletter‍

Photo Credit: Pete Linforth de Pixabay