© 2011 ChainLink Research—All Rights Reserved Page | i

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

By: Bill McBeath May, 2011

Introduction / Background

Shortly after the 911 terrorist attacks, I was invited to participate in war games the purpose being to simulate and evaluate the impact of a terrorist attack on US supply chains. (Coincidentally, or maybe intentionally, the war games were conducted at the same “undisclosed location” that Dick Cheney was whisked off to during the 911 attacks . . . or so we were told). At the end of those war games, as we were making our concluding comments, I got on my soap box to make some points—“We have gone through a revolution in supply chain, greatly reducing inventories and outsourcing manufacturing to lower-cost regions, with tremendous benefits. But it has made our supply chains longer, leaner, and much more vulnerable. The next revolution in supply chain must be about making them more resilient.”1

For over a decade now, we (and others) have been talking about

the importance of supply chain resilience. Considering how devastating disruptions can be to the brand, shareholder value, competitiveness, and a firm’s ability to trade, we continue to assert that building a resilient supply chain is one of the most important assets and competitive foundations that a company can develop.

We felt that it was time to take a measurement of the state of the industry: How far have we come? What kinds of investments are being made in resilience? What is the scope of responsibility for supply chain organizations? And how well are we actually managing risk?

To answer these questions, we conducted a broad survey and set of interviews. Our findings confirmed that we have a long, long way to go. Investments in supply chain risk are pathetically low, and it shows—our survey respondents rated their own organizations’ risk management capabilities quite low.

But to keep things in perspective, I must add that we also have come a long way in the last decade. Now there are many more people who are aware of and are talking about supply chain resilience than there were a decade ago. At the executive team level, it is at least part of the conversation, if not a high priority. And some real leaders have emerged, creating new innovative practices and approaches. Further, we see much richer and more integrated sources of real-time intelligence services, databases, analytics, and supplier management systems.

With that balanced view in mind, we present the findings of this research study to explore answers to the critical questions we posed.

1 I also made the point that preparations and mitigations for disruptions should not be cause-specific (What if there is a terrorist attack?), but rather should focus on the impacts (What if our plant cannot ship product for a period of time–how should we be prepared?)

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | ii

Contents

Introduction / Background ............................................................................................................................. i

How Strategic is Managing Supply Chain Risk? ............................................................................................ 1

An Incident-Driven Priority ....................................................................................................................... 1

The ROI of Resilience ................................................................................................................................ 2

Low Level of Investment in Supply Chain Risk Management ................................................................... 2

Supply Chain Teams’ Role and Effectiveness in Managing Risks .................................................................. 5

Proactive vs. Reactive Approach ............................................................................................................... 9

The Myth of Black Swans .......................................................................................................................... 9

Managing Multi-Tier Risks and Secondary Effects ........................................................................................ 9

Conclusion ................................................................................................................................................... 12

Appendix A: Supply Chain Risk Related Research and Resources .............................................................. 13

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 1

How Strategic is Managing Supply Chain Risk?

An Incident-Driven Priority The devastating 2011 Japanese tsunami was a wakeup call for many companies. Even many of those not immediately affected have been rattled by the events. Senior executives around the world are meeting with their operational teams to ask the questions, “How are we impacted? What are you doing to ensure continuity of supply? What changes should we make to better prepare for future incidents?” Unfortunately, we have seen over and over that for most companies the memory of this will fade, and the executive team’s attention will be consumed by other matters that are deemed higher priority. This is understandable, because top executives’ metrics, compensation, and the firm’s stock price are usually not impacted much (or at all) by the company’s level of supply chain resilience . . . until after a disruption occurs. Our past research has shown that executives’ tolerance for risks tends to be quite a bit higher than many of us would consider reasonable.

In late March and early April 2011, in the wake of the Japanese tsunami, we conducted a survey about supply chain risk. Our survey found that supply chain resilience tended to be reviewed and managed “down in the trenches” by the people with immediate responsibility for operational functions, as well as by the head of those functional units, such as the VP supply chain (see Figure 1, below). Review by executives in charge of the business unit or by corporate executives is considerably less common. (You can be sure that those same executives are reviewing sales numbers daily or weekly). This shows that for about 80% of companies, supply chain resilience is not yet a priority at the executive level, except for those executives directly responsible for supply chain functions.

Figure 1 – Level at Which Supply Chain Resiliency is Reviewed

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 2

The ROI of Resilience As one survey respondent put it, “I don’t have to sell the priority of risk management after a major disrupting event occurs—at that point it’s already ‘all hands on deck.’ But before the event, it is very hard to get the organization to make investments and be proactive.” Another respondent told us, “I can only justify investments in risk management tools, services, or personnel if I present a very strong ROI based on how big are the chances of a disruption.” This is understandable, but it is extremely difficult to calculate realistic odds and also to convince executives of the ROI for an event that they intuitively believe is very unlikely (see The Myth of Black Swans below).

However, studies and experience have shown that disruptions are extremely common. As well, disruptions have a huge impact on shareholder value. A study by Vinod Singhal and Kevin Hendricks showed, on average, over a 25% drop in stock price when a disruption occurred. That should make a compelling case for an ROI on managing supply chain risk.

Figure 2 – Impact of Supply Chain Disruptions on Shareholder Value

Low Level of Investment in Supply Chain Risk Management Another revealing survey question was how much is spent on supply chain risk each year. Most companies invest a paltry amount, less than $50K annually. Only about 5% spend over $1M and none in our survey spends more than $3M per year on managing supply chain risk. There was not a strong correlation between company size and the amount invested. Some mid-size firms spend considerably more than many large firms. This generally low level of investment is yet another indicator of the disconnect between the high impact of supply chain disruptions and the low level of attention and funding spent in mitigating them.

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 3

Figure 3 – Amount Spent on Supplier and Supply Chain Risk

Our survey confirmed that risk assessment is a common part of the supplier selection process. Almost 90% of respondents said that supplier risk is frequently or always part of their supplier selection process (Figure 4). However, the thoroughness of the risk assessment varies greatly, depending on the company. For some companies, a quick check of financial health is it. Others will take a look at the exposure of suppliers’ plants to natural hazard and geopolitical risk, as well as the suppliers’ business continuity processes and policies. The majority of companies do not consider risk beyond immediate suppliers. However, a few more sophisticated firms will consider not just the immediate supplier, but risks in multiple tiers upstream (more on this in the section “Managing Multi-Tier Risks and Secondary Effects,” below), and have more far-reaching monitoring systems in place to get early warning indicators when something is potentially going wrong.

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 4

Figure 4 – Role of Risk Assessment in Supplier Selection

In spite of the fact that almost 90% of companies surveyed are assessing supplier risk, fewer than 30% have a published set of resilience and risk mitigation standards for their suppliers (Figure 5, below).

Figure 5 – Published Resilience Standards for Suppliers

The frequency with which companies conduct assessments and audits of risk factors for their suppliers depends on how critical those suppliers are (see Figure 6, below). It is notable that almost 40% of respondents never conduct assessments or do so less than once a year, even for their most critical suppliers. About 10% of firms run these assessments twice a year, or more often for important suppliers. Here again, this highlights the difference between the “haves and have nots” of supply chain risk—i.e.,

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 5

those who make managing supply chain and supplier risk a key corporate priority vs. those for which it is superseded by other priorities.

Figure 6 – Frequency of Supplier Risk Assessments

We did probe what makes a supplier Class A/critical. For many of our respondents, a supplier is critical if the respondent’s firm cannot ship product without the component or material that the supplier provides and one or more of these are true:

• It is difficult to find an alternative supplier with the same capabilities.

• They supply highly engineered materials with few sources. In these cases, it may be necessary to get alternative sources pre-approved by engineering.

• There is a high cost of changing suppliers, for example the supplier has built custom tooling for your components. Here, it may be worth investing in backup copies of these tools.

• You have a sophisticated relationship with the supplier that took time to develop—this might include engineering, manufacturing, quality, and other dimensions.

Supply Chain Teams’ Role and Effectiveness in Managing Risks

Companies face a huge variety of risks. Not all of these risks are the duty of the supply chain group to fix or manage. In the survey, we explored which types of risks the SCM function should be managing and which risks are outside their responsibility (see Figure 7, below).

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 6

Figure 7 – Types of Risks the SCM Team Should Manage

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 7

Overall, the data shows that supply chain personnel believe they own some level of responsibility for a broad array of risks. In every single category, at least 70% of respondents said that the supply chain department should be either highly involved or somewhat involved. There were only three areas that more than 20% of respondents said were outside the responsibility of the supply chain function: 1) product design flaws, 2) counterfeits, and 3) HR risks (such as skills shortage and turnover). Even here, most people (over 70%) thought that supply chain should be at least somewhat involved or highly involved.

There are some areas—like exchange rate risks, sustainability/social responsibility, IT security, and theft/shrinkage—where most respondents feel that supply chain needs to be somewhat involved, but not highly involved. The logic here will vary from firm to firm. For example, for a company that sources most of its components and materials domestically but sells overseas, the exchange rate risks are all on the sell side and are more or less completely outside the control of the supply chain group. However, when a substantial amount of materials are sourced overseas in other currencies, then the supply chain and sourcing groups should be part of the team that determines the hedging strategy. This is because strategies for managing exchange risks can include things like asking suppliers for local currency pricing (invoice in the buyer’s domestic currency) as an alternative to buying OTC derivatives or Exchange-traded funds. A cross-functional team, including representatives from supply chain, should analyze the alternatives and weigh the tradeoffs to determine the optimal strategy.

Similarly, sustainability and social responsibility may be primarily an internal matter for a non-manufacturing company. However, for a manufacturing company, especially one that outsources most of its manufacturing and/or has an extended multi-tier supply chain, responsibility extends to the companies in its supply chain. Nike and others have learned the hard way that their brand will take the hit for what happens in their supply chain.

The area with the highest “Not SCM’s responsibility” response was Counterfeits. However, more respondents said that supply chain should be highly involved in managing counterfeit risks. Here again, strategies are usually multi-faceted. Some of these involve criminal investigations and strong legal enforcement—making an example of the worst offenders to discourage others. These types of activities are largely outside of the supply chain function. However, there are other activities, such as serialization of items, and tracking and validating products as they flow through the supply chain, which are clearly in the domain of supply chain. As with many risks, the answer lies in a cross-functional team approach. Cross-functional teaming should be a strong suit of the supply chain team, as much of what they do is coordinating and bridging across functional boundaries.

After asking which areas of risk the supply chain group should be managing, a logical next question is, “So, how good is your company at actually managing each of those areas of risk?” The responses to this question are shown in Figure 8, below. In this chart, the responses are sorted high-to-low, based on the number of “very good” + “good” responses.

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 8

Figure 8 – How Good Companies are at Managing Risk

What is most striking here is how poorly companies rate their own ability to manage risk. In only two areas (production reliability and business continuity) do more than half of the respondents say they are good or very good. The areas with the most “poor” ratings are geopolitical risks, natural disasters, labor

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 9

disputes, infrastructure risks (power, utilities), and demand forecasting. One of our recent studies corroborates this last finding about demand forecasting. We found demand forecasting to be the top supply chain challenge, highest priority, and most difficult to improve process (out of 24 choices) in that study.

The areas in which respondents said that they were doing the best are those that are somewhat under the direct control of the company—production reliability, business continuity, and IT security. It is striking then, that another area that is somewhat under companies’ control—managing HR risks, such as turnover—was ranked dead last. This was echoed in our 2011 Business Priorities survey that found retaining talent to be a top concern, fueled by a talent shortage in key professions.

It is not too surprising that companies find it difficult to manage geopolitical and natural disaster risks. Not only are these out of their control, but also, in many cases, they are hard to predict and there are no easy mitigation strategies. For example, if all the key suppliers are in a region with high earthquake risk, it seems that there is little you can do about it. However, it is also the case that many companies fail to take a proactive approach to managing these types of risks.

Proactive vs. Reactive Approach In speaking with companies about their response to the tsunami, it became apparent that some companies were much more proactive than others. They swung into action based on up-to-date and recently validated/practiced contingency plans they had in place. Some of these firms set up a war room within 30 minutes of the tsunami. They already had agreements in place with alternate sources of supply upon which they could draw. In contrast, other firms were caught flat footed and took longer to understand if, and how, they were affected. They then had to compete with other companies scrambling for their share of limited supply on spot markets or secondary markets.

The Myth of Black Swans Some people will complain that they could not be expected to be prepared for such a rare and unanticipated event as the tsunami. After all, it was beyond even the worst case predictions of many of the planners in Japan itself, where 30 foot seawalls were overwhelmed and backup safety systems in the nuclear plants were breached. These are sometimes referred to as “black swan” events: events that could not possibly have been foreseen. This is a flaw in disaster planning—focusing on potential events and their probability rather than on assets and impacts. Humans are notoriously bad at calculating the probabilities of rare events and even worse at “intuiting” those odds. (See sidebar “What are the odds of that?”) For more on this topic, see this article: “Black Swan? Revolutions and Tsunamis Come and Go!”

Managing Multi-Tier Risks and Secondary Effects In our survey, we found that the vast majority of respondents (nearly 80%) do not manage risks beyond their immediate first tier suppliers. Instead, they rely on their immediate suppliers to manage those risks (see Figure 9, below). The tsunami highlighted the risks in that approach and the importance of being aware of the impacts across multiple tiers of the supply chain. Many companies were impacted not by their immediate suppliers, but by their suppliers’ suppliers or by secondary effects of the tsunami. For example, Japan makes over 60% of the world’s supply of silicon wafers used in manufacturing

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 10

semiconductors. A worldwide shortage is predicted due to many wafer plants being shut down. If you are a high tech, automotive or medical device manufacturer, you don’t buy from these sources directly, but will very likely be impacted. In another example, 70% of the world’s supply of aluminum electrolytic capacitors comes from Japan. These are used in a wide variety of applications such as filtering power supply outputs, motor start capacitors, audio applications, energy discharge, photoflash, and strobe applications. Industrial manufacturers, camera and cell phone makers, and many others may be impacted by those shortages, even though they do not buy those capacitors directly.

It is risky to rely solely on your suppliers to deal with those shortages. Often times, suppliers are reluctant to be forthcoming with bad news, as they scramble and hold out hope that they will find alternative sources. By the time their situation becomes fully clear, it is too late. Having an understanding of the complete supply chain can be advantageous. You are in a position to know where there is capacity and constraint, and which suppliers are in a position to secure that limited output. This gives you a clearer picture of the true risks for your immediate suppliers, as well as an understanding of which alternate sources might have access to the limited supply. Then you can pursue those specific alternate sources more vigorously.

As another example of a secondary effect, we spoke with a printer that sells exclusively into the North American marketplace. They source almost 100% of their paper from domestic sources, so you would expect minimal or no impact from the tsunami. Yet the destruction of Japanese paper mills caused the customers of those mills to look elsewhere for paper. They have started buying from North American mills which has aggravated an already tight supply situation in this market. The ripple effects of an event of this magnitude extend around the globe, across industries, and certainly across tiers of the supply chain.

What are the odds of that?

In June 2001, a 10 year old girl in Staffordshire, England named Laura Buxton wrote on a helium balloon “Please return to Laura Buxton” along with her address, and released it in her back yard. The balloon drifted 140 miles south, past millions of people, and descended in the town of Milton Lilbourne in the back yard of another 10 year old girl named (dramatic pause) . . . Laura Buxton. They corresponded, decided to meet, and discovered that they both were the same height, had the same color hair, were wearing the same clothes, both owned 3 year old black Labrador dogs, a gray rabbit, and a guinea pig (which they both brought with them that day), and had skin discoloration in the same spot on their backside. What are the odds of that? Well, the fact is that the odds of that specific situation happening are very close to zero. But the odds of something that stunningly weird happening somewhere many, many times each year are nearly 100%. The same is true about “black swan” events in general. You can hear more about this and the phenomena of “stochasticity” in the RadioLab podcast "A Very Lucky Wind,"

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 11

Figure 9 – Management of Risk Across Multiple Tiers

Although almost 80% do not manage beyond their immediate suppliers, between 15%-25% of companies take a more active role in managing tier 2 and 3 suppliers or beyond. This can take different forms:

• Materials Going into Contract Manufacturers—Contract manufacturers in some cases have responsibility for procuring all the materials and components. Nevertheless, their OEM customer may take an active role in managing supply risks for those components, knowing that any hiccups are going to hit them directly. After all, it is the OEM’s line that will go down without those components.

• Industry-wide Shortages—Some companies have been burned by shortages in materials or capacity in tiers upstream from their immediate suppliers. Examples we have seen include shortages of tantalum powder for making tantalum capacitors which are critical in mobile electronics. Or shortages of specialized high grade titanium sponge used in making titanium sheets or structural steel from which aircraft engine components and other high performance parts are made. Some companies in these types of industries have learned to scout out demand and supply beyond their immediate suppliers to get an early warning on industry-wide constraints. In those cases, they will take steps to ensure that their needs are met.

• Critical Tier 2 or Tier 3 Suppliers—There may be critical suppliers in your supply chain that are not your direct suppliers. They may have unique capabilities or resources that are difficult to replace. In that case, a company may manage those risks closely as well.

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 12

Conclusion

A variation on the 80/20 rule seems to apply here—it seems that 80% of companies are weak at managing supply chain risks. It has become obvious, not only from this research but also from current events of the last few years, that most companies take a reactive approach to supply chain risk. They are often caught unprepared and go into “fire drill” mode when a disruption occurs, which is generally much more costly than preventative strategies in terms of the negative impact on brand, recovery time, loss of revenue, loss of market share, and distraction from other business activities while trying to cope with these events as they are happening. Companies frequently underestimate the impact of events. And they may be last in line as supplies tighten, further impacting revenue and market share.

In contrast, the other 20% of companies are proactive in managing supply chain risk. They often have a dedicated supply chain risk group. They have multi-faceted early warning systems in place to raise the red flag before disruptions occur. They are constantly monitoring the situation on the ground and across the globe. They recognize the need to understand and manage risk across multiple tiers of their supply chain.

The difference can be largely attributed to the leadership within the firm. We almost always find people at lower levels on the front lines who are acutely aware of the risks faced and are lobbying for resources and policies to mitigate those risks. But top executives are pulled by many forces and with many demands for resources and investments. Those who take the attitude “these same events are happening to everyone, so why should I spend time and money on this” really miss the true opportunity. Disrupting events can be critical turning points in the evolution of a sector that determine the future winners and losers in an industry. Those leaders will come out on top who understand risk impacts and provide the leadership and investments needed for their enterprise to proactively deal with inevitable, disrupting events.

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 13

Appendix A: Supply Chain Risk Related Research and Resources

• 12 Attributes of a Successful Business Continuity Plan

• Black Swan? Hardly! Revolutions and Tsunamis Come and Go!

• Managing Supply Chain Risk: The Secure Supply Chain Technology Footprint (Webinar)

• Risk Management Technology for the Supply Chain (Mini Report)

• Consider Risk in Your Optimization Model

• What Noah Knew About the Supply Chain That You Don't

• Managing Supply Risk: Part One - Quantifying and Predicting Supplier Risk

• Managing Supply Risk: Part Two - Supplier Business Continuity

• Managing Supply Risk: Part Three - Hedging Strategies: Cross-Functional Teams

• Managing Supply Risk: Part Four - Hedging Strategies: Approaches

• Identifying and Assessing Supply Chain Risk

• Sourcing in Times of Uncertainty

• Supply Chain Risk and its Impact on Equity Volatility

• The Effect of Demand-Supply Mismatches on Equity Volatility

• The Effect of Supply Chain Disruptions on Long-term Shareholder Value, Profitability, and Share Price Volatility

• The Interview: Getting Real with Paul Fox

• Total Cost Sourcing

• Managing Your Managed Service Provider

• Reducing Risk in Global Life Sciences Supply Chains

• Managing Risk is Not Just Child's Play

• A Real Options Perspective on Supply Chain Management in High Technology

• Managing Material Price Risk in the Supply Chain

• Managing Risk at Key Stages in Product Lifecycles

• Supply Chain Orchestration

• What is SRFM? (Supplier Risk and Flexibility Management)

• Resilient Supply Chains - The Next Frontier

• Jointly Optimizing Capacity Flexibility, Supply Flexibility and Component Commonality at Ford Motor Company

• Operational & Financial Risk in the Supply Chain

• Supply Risk and Flexibility Management at Agilent

• Pandemic Preparedness for Businesses and their Supply Chains

• Vested Outsourcing - An Interview with Kate Vitasek

Urgency for Supply Chain Resilience: Results from ChainLink’s 2011 Supply Chain Risk Survey

© 2011 ChainLink Research—All Rights Reserved Page | 14

719 Washington St., Suite 144 Newton, MA 02458

617-762-4040

Email: info@CLResearch.com Web: www.ChainLinkResearch.com