1. Executive Summary: The Need for Supply-Chain Risk Management

Transcription

1 1

2 1. Executive Summary: The Need for Suppy-Chain Risk Management Modern enterprises increasingy find themseves reying on others for their success. Historicay, enterprises have spent ess than a third of their budgets on purchased goods and services, having reied on interna sources for these. Today, many enterprises spend most of their budget on purchased goods and services. This is in arge part because of the advantages enterprises have found in strategies such as gobaization, outsourcing, suppy-base rationaization, just-intime deiveries, and ean inventories. In addition, many companies have consoidated operations both internay and externay to achieve economies of scae. Whie gobaization, extended suppy chains, and suppier consoidation offer many benefits in efficiency and effectiveness, they can aso make suppy chains more britte and can increase risks of suppy-chain disruption. Historic and recent events have proven the need to identify and mitigate such risks. The March 2011 Tohoku earthquake and subsequent tsunami in Japan showed how one event can disrupt many eements of goba suppy chains, incuding suppy, distribution, and communications (Lee and Pierson, 2011). In extreme cases, a singe event at one ocation can severey damage an enterprise or even cause it to eave an industry. Effective suppy-chain risk management (SCRM) is essentia to a successfu business. It is aso a competence and capabiity many enterprises have yet to deveop. In some areas, both probems and practices are we defined. In others, probems are defined, but practices are deveoping. In sti other areas, both the definition of the probems and the practices needed to address them are deveoping. In sum, SCRM is an evoving fied. In this document, the Suppy Chain Risk Leadership Counci (SCRLC), a cross-industry counci incuding suppy-chain organizations from more than two dozen word-cass manufacturing and services firms and academic institutions, outines an approach to SCRM. This document provides a framework for coecting, deveoping, and impementing best practices for SCRM. It focuses on Identifying interna and externa environments Risk identification and assessment Risk treatment Continua monitoring and review of risks and their treatment. This document is meant to be a practitioner s guide to SCRM and associated processes. Approaches for identifying, evauating, treating, and monitoring suppy chain risk wi differ across individua enterprises depending on their industry, the nature of their extended suppy chains, and their toerance for risk (or risk appetite). Therefore, rather than prescribing a specific approach to SCRM, this document notes some guideines and possibe approaches an organization may wish to consider, incuding exampes of toos other organizations have used. Specific enterprises wi adapt the concepts incuded in this document to fit their unique characteristics and expand the depth and breadth of the processes to meet the requirements of their organizations. This document excudes risks such as those to brand reputation or inteectua property which exist outside the suppy chain. It seeks to foster the deveopment of best SCRM practices for appication in industria settings rather than provide a reguatory framework. 2

3 This is a working document. Its contents refect a coection of best-practice inputs from SCRLC members. The inputs on suppy-chain risk management are, to our knowedge, unique, though based in part on previous works regarding suppychain risk more generay. The probems of SCRM and the means to address them wi continue to change. As they change, we hope to both update this document and to issue additiona pubications detaiing evoving areas. This document serves as a baseine for both heping enterprises assess and address suppy-chain risks and for documenting evoving practices. We seek coaboration to promote these practices for suppy-chain resiiency. About the SCRLC The SCRLC ( is a cross-industry organization incuding word-cass manufacturing and services suppy-chain organizations and academic institutions that work together to deveop and share best practices in suppychain risk management. Its mission is to create suppy-chain risk management standards, processes, capabiities, and metrics that refect current best practices and can be widey adopted. 3

4 2. SCRM: An Overview The SCRLC defines suppy-chain risk as the ikeihood and consequence of events at any point in the end-to-end suppy chain, from sources of raw materias to end use of customers, and suppy-chain risk management as the coordination of activities to direct and contro an enterprise s end-to-end suppy chain with regard to suppy-chain risks. Suppy-chain risk management integrates severa previous or ongoing initiatives, incuding those for business continuity and suppy-chain security. Suppy-chain security-management systems seek to resist intentiona, unauthorized act(s) designed to cause harm or damage to, or by, the suppy chain (ISO 28000:2007). SCRM goes beyond this by not ony seeking to address such acts but aso to promote business continuity and to mitigate any disruptions, that is, events that interrupt norma business, activities, operations, or processes (ASIS Internationa, 2007; ASIS Internationa and BSI, 2010). Such events may not ony be intentiona acts such as sabotage but aso unintentiona acts such as a hurricane. They may be both events anticipated, such as poitica unrest, or unanticipated, such as an earthquake. Risk Management Process Overview In this document, we provide an approach to risk management. Our process, based on ISO 31000, covers eements of risk identification, risk assessment, and risk treatment (Figure 2.1). ISO is a key buiding bock to our approach; whie adapting it to our own purposes, we recognize the need to avoid repicating standards documents but rather to strive for practices that cover security, crisis, continuity, and recovery requirements enterprises may have. Figure 2.1: Risk Management Process The process begins with identifying interna and externa environments. Enterprises may inadvertenty overook interna risks. These may incude those posed by a rogue empoyee, as we as those posed by inadequate poicies, strategies, or 4

5 organizationa structures. The externa environment in which an enterprise, and its suppiers, must work wi aso pose differing risks. For exampe, some suppiers wi face meteoroogica risks, whie others, because of their distance, may have greater transportation risks. Mapping its suppy chain can hep an enterprise identify the risks it faces and how best to prioritize and address them. To prioritize and address risks, firms wi need to identify criteria for determining what may pose a risk to its operations. One potentia starting point is the suppy chains for the products most affecting firm profitabiity. Once a firm understands how to identify risks, it may undertake risk identification and assessment, which incudes risk identification, risk anaysis, and risk evauation. Risk identification may entai using a ist of common risks incuding externa risks such as natura disasters, accidents, sabotage, or abor uncertainty; suppier risks such as production probems, financia issues, or subcontractor probems; distribution risks such as cargo damage, warehouse inadequacies, or suppy pipeine constrictions; and interna risks such as personne avaiabiity or faciity unavaiabiity. (See Appendix 2.1 for a ist of sampe risks by category.) Such process wi aso invove prioritizing risks by the threat (as measured by ikeihood and consequence) they can pose to a firm s operations. Once a firm has identified and prioritized the risks that it faces, it can devise risk treatment pans. This incudes measures to protect the suppy chain from risks, pans to respond to events that these risks may cause, and pans to continue operations in the face of disruptions and fuy recovering from them. This may aso invove determining ways to measure risks and the effectiveness of pans to imit them or to respond to disruptions. Enterprises must aso undertake continua communication and consutation as we as monitoring and review throughout this process. Monitoring and review entais not ony evauating the effects of risk treatment but aso maintaining the pan and responding to changes in suppiers, processes, and reguation affecting eements of the suppy chain. It aso entais continuay identifying opportunities for improvement. Principes of SCRM Efforts to impement SCRM must address four principes: eadership, governance, change management, and the deveopment of a business case. Leadership support and guidance is essentia to any successfu SCRM program. An integrated and engaged eadership team can not ony hep identify risks we before they cause disruptions but aso provide a quick and thorough response to any incidents that might occur. Utimatey, eadership, reporting and ownership of suppy-chain risk shoud rest with senior management. An effective SCRM team shoud incude eaders from functions such as Business continuity Engineering and design Enterprise risk management Finance Governance Import/export compiance Logistics 5

6 Manufacturing Procurement Quaity Security Suppier management. Differing functions shoud have representation on both the executive steering team and the impementation team. It is most effective to have an executive sponsor who is skied in the area in which the firm faces the greatest risk. For exampe, if timey transportation of components is the most vita function for a firm and the one where it may face the greatest risks, then it may wish to have a ogistics executive be the executive sponsor of the SCRM team. Corporate cuture, incuding the area that a company most wishes to emphasize to buid its reputation, may aso determine executive sponsorship for the SCRM team. For exampe, a manufacturing firm may choose to have a manufacturing executive be the executive sponsor of the SCRM team, regardess of the greatest suppy-chain risks. One eading firm ros up risks to the chief information officer, to whom responsibiity for suppy-chain risks was originay given. Another has a vice president of risk manager. A eading insurance provider has its chief operating officer assume utimate responsibiity for risk management. In many mid-sized companies, the chief financia officer may have utimate responsibiity for risk management. The team shoud ensure that risk-management processes are embedded into business-function processes so as to ensure proper communication and coaboration on events. Reguar (e.g., monthy) meetings of the impementation team can hep ensure proper communication, as can ess frequent but sti reguar (e.g., quartery) meetings of the executive steering team. One eading firm briefs its executive board quartery on suppy-chain risks and what is being done to address them. Ideay, a firm wi have detaied governance procedures for a continuing suppy-chain risk management team, incuding those on meeting structure, attendees, standard agenda items, and business-process deiverabes. Typica agenda items might incude process maturity, metrics, compiance, and audits; a review of risks and how the firm is addressing them, and sharing of knowedge and best practices. Suppy-chain risk management teams shoud use inputs from ower-eve working groups and process users to infuence decisions of higher-eve executives in determining appropriate resources and priorities for their efforts (Figure 2.2). 6

7 Figure 2.2: Notiona Risk Management Governance Structure Estabishing or improving SCRM in most enterprises represents a major change. Consequenty, those impementing SCRM wi need to pay particuar attention to the tenets of successfu change management. These incude a compeing case for change, unwavering senior eadership support, and a cear vision of the future with the change. They aso incude deveopment of an action pan for impementation as we as ongoing monitoring and refinement to refect essons earned. Lasty, they require sustained communication with key stakehoders through the change, proactive education and training so that personne have the skis to execute the change, incentives aigned with the desired outcomes of the change, and adequate resources to successfuy manage and impement the change. Because resistance is natura and to be expected with a major change, those impementing SCRM aso need to pay attention to the psychoogica and emotiona aspects of the change. Linking it to other corporate suppy chain objectives such as corporate socia responsibiity and carbon footprints can aso be usefu. The business case for SCRM has severa components. SCRM can offer cost savings by protecting against saes and market-share oss and rebuiding costs. SCRM can aso offer enterprises a competitive advantage if it enabes an enterprise to recover faster than its competitors. Disruptions carry costs as do workers who must og additiona hours to compensate for shortfas caused by disruptions and warehouses needed to store items needing key parts for competion. Identifying these cost savings can hep justify SCRM investments, especiay if these investments can otherwise hep firms make the most of their resources. SCRM can aso offer intangibe benefits. These incude avoiding damage to reputation or brand that may accompany a suppy-chain disruption as we as breaking down organizationa sios, which is not ony necessary for SCRM but can aso hep enterprises in other initiatives. As an exampe, a eading firm with an estabished, strong SCRM program, uses a metric tited "Time to Recover (TTR)" to refect and measure the business case for investing in their SCRM program. Product output and revenue are directy impacted under mutipe risk scenarios. By identifying, assessing, and mitigating these risks, this firm targets specific reductions in the TTR for their business. Forecasting TTR with and without risk mitigation shows the effects, in revenue, of SCRM. Indeed, this firm caims a focus on TTR metrics in its SCRM heped it save miions it woud have ost in subsequent events. We turn next to how firms may begin identifying their interna and externa environments. 7

8 8

9 3. Identifying Interna and Externa Environments Risks exist at discrete eves and entities within an organization. Manufacturing risks exist at manufacturing sites. Suppier risks exist at suppier sites (incuding those of sub-tier suppiers). Distribution risks exist at suppiers and in upstream and downstream transportation and ogistics systems (Figure 3.1). Legisative, compiance, inteectua property, and reguatory risks exist at the country or regiona eve for mutinationa enterprises. Finay, strategic risks exist at the business-unit or corporate eve. Credit: E. V. Leyendecker, U.S. Geoogica Survey. Photo is of Interstate 880 in Oakand, Caifornia after Loma Prieta earthquake of 1989, Figure 3.1: Earthquakes Can Pose Risks to Transportation and Security Enterprises must identify, own, and manage risks at the eve they exist. Enterprises must aso aggregate and report risks across the organization and verticay through business reporting structures. Enterprises shoud give risks that exist within mutipe entities common, coordinated treatments. When ower-eve risks are identified at higher eves of the enterprise but not owned at those eves, it may be necessary to impement governance contros to assure that risks are managed throughout the enterprise and suppy chain. Such risks may arise when franchises make for oca consumption a fina product whose performance wi affect reputation of a more widey used corporate brand. They may aso arise when performance of a ower-tier suppier disproportionatey affects the reputation of a arge manufacturer as has happened, for exampe, in the use of ead paint by ower-tier suppiers on toys utimatey assembed and sod by arge firms with strong brand-name recognition. Governance contros to manage such risks may incude corporate eadership setting poicies, procedures, and standards for ower eves to foow, with governance supported by compiance activities such as auditing. Enterprises cannot te 9

10 franchises how to operate their faciities, but, as they do with ensuring compiance with corporate socia responsibiity practices, they can provide guideines. The presence of differing risks at differing eves of an enterprise underscores the importance of defining the context within which a risk-management program is impemented. This incudes suppiers, manufacturing, ogistics (e.g., warehousing and distribution), customers, and other eements that can affect the suppy chain. These eements wi vary by industry, as wi the efforts an organization can make to address them. For exampe, a manufacturing pant may have more contro over assemby risks than a higher-eve business unit, whie a business unit may be better abe to address suppy-chain risks posed by egisative and reguatory issues and to coordinate efforts to mitigate some procurement risks. A key decision in deveoping an SCRM program is the scope of the suppy chain to incude. Enterprises may initiay focus on Tier 1 suppiers, or even prioritize among Tier 1 suppiers. In most cases, the scope shoud incude a tier 1 suppiers and customers. In determining how much of the suppy chain to incude beyond the first tier, managers may wish to characterize inputs by the number of suppiers and number of customers. For exampe, at one extreme, for commodities with a arge number of suppiers, it is ikey not necessary to go beyond the first tier in considering suppychain risks. At another extreme, for materias with few suppiers or ony one, it is necessary to consider risks among second-tier suppiers. Between these two extremes firms need to assess how critica a particuar component is or how easiy a suppier can be repaced and, if necessary, consider suppy risks in the second tier for critica components or suppiers. By repeating this process for increasing numbers of tiers of suppiers and customers, enterprises can capture the portions of the suppy chain that have the greatest risks to operations. Such an approach is ony a guideine; specific knowedge of an organization and its industry is necessary to guide decisions. Mapping suppy-chain processes can hep enterprises understand the potentia risks that exist as we as the organizations invoved. Figure 3.2 presents a notiona map. Upstream, it originates with raw materias, parts, assembies, and packaging going to suppiers, some of which may fow directy to the fina production or assemby point as we. Distribution systems, incuding trucks, trains, ships, and aircraft, move components from suppiers to the inventory of manufacturers, as we as from manufacturers to the inventory of customers. Severa eements are common to a these eements and can be the source of risks throughout the suppy chain. These incude infrastructure such as buidings and equipment, utiities whether raw (e.g., water) or converted (e.g., refrigeration), process functions such as production panning or saes and operation panning (S&OP), and personne, incuding saaried and houry workers as we as temporary workers and contractors. Not a these nodes wi have risks for a operations, but a shoud be considered. 10

11 Upstream inputs Raw materias Parts Sub-assembies Assembies Packaging Distribution system Trucks/roads Trains/rai Ships/ports Aircraft/airports Warehouses Manufacture Management Workforce Utiities Capacity panning Quaity systems Distribution system Trucks/roads Trains/rai Ships/ports Aircraft/airports Warehouses Downstream outputs Assembies Fina product Inventory Inventory Suppiers Production or assemby Customers Wastewater Air emissions Soid waste Hazardous waste Infrastructure Buidings Equipment Process Packaging Utiity Raw Water Eectricity Gas or fue oi Air Utiities Converted Steam Refrigeration Compressed air HVAC Process functions Production panning Process contro Operations Accounting S&OP Peope Saaried Houry Temporary Contractors Figure 3.2: Notiona Suppy-Chain Process Fows Information fows shoud aso be documented. Information can fow both upstream and downstream. In particuar, information fows on downstream conditions can hep upstream processes provide the correct quantity and quaity of materias needed. Organizations shoud map the suppy-chain eements for which they are directy responsibe and that they contro. They shoud aso extend the suppy-chain map at east one tier up and one tier down, considering direct suppiers and direct customers incuding transportation and information inks for them. Firms may use severa criteria to identify risks (Moore, Grammich, and Bicke, 2007). Pareto anaysis, aso known as A-B- C anaysis, can hep firms identify the proportion of goods and suppiers on which it is most dependent in terms of profitabiity or criticaity, and hence the goods and suppiers that can pose the most risk to the suppy chain. More sophisticated portfoio anaysis can hep firms identify goods by both their vaue and the vunerabiity of suppy, and ead firms to focus their SCRM first on strategic or critica goods of high vaue and high suppy vunerabiity. These may incude scarce or high-vaue items, major assembies, or unique parts, which may have natura scarcity, few suppiers, and difficut specifications. We next examine how firms can identify and assess risks. 11

12 4. Risk Assessment Process A soid risk management program, from initia depoyment to sustainabe operation, incudes a robust and ongoing risk identification and assessment process. That is, it incudes a risk-assessment process that is abe to evauate a wide variety of risks over time. The risk-assessment process shoud distinguish between risks that shoud be incuded in the risk-management process and those that shoud not. Norma variations in product demand and quaity, and those that are maintained within acceptabe imits, do not represent risks that shoud be incuded in the risk-management process. Characteristics that can cause abnorma variations, that is, those which the suppy chain cannot fex and respond to, shoud be incuded. Risk Identification Deveoping an initia risk register, which is a one-time effort, is necessary to identify baseine risks. Too many organizations start a risk management program without knowing what threats the organization faces, or what consequence a disruption woud have. As a resut, they focus too much protecting against the wrong threats or too itte protecting against threats that matter. Worse, they may fai to anticipate important threats, or fai to recognize the consequence an apparenty minor threat may have. Risk identification might begin with brainstorming sessions, previous risk assessments, surveys, or sti other efforts to identify and ist potentia risks within suppy-chain processes. Reference works that can hep with identifying risks incude those from the British Standards Institution (BS 31100:2008), which offers a code of practice for risk management, and from the ISO (ISO 31010:2009), which offers a compendium of risk assessment techniques. A business-impact anaysis can hep a firm evauate the threats a firm might face and their consequences. Such anaysis might start with a worst-case scenario focusing on the business process that are most critica to recover and how they might be recovered remotey. A business-impact anaysis shoud identify critica business functions and assign a eve of importance to each function based on the operationa or financia consequence. It shoud aso set recovery-time objectives and the resources required for these. Tabe 4.1 presents exampes of threats an organization may wish to consider for mitigation. Appendix 2.1 (referenced earier) presents a onger but not exhaustive ist. Note that risks can overap categories. Tabe 4.1: Potentia Risks to an Organization and Its Suppy Chain Externa, End-to-End Risks Natura disasters Accidents Sabotage, terrorism, crime, war Poitica uncertainty Labor unavaiabiity Market chaenges Lawsuits Technoogica trends Suppier risks Physica and reguatory risks Production probems Financia osses and premiums Management risks Upstream suppy risks Distribution Risks Infrastructure unavaiabiity Lack of capacity 12

13 Labor unavaiabiity Cargo damage or theft Warehouse inadequacies IT system inadequacies or faiure Long, muti-party suppy pipeines Interna Enterprise Risks Operationa Poitica uncertainty Demand variabiity Personne avaiabiity Design uncertainty Panning faiures Financia uncertainty Faciity unavaiabiity Testing unavaiabiity Enterprise underperformance Suppier reationship management To identify risks, firms may aso wish to consider Number and ocation of suppiers. For exampe, are there suppiers in countries with socia unrest (Figure 4.1), terrorist or drug activity, or high eves of corruption? Number and origin of shipments. For exampe, have increased quantities or vaues of shipments posed additiona risks? Contractua terms defining responsibiity for shipping. For exampe, firms may specify security contros and procedures for their suppiers. (Appendix 4.1 provides sampe contractua terms and conditions for suppy-chain security.) Modes of transport and routes for shipments. For exampe, firms may ask their suppiers foow certified security procedures for ocean-container or truck-traier shipments. Other ogistics providers or partners invoved in the suppy chain (e.g., packaging companies, warehousing, trucking companies, freight forwarders, air or ocean carriers), who hande shipments. For exampe, firms may that ogistics providers meet a certification standards form an officia suppy-chain security program. 13

14 Credit: Photo of Paris demonstrations and riots foowing May 2007 eection of Nicoas Sarkozy by Mikae Marguerie, Figure 4.1: Unrest Can Strike Anywhere at Unpredictabe Times Not a possibe risks, of course, wi threaten organizations equay. Locations are not, for exampe, equay at risk for meteoroogica threats to their operations. Organizations may wish to use operationa exercises to determine if they have identified a pausibe threats for a given ocation. They may aso wish to use such exercises to anayze risks and evauate their responses to them. The initia risk register, even if incuding a identified risks for mapped processes, wi ikey not cover a risks, or even a significant risks to the suppy chain. It is a starting point to identify reevant suppy-chain risks. Once the baseine risks 14

15 are identified, the organization shoud periodicay review the status of risks in the risk register, incorporating new risks as they deveop and eiminating risks that are no onger reevant. Risk Anaysis The risk anaysis process shoud estimate the ikeihood and consequence of risks facing a firm and accordingy prioritize them for utimate treatment. To begin, firms may choose to rank risk events based on a quaitative overa risk eve. Such a simpistic approach shoud ony be used for the initia risk register, but provides an easy way to quicky prioritize perceived risks and seect those that shoud receive priority attention. Once an enterprise has identified its top risks, it may use more sophisticated methods, such as the bow-tie method, to fuy understand the nature of the risk and to rate the ikeihood and consequence of inherent risk (i.e., risk in the absence of any treatment) and residua risk (i.e., eve of risk remaining after treatment). The bow-tie risk anaysis method is a form of cause and consequence anaysis the two dimensions of risk events and it ceary ties treatment actions against each dimension of a risk event. Figure 4.2 shows an exampe of the bow-tie method. Figure 4.2: Bow-Tie Method for Linking Treatment to Cause and Consequence For exampe, a manufacturer may face risk of shutdown resuting from an earthquake, a fire, a food, faiure of a key suppier, or temporary oss of workers due to an infectious disease outbreak (Figure 4.3). In anayzing its risks, it may wish to determine the ikeihood of each of these events. Likewise, it may wish to rate the consequences of such events. Five-point scaes of ikeihood (ranging, for exampe, from ess than 5 percent for the east probabe to more than 90 percent for the most probabe) and consequence (ranging, for exampe, from ess than 2 percent of gross revenue or 4 15

16 percent of net revenue for the east consequentia to more than 20 percent of gross revenue or 40 percent of net revenue for the most consequentia) may suffice for this. Inherent and residua risks may then be cacuated and compared by combining ikeihood and consequence ratings before and after treatment. Credit: Photo of 2009 fire and exposion at Caribbean Petroeum Corporation refinery near San Juan, Puerto Rico from U.S. Chemica Safety and Hazard Investigation Board, Figure 4.3: Fires Can Shut Faciities for Varying Lengths of Time Risk Evauation Enterprises may use their ratings of the ikeihood and consequence of risks before and after treatment to evauate residua risk eves against acceptabe risk eves, that is, their risk toerance. If the ikeihood and consequence of residua risks is found to be greater than their risk toerance, then enterprises need to devise further risk treatments to reduce the eve of residua risk. Acceptabe risk eves wi be unique to each organization and suppy chain. They may vary by commodity, product, or service, as we as over time. Different risk-toerance eves may be set for different eves of the organization. Whie generay tied to financia impact, through which risks may best be understood and compared, risks may aso be tied to other corporate assets such as reputation. One eading firm even considers the consequence of potentia risks by impact to stock price. One way an organization may wish to assess its risk toerance is through a risk frontier graph, potting the ikeihood of events by their consequence (Figure 4.4). Enterprises may find some risks to be of such ow ikeihood or to have such imited consequence that they do not warrant any further treatment or consideration. Those of greater ikeihood or consequence enterprises may wish to reduce through various buffering (e.g., use of mutipe suppiers or safety stocks) 16

17 or other mechanisms of risk avoidance or eimination. Such mechanisms may seek to reduce the ikeihood, duration, or consequence of a risk event. High Likeihood of event Buffer Eiminate, avoid risk Acceptabe risk frontier Low Minor Consequence of event (interruption time or cost) Major SOURCE: Zsidisin, Ragatz, and Menyk, 2003 Figure 4.4: Notiona Risk Frontier Another means of evauating risk is to use a heat-map showing risk-events on a matrix defining ikeihood and consequence eves. This technique aows managers to easiy see the reative ikeihood and consequence of differing risks. To use this method effectivey it is critica to have we-defined and consistenty used criteria for the different ikeihood and consequence eves. Figure 4.5 shows a heat-map iustrating the concept. 17

18 Figure 4.5: Heat Map Showing How Firms May Wish to Prioritize Risks by Likeihood and Consequence We turn next to how an enterprise, having prioritized its risks, may seek to address them. 18

19 5. Risk Treatment Once an enterprise understands its suppy chain and anayzed its potentia risks, it can impement an effective suppychain risk management program with its partners, that is, its suppiers, carriers, and ogistics providers. Such a program shoud have at east three eements: protecting the suppy chain, responding to events, and continuing business operations whie recovering from events. We discuss each of these beow. Protecting and Securing the Suppy Chain An effective suppy-chain risk management program must ensure that an enterprise and its partners impement appropriate measures to fuy secure goods and their components from the point of origin to fina destination. Suppy chain security is essentia from two perspectives. First, firms need to prevent oss from theft or damage. Second, they need to prevent unauthorized intrusion into shipments that coud enabe insertion of contraband (drugs, weapons, bombs, human trafficking, counterfeit goods, etc), oss of inteectua property or technoogy contained in the shipments, and tampering (insertion of harmfu eements such as poisons or "Trojan horses" in computing goods). Effective suppy chain security and protection incudes basic standards for physica security, access contros, personne security, education and training, procedura security, information-technoogy (IT) security, business-partner security, and conveyance security from the point of origin to fina destination within your suppy chain. Enterprises and their partners may assess their effectiveness with these measures through sef-evauation (Appendix 5.1). We discuss some benchmark standards for each of these criteria beow. Firms may wish to adapt or emphasize these in unique ways to refect the unique risks they must address. For exampe, pharmaceutica and eectronic goods companies may have high vaue shipments that are at far more risk for theft than other commodities. Physica security. Suppiers, shippers, and ogistics partners shoud have physica-security deterrents to prevent unauthorized access to their faciities and a cargo shipments. Such features may incude perimeter fencing, controed entry and exit points, guards or access contros, parking contros, ocking devices and key contros, adequate ighting, and aarm systems and video-surveiance cameras. Access contros. Access contros must prevent unauthorized entry to faciities, maintain contro of empoyees and visitors, and protect firm assets. They shoud incude the positive identification of a empoyees, visitors, and vendors at a points of entry and use of badges for empoyees and visitors. Firms shoud have in pace procedures to identify, chaenge, and address unauthorized persons. Personne security. Enterprises and their partners shoud screen prospective empoyees (in ways consistent with oca reguations) and verify empoyment appication information prior to empoyment. This can incude background checks on educationa and empoyment background and possibe crimina records, with periodic subsequent checks performed for cause or sensitivity of an empoyee s position. Firms and their partners shoud aso have procedures in pace to remove badges, uniforms, and faciity and IT-system access for terminated empoyees. Education and training. Firms and their partners shoud estabish and maintain a security-training program to educate and buid empoyee awareness of proper security procedures. Best practices incude training on the threat posed by criminas, terrorists, and contraband smuggers at each point in the suppy chain as we as on ethica conduct and the avoidance of corruption, fraud, and expoitation. Enterprises and their partners may especiay wish to ensure empoyees in shipping and receiving understand proper 19

20 suppy-chain security measures. Education and training shoud aso incude documented procedure for empoyees to report security incidents or suspicious behavior. Procedura security. As noted above, firms and their partners shoud estabish, document, and communicate procedura security measures to empoyees. Such documentation may incude a security manua, pubished poicy, or an empoyee handbook. Documentation shoud incude procedures for issuing accessing devices, identifying and chaenging unauthorized or unidentified persons, removing access for terminated empoyees, IT security and standards, reporting of security incidents or suspicious behavior, inspection of containers before packing, and managing access and security to shipping containers. For shipping, such procedures shoud incude security for shipment documentation, shipping and receiving, and packaging. IT security. IT security measures shoud ensure automated systems are protected from unauthorized access and that information reated to shipment routing and timing is protected. This shoud incude password protection (incuding periodic changing of passwords) and accountabiity (incuding a system to identify any improper access or ateration). Business-partner security. A suppy-chain security program must ensure that any suppy chain partner, as we as any further sub-contracted suppiers or ogistics service providers, empoy practices to ensure the security of a shipments. Any partner used in the manufacturing, packaging, or transportation of shipments must have documented processes for the seection of sub-contractors to ensure they can provide adequate suppy-chain security. Suppiers shoud ensure that any parties handing shipments be knowedgeabe of and abe to demonstrate through written or eectronic communication that they are meeting security guideines. An exampe of contract anguage that coud be used with freight forwarders and transport providers is contained in Appendix 5.2. Conveyance security. Transportation, particuary drayage (inand truck support), may be the most vunerabe point of the suppy chain. Procedures that suppiers and shippers shoud foow incude inspection and seaing of containers (cf. ISO 17712:2010 on seaing containers), storage of containers, and shipment routing through freight forwarders or carriers who are certified in a recognized suppy-chain security program or who otherwise demonstrate compiance with a firm s SCRM guideines. Responding to Events Even with the best aid pans, enterprises may sti confront crises in their suppy chains. We characterize crises as events that threaten the organization, with intense time pressures, high stress, and the need for rapid but carefu decision making. A crisis is an unstabe condition invoving an impending abrupt or significant change that requires urgent attention and action to protect ife, assets, property, operations or income, the environment and reputation. Crisis events incude natura disasters, major infrastructure faiures, major fires, poitica unrest, abor disputes, pandemics, information technoogy faiures, or security threats (Figure 5.1). 20