The Global Supply Chain Ups the Ante for Risk Management

Insights from a Quantitative Study 08/11/2015

By Lora Cecere

Founder and CEO Supply Chain Insights LLC

Page 2

Contents

Research

Disclosure

Executive Summary

What Is Risk Management?

Current State

Why a Risk Management Program?

The Ports as a Risk Issue

Risk Management Fundamental to the Global Organization

Supplier Sensing and Supplier Development Programs

Preventing a Material Event

Recommendations

Conclusion

Appendix

Prior Reports in This Series

About Supply Chain Insights LLC

About Lora Cecere

Endnotes

3 3 4 6 6 8

10 12 13 15 17 18 19 23 24 24 25

Page 3

Research As companies become more global, the need for risk management increases. This report takes a

critical look at the current practices of Supply Chain Risk Management. The basis of the report is a

quantitative study completed in July 2015. The study is based on a quantitative survey designed for

and tendered to a research panel. The design is based on insights from a prior survey conducted in

2014. To participate in the study, respondents were screened on company type, company size and

familiarity with risk management practices.

In Figure 1, we share the objectives, methodology, and demographics of the Risk Management study

that is the basis of this report.

Figure 1. Overview of the Risk Management Analysis

Disclosure Your trust is important to us. As such, we are open and transparent about our financial relationships

and our research process. This independent research is 100% funded by Supply Chain Insights.

These reports are intended for you to read, share and use. Please share this data freely within your

company and across your industry. All we ask for in return is proper attribution when you use the

materials in this report in public forums. We publish under the Creative Commons License Attribution-

Noncommercial-Share Alike 3.0 United States and our citation policy is outlined on the Supply Chain

Insights Website.

Page 4

Executive Summary Unfortunately, supply chain disruptions are a fact of life for today’s global multinational company. The

reasons are many. A risk management event can be triggered by natural events, geopolitical shifts,

economic uncertainty and demand/supply volatility.

Historically, the roots and genesis of risk management programs were based on attempts to reduce

insurance costs. Today it is much, much more. The focus is on prevention, early sensing, and the

execution of well-orchestrated plans to mitigate the impact of a disruption. Global supply chain

leaders understand that designing and implementing a robust risk management practice is essential

and fundamental to running a global business. The size of the bubble in Figure 2 indicates the relative

level of risk today, and the colors correspond to the expected change in risk (5 years ago vs. 5 years

in the future).

Figure 2. Comparison of Risk Drivers for the Past Five Years and Future Five Years

Page 5

While product quality and supply chain visibility are declining but still important, the areas of

operations complexity and the definition of globalization infrastructure is increasing. The areas of

economic uncertainty, supplier reliability, along with demand volatility, are continued risk factors.

Over time, as supply chains morphed from regional to global multinational organizations, globalization

and regulatory compliance increased. As a result, procurement has shifted from traditional programs

focused solely on contract management, price and term negotiations, and supplier scorecards to

include the evolution of supplier development, to manage product quality and multi-tier supplier

relationships, in and across value chain relationships.

Today is a less certain world than a decade ago. Geopolitical shifts, economic uncertainty and

demand/supply volatility are rising. In addition, to spur growth companies are quick to add products to

the item master, but slow to rationalize the portfolio. The rising complexity of items sold decreases the

organization’s ability to forecast, and the longer lead times across multiple tiers of sourcing and

supply increases the Bullwhip Effect’s impact (distortion of the demand signal across multiple tiers of

the value network). As a result, there is a greater need for supplier development and supplier sensing

to reduce supply risk. Inventory management and supplier financial sensing grow in importance with

the increase in uncertainty.

Risk management is no longer narrowly focused: a technology, a response to a natural disaster, or

improving supply chain visibility. Instead, it is more holistic with a focus on managing demand and

supply variability cross-functionally and improving outcomes in an uncertain world.

In this report, we share insights on the current state of risk management programs while providing

recommendations on what defines excellence.

Page 6

What Is Risk Management? To ensure clarity, let’s start with a definition. For the purposes of this report, supply chain risk

management is defined as the proactive identification and assessment of potential risks to the supply

chain along with the development of strategies to avoid these risks and avoid supply chain disruption.

A disruption is a failure in cost, quality or customer service. The event can be external or internal to

the enterprise. It also can be material affecting performance to the degree that it must be declared, or

stated, on the financial balance sheet in corporate reporting.

Current State When business leaders are asked about relative business pain, as seen in Figure 3, risk

management ranks lower than other business drivers. Does this mean it is unimportant?

Figure 3. Top Issues of Business Pain for the Respondent

Page 7

We think no. Instead, risk management programs are multi-pronged with a focus on mitigating

multiple issues—talent availability, volatility, product quality, and supplier reliability—causing business

pain. Successful risk management programs are focused on the mitigation of these and many other

critical business issues.

The business drivers vary by industry. As shown in Table 1, while talent development and the need to

build global supply chain teams is pervasive across the process, discrete, and retail industry sectors,

the process industries—consumer products, food and beverage, chemical, and pharmaceutical—are

struggling with the speed of business, changing regulations, and the clarity of business strategy. In

contrast, discrete industries are more focused on product quality, supplier reliability, and cross-

functional alignment. Retail, with aging systems and increased security risks for the protection of

customer data, struggles more with the ability to access and use data and the management of value

network relationships. The risk management program differences vary more by industry than by role

(for role-based analysis reference Figure E in the Appendix).

Table 1. Top Issues of Business Pain by Industry sector

Page 8

Why a Risk Management Program? As shown in Figure 4, for most, it is just the right thing to do. Based on business impact and the need

for prevention, it is also a focus of the leadership team. It is a horizontal cross-functional process.

Over the last ten years, risk management and corporate social responsibility programs have become

tightly intertwined. This is an increasing trend.

Many times, approximately 47% of the time, risk management importance is driven by a disruption. A

disruption stops the flows of the supply chain. It can be driven by a natural event, or a major quality

issue, but the impact is the same. The supply chain stops functioning. Normal operations come to a

halt. These events scar an organization leaving multi-year impacts.

Figure 4. Reasons for Risk Management Importance

A global organization is more dependent on the reliability of the nodes of the supply chain than a

regional supply chain. The longer trade lanes result in a greater bullwhip effect and a distorted view of

market demand. To compete, companies must constantly change production schedules and logistics

agreements and tenders. The data is ever-changing, necessitating the need for an inter-enterprise

system of record to manage value networks.

Page 9

The unfortunate reality is that in today’s supply chain most trade is supported by email and

spreadsheets. Traditional connectivity methods of Electronic Data Interchange (EDI) while important

have too much latency to manage the hour-by-hour and cross-time-zone requirements of supply.

Unfortunately, only 8% of flows for quality and inventory are managed through canonical

infrastructure through B2B networks0F

i. These requirements cannot be managed through extensions of

Enterprise Resource Management (ERP) or Advanced Planning Systems (APS). Instead, it requires

the building of outside-in processes using business networks based on many-to-many data models.

(For more on these requirements reference the related research available from Supply Chain Insights

at the end of this report.)

In addition, multi-tier inventory management, network design, and supply chain visibility increase in

importance. The reliability in the flows of product, cash, and information across borders and

continents is paramount. The trade lanes are longer. In-transit inventory is greater. When things go

wrong the impacts are greater. The impacts are greater than in the times of a simpler, more regionally

controlled supply chain.

In Figure 5, we share the impacts of supply chain events for the period of 2010-2015.

Figure 5. Impacts on Supply Chain Results

Page 10

Note that supply chains recover better and more quickly from a major disaster like a hurricane,

tsunami, flood or a volcano, than they can from major port disruptions. Supply can usually be sourced

from multiple points and the supply chain, if properly designed, can pivot quickly—alternate supply,

redeployment of inventory, and new shipping lanes—in the face of a natural disaster. In the last

decade, Intel’s supplier development efforts in Japan, and Seagate’s in Thailand, spawned best

practices in supplier sensing and supplier development proving that when sensed early, and

processes are well-developed, that the impact of a natural disaster on the supply chain can be

mitigated.

The ports are a different story. When there is a problem, there are few alternatives. Resolution is

slow and deeply enmeshed in government bureaucracy. When there is a port slowdown, lead-time

variability increases ten-fold1F

ii. The supply chain can respond better to longer lead times than supply

variability. In a port slowdown, containers sit on the water with little to no predictability for unloading.

The node of the supply chain becomes unreliable, putting pressure on other nodes. The time for

resolution is longer and less manageable.

The Ports as a Risk Issue Ocean cargo and port infrastructure is a looming issue for the United States. The 2015 port slowdown

is the tip of the iceberg. While the 2015 port slowdown was heralded as a labor issue, the business

drivers were more fundamental. The introduction of larger ships, with a need for greater port capacity

for unloading, was compounded by the transfer of ownership of chassis (the undercarriage of the

container for road transit) from the ocean carriers to the transportation providers in the ports. Port

authorities—especially in land-locked ports—were caught flat-footed. Manufacturers did not know

what to do. For many, due to time and cost, shifting ports was not an option.

As shown in Figure 6, ship size has slowly increased over the last decade. Ships are now three times

greater in size than they were ten years ago. The increase in draught, or depth, of a loaded container

ship impacts logistics flows through major throughways like the Panama and Suez canals.

While manufacturing processes are being redesigned for shorter cycles and smaller batches to

improve reliability, in ocean freight, it is the inverse. Ocean carriers are moving towards longer cycles

and lumpier supply. This requires the redesign of the supply chain for push-pull decoupling points

with greater focus on multi-tier inventory design. Most companies are not up to the challenge.

The larger ships, coupled with slow steaming of ocean vessels to improve fuel efficiency, are

increasing transit time; but, it is also increasing in-transit inventories. This has an impact on working

Page 11

capital and obsolescence. As a result, when there is a port slowdown, the issues are messier. The

ships are bigger and the risk is higher.

Figure 6. Changes in Ship Size2 F

iii

In supply chains with short-life-cycle products like high-tech and electronics, slow steaming of the

ocean vehicles, and an increase in port reliability issues, puts greater volume in the air with an impact

on costs and greenhouse gas emissions.

To stem the issues in North America, there is a need for a port infrastructure redefinition. Unlike

European countries that are quickly redesigning ports for the Triple-E ocean container ships (over

14,000 TEUs), the United States is slow to react. As a result, future port issues will be an even

greater risk issue to the North American supply chain. To combat the issue, large companies are

seeking help from government agencies to put more funding and attention on supply chain

infrastructure. Risk management is shifting from an enterprise to a value chain discussion, including

lobbying efforts by major global multinationals to improve commerce logistics infrastructure.

Page 12

Risk Management Fundamental to the Global Organization Globalization is, and continues to be, a major impetus to program development for risk management.

The building of the global multinational company is a journey. It happens over many, many years.

The systematic risk management programs are typically managed at a leadership level (reporting to a

Chief Operating Officer or Chief Executive Officer 35% of the time) or by the supply chain

organization (43% of the time). It is seldom a reporting relationship managed by the finance team (8%

of respondents). Leadership is a major factor for success. Based on interviews with clients over the

past decade, this is a shift. The early risk management programs were more deeply rooted in finance

or procurement. As they have matured, they have been elevated in the organization and become

more cross-functional. As shown in Figure 7, they are seldom outsourced. It is just too critical.

Figure 7. Structural Definition of Risk Management Programs

A standalone group—managing cross-functional and interrelated business issues as a risk

management program—is directionally more common in discrete organizations than a process-based

Page 13

industry. Why? Discrete organizations are more dependent on contract manufacturers and

intertwined value-chain relationships between first, second, and third tier manufacturers. With

complex Bill of Materials (BOM) relationships, and large quality of conformance issues with global

suppliers, these brand owners learned the importance of risk management early. Only 6% of

respondents are just getting started and 22% believe that their programs are much better today than

five years ago.

Supplier Sensing and Supplier Development Programs To mitigate risk, over the last decade, companies have initiated supplier development programs. As a

part of these cross-functional initiatives to sense the financial health of suppliers, brand owners sense

financial health and deploy teams to help improve the supplier relationship. This program is a

characteristic of a supply chain leader.

While traditional procurement programs are more focused on buy-sell relationships and reducing

supplier costs, supplier development programs are more proactive with a focus on helping improve

supplier health. The leader knows the value chain is dependent on healthy and profitable supplier

relationships.

Figure 8. Supplier Visibility

Page 14

Supplier development starts with supplier visibility. The majority of customers, as shown in Figure 8,

have visibility of their first tier of suppliers but fewer have visibility of the total supply chain. When a

disaster happens, the first step in deployment of resources is visibility. It becomes mission critical.

The monitoring of supplier health is a characteristic of a mature risk management program definition.

Financial sensing of suppliers grew in importance following the 2007 recession. Leaders today have

advanced financial sensing capabilities for strategic suppliers. We share the current state of this

practice in Figure 9.

Figure 9. Multi-Tier Supplier Visibility

Note in Table 2 that when companies rate themselves as mature on risk management, they have two

dominant characteristics. The first is leadership support and the second is financial supplier sensing.

Financial supplier sensing can either be managed through a third-party or through the use of financial

data from third-party aggregators like YCharts, or OneSource (now Avention).

Page 15

Table 2. Characteristics of Companies Rating Themselves Higher on Supplier Risk Management Programs

Preventing a Material Event The value of risk management is rooted in business continuity. In 2014 companies experienced an

average of three business discontinuity events, with at least one resulting in a material impact to the

balance sheet included in financial reporting. This is significant. In the survey, 28% of the supply

chain disruptions led to reporting balance sheet impacts.

Page 16

Figure 10. Impact of Disruption

While 22% of companies surveyed reported a strong improvement in risk management, this data is

similar to the survey response from a year ago. While the populations of the two surveys are

different, and it is difficult to draw conclusions, we do know from discussions with supply chain

leaders that many are struggling to make progress. Many feel that they are treading water.

Page 17

Recommendations The most advanced risk management programs are deeply rooted in preventive measures. The focus

is top-down and horizontal—working across functional silos—and led by a business leader. They are

also deeply embedded into other horizontal processes like network design, corporate social

responsibility, and supplier development.

When it works well, companies are aggressive in the design of inventory buffers, with active work

through network design to build the right push-pull decoupling points, implementation of supplier

monitoring and scorecarding, and the development of business continuity plans. The common

threads are prevention, and readiness.

Figure 11. Important Techniques to Mitigate Risk by the Survey Respondents

In building and rethinking risk management programs, keep these five elements in mind:

1) Leadership Matters. In this report, companies who rate themselves higher on the execution of risk

management programs are more likely to be driven by leadership support. This is not a program that

can be effective managed bottoms-up.

Page 18

2) Focus on Multi-Tier Inventory Management. The management of the forms and function of

inventory, and the design of the network, are paramount to buffer risk. Inventory is the most important

buffer and companies with strong risk management programs define an inventory planning position and

are active and knowledgeable about the use of multi-tier inventory management technologies.

3) Implement Supplier Sensing and Supplier Visibility Programs. Visibility of suppliers—locations

of facilities and their suppliers—is the first step. The second is supplier financial sensing. Companies

with advanced risk management programs redesign the role of procurement to build, not just audit,

value chain relationships.

4) It Is About Much, Much More Than Technology. While technology vendors espouse risk

management as a technology, it is much more than the deployment of a technology. While visibility

technologies are an important part of the solution, they are not the answer.

5) Things Happen. Not All Risks Can Be Prevented. Demand and supply risks are increasing. They

cannot be totally prevented. The design of inventory buffers and supplier visibility programs are critical;

but, it is also important to have well-defined practices and drills to help the organization to mobilize

quickly in the face of a disaster. It is not a time for indecision. When a disruption happens, there needs

to be a clear definition of protocols and responsibilities. Many advanced companies implement drills

and practice deployment to ensure readiness.

Conclusion The global supply chain has more risk than the regional supply chain and requires an active and

robust risk management program. The most successful are multi-prong with an equal focus on

prevention and recovery. The mature supply chain leader knows that a disruption lies ahead. They

are impossible to eradicate. Having a mature risk management program is the foundation for

business continuity in the face of an uncertain world. For the global supply chain, a robust risk

management program is essential.

Page 19

Appendix

In this section, we share the demographic information of survey respondents, along with research

findings to support the key insights listed in this report.

The names, both of individual respondents and companies participating, are held in confidence. We

never share the name of the respondents. In this section, the demographics are shared to help the

readers of this report gain a better perspective on the results. The demographics and additional

charts are found in Figures A–G. To help the reader, at the bottom of each image are the specific

questions asked in the survey along with the survey demographics.

Figure A. Industry Overview of Respondents

Page 20

Figure B. Overview of Company Respondents

Figure C. Role and Regional Demographics

Page 21

Figure D. Reporting Structures: Responsibility for Risk Management in the Organization

Figure E. Relevant Business Pain by Business Role

Page 22

Figure F. Nature of Supply Chain Risk Management

Figure G. Change in Risk Management Performance vs. Five Years Ago

Page 23

Prior Reports in This Series Over the course of the last three years, our research methodology and report content has changed

and matured. You can track our progress, and find relevant, industry-specific information here:

Inventory Optimization in a Market-Driven World

Can you afford the Risk?

Building Effective Business Networks in Process Industries

Building B2B Networks: Who are the Players?

Page 24

About Supply Chain Insights LLC Founded in February, 2012 by Lora Cecere, Supply Chain Insights LLC is focused on delivering

independent, actionable, and objective advice for supply chain leaders. If you need to know

which practices and technologies make the biggest difference to corporate performance, turn to us.

We are a company dedicated to this research. Our goal is to help you understand supply chain

trends, evolving technologies and which metrics matter.

About Lora Cecere Lora Cecere (twitter ID @lcecere) is the Founder of Supply Chain Insights LLC and

the author of popular enterprise software blog Supply Chain Shaman currently read

by 5,000 supply chain professionals. She also writes as a Linkedin Influencer and

is a a contributor for Forbes. She has written three books. The first book, Bricks

Matter (co-authored with Charlie Chase). published in 2012. The second book, The

Shaman’s Journal, published in September 2014, and the third book, Supply Chain

Metrics Metrics That Matter, published in December 2014. Her fourth book The

Shaman’s Journal 2015 will publish in September 2015.

With over thirteen years as a research analyst with AMR Research, Gartner Group, and Altimeter Group, and now as a Founder of Supply Chain Insights, Lora understands supply chain. She has

worked with over 600 companies on their supply chain strategy and speaks at over 50 conferences a

year on the evolution of supply chain processes and technologies. Her research is designed for the

early adopter seeking first mover advantage.

Page 25

Endnotes

i B2B Networks in Process Industries, Supply Chain Insights, March 10, 2015, http://supplychaininsights.com/building-effective-business-networks-in-process-industries/ ii Lora Cecere, Forbes, January 10, 2015, http://www.forbes.com/sites/loracecere/2015/01/08/the-chassis-is-the-missing-link/ iii Source: Captain J. William (Bill) Cofer, President, Virginia Pilot Association, presentation to Virginia Port Authority Virginia's Offshore Fairways (November 27, 2012)/http://www.virginiaplaces.org/transportation/shiptransport.html