For each category, there are risk drivers (such as single-source dependency or supplier bargaining power) and the potential impact of the risk (lost production and reduced customer satisfaction, are two). Again, the categories, drivers and the impact will vary by industry and supply chain organization. With risks spread across dozens of suppliers and hundreds or thousands of stock-keeping units (SKUs), the prospect can seem a little daunting. Everything does not have to be examined at once. Your supply chain risk management strategy can target issues such as impact and frequency:
- Risks with high impact deserve attention because of their potential effect on revenues, margins and competitive advantage.
- Risks with high frequency deserve attention because risks by definition are not supposed to be certainties.
Figure 4 charts these two factors against each other, suggesting where and how to focus your efforts. Clearly the most important risks are those in the upper-right quadrant: high impact, high frequency. These SKUs should be your starting points for re-sourcing efforts. When addressing the upper left quadrant (high impact, low frequency), these risks can be mitigated through a joint process improvement with the supplier or other techniques with minimal effort.
For example, since the New Mexico fire, Ericsson has implemented a risk assessment process that classifies each of its components based on the number of suppliers and the business recovery time to find an alternative source or redesign the product. For critical components, Ericsson then evaluates many risk drivers, selects risk mitigation strategies and develops templates for incident handling and business continuity planning to reduce potential consequences.
Ericsson's philosophy of risk management now has the rigor of its competitor Nokia. Nokia, whose monitoring processes had identified a potential concern in New Mexico even before Philips officials notified them of the fire, also relied on philosophies that encouraged communication of such news and that gave executives addressing such supply risk problems authority to make on-the-ground decisions.
As they implement risk management, many companies perform their monitoring by developing key risk indicators (KRIs) metrics that evaluate changes in the likelihood of a supply disruption. For example, a KRI may be a tolerance level for the number of defects in a shipment or its potential delay. What happens when the KRI changes? For one thing, you might choose to alter your inventory levels. For example, hearing about the coming dockworkers' strike in California in 2002, several smart retailers increased their inventories of key products ahead of time.
Indeed, attention paid to amounts of inventory may divert attention away from the ways to reduce costs and risks by changing the types of inventory. Consider the paint industry: inventories were formerly kept in a wide variety of colors. But now salespeople can mix color specifications after the customer places an order this innovation means paint manufacturers can dramatically reduce inventories, while actually reducing the risks of out-of-stocks.
But mitigating risk is not merely about more carefully watching the supply chain. It can also be about making that supply chain more flexible, or even altering it. Where are parts pooled across products? Are there ways to engage redundant suppliers while maintaining economies of scale? Are there points in your value chain where the risk and cost equation suggests that excess capacity may be okay?
Such questions, of course, go to the heart of procurement strategy. But they have a risk dimension as well. That interplay may be a factor in leading companies' decisions about organizational responsibility in risk management.
Techniques of Supply Risk Management
Ideas and philosophies of risk management are not new to large corporations. They've been dealing with risks in events, prices, currencies, interest rates and other factors for years. As Figure 5 shows, supply risks are merely one component of a larger enterprise risk management strategy. Sometimes supply risks overlap the other categories, as when the risks of political events now have to be evaluated not just within the company but across the supply chain. Sometimes they represent an additional level of complexity, as when foreign exchange risks have to be factored into multiple global supply environments.