Supply chain risk management has assumed greater priority in today’s globally
interconnected supply chains in a volatile, uncertain, complex, and ambiguous world.
To see the importance of risk to supply chains,
you need look no further than the three Vs. The three Vs are core supply chain goals.
Increasing visibility relates to ready access to information.
Increasing velocity relates to fast throughput.
The third goal, minimizing variability, directly relates to risk. Variability is the naturally
tendency of activities to fluctuate around an average. Similarly, risk is basically uncertainty.
Both threats and opportunities are uncertain so they are both considered types of risk.
Investors and markets dislike variability and uncertainty. They reward organizations who can
minimize their downside threats even if this reduces some upside opportunities. Having and
using a sound risk management methodology is key to reducing both variability and uncertainty.
An example is the ISO 31000 Risk Management standard,
which includes a process framework like this. Any organization can use this methodology because
each will carefully define its risk appetite as part of establishing the context. A risk-averse
and a risk-seeking organization can use the same process but arrive at different responses.
Next, risks are identified, analyzed, and evaluated. Identification records
all known risks, and a classification helps ensure the process is thorough. Even with
this process there may be some unknown risks that no one has identified yet.
Supply chain risk categories might include strategic,
supply, demand, process, environmental, hazard, financial, malfeasance, and litigation risks.
Risk analysis starts with a qualitative assessment of probability and impact. Both can be given
percentage weights. Multiplying the probability percentage by the impact percentage results in a
percentage risk rating. Risks over a threshold can then be given an appropriate response.
For significant risks, organizations can use the expected monetary value method.
This method still uses probability times impact, but now impact is measured in monetary
units. Multiplying monetary impact by the probability produces a risk-weighted amount.
It is a threat if negative and an opportunity if positive.
For example, say a risk has a 40 percent probability and could cost the organization
200 dollars if it occurs. This would be an EMV of minus 80 dollars, which is a threat.
The cost of a risk response can be factored in to find the net monetary impact. For example,
if a response that cuts the probability in half costs 100 dollars, then the net
impact of minus 300 dollars times 20 percent probability is an EMV of minus 60 dollars. The
organization may choose to make this response because it has a better EMV than no response.
The idea is to ensure that the cost of the response is appropriate to the given risk.
A risk evaluation is the last part of assess risks.
Evaluation prioritizes risks based on priority, impact, and needed response urgency.
The result of the evaluation is a choice of risk treatment or response.
Responses include accept, avoid, transfer, and mitigate.
Accept means to do nothing other than watch the risk,
such as when there are no cost-effective responses or the impact is negligible.
Avoid means to change the plan to eliminate the risk or its impact.
Transfer involves insurance or a contractual risk transfer to a supply chain partner.
Mitigate is to take preventive actions to reduce the probability or impact of a risk.
In addition to these actions, note how ISO 31000 also has an ongoing
communication and consultation process, a monitoring and review process,
and a record and report process.
The main record is called a risk register, which assigns an ID and rating to each known risk,
assigns a responsible party, and tracks responses.
Let’s drill down into supply risks. Supply risks include availability, pricing, quality,
supplier lead time, transportation lead time, customs, and labor. Note how for each risk the
organization has selected both a preventive and a contingent action. The preventive action is for
before the risk event occurs, while the contingent action is for after the risk event occurs.
For the quality risk, for example, a penalty clause in supplier contracts can provide a
disincentive to providing poor quality. If quality fails to meet expectations, then the supplier can
be placed on probation. We hope you enjoyed this overview of supply chain risk management.