2. Understanding SC Risk + Resilience

Risk management is the continuous process of:

1. Risk identification – finding what can go wrong.

2. Risk assessment – evaluating severity, likelihood and detectability.

3. Risk control – introducing mitigating measures to reduce the risk.

It is applied to reduce the possibility of suffering loss, such as financial losses, production stoppages, quality failures, accidents or reputational damage.

Supply chains face risks from suppliers, transport, production and external events. Risk management helps companies prepare for and reduce these disruptions.

1. Complexity and limited visibility: Companies often do not know their complete supply network, especially indirect suppliers.

2. Knowledge requirements: Risk identification needs experts from different functions and detailed knowledge of the company and its supply chain.

3. Subjective assessment: Severity, likelihood and detection scores are based partly on human judgement.

4. Unknown unknowns: Some disruptions cannot be predicted, quantified or included in a traditional risk assessment.

5. Efficiency–resilience trade-off: Measures such as additional inventory, suppliers and capacity increase protection but also increase costs.

6. Continuous coordination: Risks change over time, so identification, assessment and control must be repeated continuously across supply-chain partners.

The basic problem is a loss of control.

Companies cannot completely control all suppliers, transport routes, countries, technologies and external events.

Longer supply chains contain more companies, intermediaries, countries and transport steps.

This makes the supply chain more complex and harder to monitor.

One disruption at an important transport point can affect hundreds of ships, many industries and several countries at the same time.

Companies are connected through many suppliers, customers, transport routes and production locations. One company or location may support several value streams at the same time.

Different products may depend on the same supplier, factory, port, transport route or energy source. A failure at this shared point can stop several flows together.

They make the supply chain geographically more diverse.

The company becomes exposed to more countries, laws, political conditions, transport routes and external events.

1. They reduce inventory levels.

   When a disruption occurs, there may not be enough raw materials or parts to continue production.

   
   

2. Production lines may shut down because the company has only a small amount of inventory available.

No.

They reduce costs and waste, but they also reduce safety buffers.

Companies must balance efficiency and risk.

1. strategic risks - Markets, competition and sabotage.

2. financial risks - Currencies, interest rates and stock markets.

3. regulatory risks - Tax laws, environmental law and employment law.

1. technical risks - New technologies, security and products.

2. operational risks - Transport, suppliers and quality.

3. economical risks - Trade restrictions, exchange rates and political boundaries.

1. Risk Identification - finding possible events, failures or dangers that could negatively affect the company or supply chain.

   
   

2. Risk Assessment - evaluating and quantifying the identified risks.

   
   

3. Risk Control - selecting and implementing measures that reduce the risk.

It requires:

• extensive knowledge of the company and its supply chain,

• practical experience with possible problems and deviations.

1. What can happen or go wrong?

2. How likely is it to happen?

3. What are the consequences if it happens?

1. Severity is an estimate of how serious the effect of a failure will be for the next user or final customer.

2. Likelihood, also called occurrence, estimates how likely the cause of a failure is to occur.

3. Detection estimates how effective the controls are at preventing or detecting the failure before it reaches the customer.

The Risk Prioritization Number, or RPN, is a score used to rank risks.

RPN=S×L×D

High RPN: It means the risk requires more attention because it is severe, likely, difficult to detect, or a combination of these factors.

Low RPN: It means the risk is less urgent compared with risks that have a higher RPN.

Risks with high severity, high likelihood and low detectability.

Risk control means identifying and assessing mitigating measures that lower the RPN.

1. What can reduce the likelihood of occurrence?

2. What can reduce the severity?

3. What can increase the detectability of the problem?

Risk management tries to prevent or reduce shocks.

Resilience prepares the supply chain to function, adapt and learn when prevention fails.