Understanding supply chain risk: A McKinsey Global Survey

of 6 Survey Understanding supply chain risk: A McKinsey Global Survey Executives believe they face growing risk from disruptions to their supply chains yet many are unprepared to manage those risks. Web exclusive, October 2006 Nearly two out of three executives who responded to the latest global survey of business executives conducted by The McKinsey Quarterly 1 say they face increasing risks to their ability to supply their customers with goods and services cost effectively. The executives identify a wide variety of risks; topping the list is the availability of well-trained labor. Few executives express confidence in their company's ability to manage these risks successfully, and companies are making surprisingly little use of some well-known tools that could help. Notes 1 The McKinsey Quarterly conducted the survey in September 2006 and received 3,172 responses from a worldwide panel of executives at publicly and privately held businesses across a full range of industries. Rising risk Most of the surveyed executives say supply chain risk is growing (Exhibit 1). The executives most likely to say that their company's level of risk has risen are those in retailing, manufacturing, and energy; those in the energy industry are by far the most likely to say their risk has increased significantly. Professionalservices executives are the least likely to have seen an increase in risk, but even there, nearly half have done so. Executives at all levels share the view that risk is on the rise. Labor tops the list The executives rank labor, regulation, and suppliers as the top three supply chain risks on which they focused during their most recent round of planning (Exhibit 2). Among all risks, the clear leader is the availability, cost, and quality of labor. Labor is the concern cited most often in every region of the world except Latin America, where regulatory issues are by far the biggest concern. Executives at the smallest companies

of 6 (those with annual revenues under $500 million and with fewer global resources) are also particularly likely to say that labor is a problem. Among respondents who identify labor as a significant issue, almost two-thirds are primarily concerned about the availability of well-trained labor. Indeed, though the level of concern varies somewhat, a shortage of high-quality employees remains the top issue among those concerned about labor, regardless of their company's size or location. Among those concerned about labor, labor cost is their biggest worry; only 3 percent of them cite labor disruptions and less than 1 percent of this group cite diseases or pandemics. Too many risks, too little time What are companies doing to mitigate their increasing risk? Executives cite a range of actions; of these, entering into performance contracts with suppliers is cited most often (Exhibit 3). Actions that could mitigate labor-related risk are rarely mentioned. The degree of disconnection between risk and its mitigation may be one reason that executives rate fairly poor their company's ability to mitigate their key supply chain risks, 39 percent say they are at best slightly capable of doing so (Exhibit 4). Furthermore, 41 percent of executives say that their company does not devote enough time or resources to mitigating risk nearly five times the number who say that too much time and too many resources are allocated. Respondents have mixed views on whether their supply chain risks will change over the next five years: 40 percent of executives think their company will probably or definitely face the same risks it does now, and the same number believe the risks will be different. On this point, there is minimal difference between the views of C-level executives 2 and others. Given that so many believe their risks will change, companies' lack of preparation could become an even larger problem than it is now. Notes 2 Board members, CEOs, CFOs, and other top executives. What might help Executives say they're making surprisingly little use of some well-known tools and techniques that could help

of 6 them assess the business landscape and manage risks more effectively. For example, more than half of all respondents say their company either undertakes no formal risk assessment or conducts only a qualitative assessment (Exhibit 5). Even when companies do use quantitative assessments, most executives are not using tools tailored to their specific circumstances. Executives who consider their company to be extremely capable of managing risk, however, are more than twice as likely to say they use detailed analyses of cash flow at risk 36 percent say so and are far more likely to use tools tailored to their company's risks. Only about half of surveyed executives say their company manages risk centrally, which would allow it to see risks that cut across various business units or functions. Interestingly, whether a company manages risk centrally or at the business-unit level, the percentage of executives who say that the company is generally capable of

of 6 managing its risks is almost identical (Exhibit 6). Executives are not compensating for a lack of central risk management by adopting company-wide standards or practices aimed at mitigating risk. Thirteen percent of executives say they don't know if their company has such standards, and 45 percent are sure it doesn't. Among those at companies with such standards, only 23 percent consider the standards to be very well enforced (Exhibit 7). Even though enforcement is relatively lax, executives at such organizations believe that they are far more capable of managing their risks than executives without such company standards believe they are. Sarbanes-Oxley and risk Only 18 percent of respondents believe that the Sarbanes-Oxley reporting requirements 3 help them reduce their supply chain risks. Executives below the top level of their organization, who are more likely to be dealing with the details of meeting these reporting requirements, are nearly three times as likely as those at the top to say that Sarbanes-Oxley has been helpful (Exhibit 8).

of 6 About the Contributors Contributors to the development and analysis of this survey include Ram Muthukrishnan, a consultant in McKinsey's Chicago office, and Jeffrey A. Shulman, an associate principal in the Dallas office. Notes

of 6 3 Section 404 of the Sarbanes-Oxley Act of 2002 requires all public companies to give the US Securities and Exchange Commission an annual assessment of the effectiveness of their internal controls. In addition, the independent auditors of a corporation must review its management's internal-control processes with the same scrutiny given to financial statements. Copyright 1992-2007 McKinsey & Company