Managing Supply Chain Risks

Emerging Trends & Technologies

Jeff St. John

John R.C. Pearce
StoneCross Group, LLC
CONFIDENTIAL 1 © StoneCross Group, LLC
 Agenda

 Trends & “buzz” – what has changed?

 What are major risk sources?
 What technologies/resources are emerging?
 What does “mapping risk” involve?
 Benchmarking your firm’s risk?
A recommended approach to SCRM
 Q&A
CONFIDENTIAL 2 © StoneCross Group, LLC
 What Has Changed?

CONFIDENTIAL 3 © StoneCross Group, LLC

 Supply Chain Risk Management
What Are Others Saying?

 CNN Money: The Global Supply Chain – So Very Fragile!

 Forbes: Supply Chain Risk a Hidden Liability for Many
Companies
 IDC Manufacturing Insights: Supply Chain Resilience
Research & Practice
 Fortune: Supply Chain-Risk Management & Sustainability
 SupplyChain 247: 6 Strategies to Prepare Your
International Supply Chain for Disruption
 MIT/PwC: Supply Chain & Risk Management 2013 Study

CONFIDENTIAL 4 © StoneCross Group, LLC

 Evolutions of Supply Chain Complexity
MIT Forum: Supply Chain & Risk Management

 Studied 209 companies with global footprints

 Dependencies between supply chain entities has
increased
 Changes in SC network occur more frequently
 Increased product introductions
 Products and services becoming less standard
 Number of entities in supply chain has increased
What Would You Add?
CONFIDENTIAL 5 © StoneCross Group, LLC
 Top Sources of Supply Chain Risks
Massachusetts Institute of Technology 2013 Study

 Raw Material Price Fluctuations

 Currency Fluctuations
 Market Changes
 Energy/Fuel Price Volatility
 Rising Material Scarcity
 Rising Labor Costs
 Geopolitical Instability
 Supplier/Partner Bankruptcy
 Technology Changes
 Unplanned IT Disruptions
CONFIDENTIAL 6 © StoneCross Group, LLC
 Elements to Controlling Risk

 Real Time Incident / Event Awareness &

Monitoring of a Global Nature
 Knowledge of Mandatory Compliance with
• Applicable Laws, Regulations and Practices
 Complete, Up-To-Date Database & Mapping of
• Primary, secondary and sub-tier areas of exposure
• Your locations – suppliers, partners, customers, people

 Relevant KPI’s to tie back to SCR

 Integrated knowledge of finished product
components and relationship to supplier(s)
7
CONFIDENTIAL 7 © StoneCross Group, LLC
 Supply Chain Mapping
Visualizing Your Supply Chain – Amerigo

CONFIDENTIAL 8 © StoneCross Group, LLC

 Supply Chain Risk Mapping

“It pays to have supply chain backup

plans……..

……….providing you know

what to backup!”

……SCAIRTM

CONFIDENTIAL 9 © StoneCross Group, LLC

 The SCRM Challenge
Where Does Risk Exist – How Is It Addressed Today?

RAW MATERIAL DISTRIBUTION &

MANUFACTURING LOGISTICS WAREHOUSING
SOURCING

Manual, Inefficient Processes for Tracking Risk

CONFIDENTIAL 10 © StoneCross Group, LLC

 Emerging Technologies & Offerings
Incident Tracking – Planning – Execution – Visibility – Mapping

 Resilinc  MetricStream
 Razient  Trade Merit
 Amerigo  CDC/Aptean
 InterSys Ltd (SCAIRTM)  Manhattan Associates
 GT Nexus  Marsh Risk Consulting
 PW - KPMG – Deloitte  SCRLC
 FM Global  ISO 28002

CONFIDENTIAL 11 © StoneCross Group, LLC

 Global Event Tracking - a Deeper Dive
Courtesy of Razient Technologies

CONFIDENTIAL 12 © StoneCross Group, LLC

 Event Tracking for Supply Chains
A Technology Preview – What They Do

 Provides timely, daily visibility of all relevant incident types

and threats specific to your locations, supplier/sub-
supplier, third parties and customer locations
 Configurable action and response steps to quickly address
risks and threats that may disrupt the flow of goods,
materials or other supply chain activities
 Tracks compliance against best practices, your company
standards, applicable laws and regulations including global
regulatory requirements of every vendor in your network
 Opens new possibilities of pro-active management of risks
and human capital via mobile capabilities

CONFIDENTIAL 13 © StoneCross Group, LLC

 Defining Events to Track
Incidents are Tailored for your Supply Chain

CONFIDENTIAL 14 © StoneCross Group, LLC

 Going from Reactive to Pro-Active
Alerts Monitoring

Global Incident
Management

 Global threat
dashboard
 Data feeds from
numerous data
sources
 Immediate correlation
to locations
 Determine which
locations/parts are
facing potential
threats
 Crisis management
tracking, and
mitigation steps

CONFIDENTIAL 15 © StoneCross Group, LLC

 Going from Reactive to Pro-Active
Compliance Tracking

Compliance Management

 Achieve regulatory
compliance and industry
best practices
 Customize, distribute,
manage, and monitor risk
Surveys
 Reduce cost of vendor
risk management
through automated
processes
 Track and report on
compliance results
 Utilize a library of
predefined assessments
 Archive compliance
results
 Centralized document
collection

CONFIDENTIAL 16 © StoneCross Group, LLC

 Mobile Event Tracking Capability
User Alerts – Incidents – Notifications – General Content

CONFIDENTIAL 17 © StoneCross Group, LLC

 What is your SC Risk Maturity?
How far do you have to go?

 Prelimnary Discussions?  Risk mitigation strategy

exist?
 Risk Management
integrated into your SC?  Are critical suppliers
cooperative?
 Mapped critical suppliers &
associated risk?  Are third-parties evaluated
for Risk?
 On-going assessment
strategy for Risk?  Suppliers periodically
evaluated for Risk?
 Suppliers chosen based on
Risk elements?  Do you know of critical
“risk funnels” that you
 Do you segment Risk
share with competitors?
strategies?
CONFIDENTIAL 18 © StoneCross Group, LLC
 SC Risk Maturity Benchmark
MIT Study Results: 60-40-10

Reactionary  All Risks

Awareness  Traditional risks
Proactive  Non-traditional risks
Integrated  “Black swan” events
Resilient  Major emerging trends/risks

CONFIDENTIAL 19 © StoneCross Group, LLC

 SCRAM®
An Approach To Risk Management

• Define risk area and scope

Define • Categorize the nature of the risk, i.e., (non)compliance or
incident

• Develop a baseline of current activities / performance

Measure • Assess the current processes and controls environment

• Assign relative risk value to factors affecting risk in each

Analyze risk area
• Identify changes or other factors that can positively or
negatively affect the risk

• Improve processes and controls

Improve • Identify ways to remove or avoid situations which affect
risk exposure

• Develop processes and structure to manage and monitor

Control risk
• Develop reporting mechanisms to warn of situations or
incidents which affect risk exposure

20
CONFIDENTIAL 20 © StoneCross Group, LLC
 SCRAM® Approach
Define risk area and scope / understand Client Business Practices

Define  Complete Initial Client Profile Background and Understanding

Document

 Work with Executive Leadership to Complete the Risk Intelligence

Measure Maturity Model
• Identify key stakeholders in the organization
• Complete Individual Maturity Model Analysis with each stakeholder
• Compile and Analyze Results
• Work with organizational Leadership to interpret results
Analyze

 Identify Key Organization Stakeholders / Leadership Team to

participate in the Supply Chain Assessment & Management
(SCRAM®) process
Improve

 Work with Stakeholders / Leadership to strategically identify

“Critical Risk Areas” of focus to highlight during process
Control

21
CONFIDENTIAL 21 © StoneCross Group, LLC
 SCRAM® Approach
Assess Current Processes and Controls Environment

Define
 Deploy Subject Matter Expert(s) (“SME”) to conduct Risk
Assessments
• Meet with key Client process and control owners
• Remote and In-Field assessments of Client processes and controls

Measure
 Document Risk Assessment results
• Document discussions with process and control owners
• Document Client processes and controls pertaining to Risk assessments
• Obtain supporting documentation, as necessary, to support processes and controls
Analyze
 Confirm Risk Assessment results with process / control owners
• Compile results of assessments
• Follow-up discussions with process and control owners to validate findings

Improve

Control

22
CONFIDENTIAL 22 © StoneCross Group, LLC
 SCRAM® Approach

HIGH 24 13
Define

Relatively Low High Vulnerability to

Probability of Occurring Enterprise and Requires
Consequences

Measure
BUT Relatively High Constant Attention
Consequence
8

Analyze 1

Relatively Low Relatively High

Probability of Occurring Probability of Occurring
Improve and Relatively Low BUT Relatively Low
33 Consequence Consequence
18

Control LOW Probability of Occurrence HIGH

23
CONFIDENTIAL 23 © StoneCross Group, LLC
 SCRAM® Approach
Identify Improvement Initiatives Using Lean / Six Sigma Tools for
Mitigating Risk

Affinity Diagram: Brainstorm improvement ideas around a risk

Define area and group ideas for the purpose of selecting the most
appropriate

Cause and Effect Diagram: Identify the various changes and

Improvement
Measure initiatives that can affect the improvement effect desired Ideas

Interrelationship Diagram: Identify and analyze the cause and

Analyze effect relationships across the various issues initiatives to
highlight key drivers and outcomes in a holistic manner

Force Ranking: Force rank the improvement changes /

initiatives based upon severity of the risk outcomes from
Improve not making the changes

Control

24
CONFIDENTIAL 24 © StoneCross Group, LLC
 SCRAM® Approach
Develop Processes to Manage and Monitor Risk

 Establish Official “Enterprise Risk Management” (ERM)

Framework
Define • Document auditable Control Objectives and Control Activities within
ERM
– Entity-Level Controls
– Controls Objectives and Activities by Risk Area
Measure • Document Client Entities governed by ERM Framework
• Establish Control Owners within Client organization
• Establish Control Assessment Rotation Plan / Frequency

Analyze  Consider Adoption of a Risk Management Tool for Ongoing

Management and Monitoring of Organization-Wide Risks

Improve

Control

25
CONFIDENTIAL 25 © StoneCross Group, LLC
 ISO 28002

CONFIDENTIAL 26 © StoneCross Group, LLC

 ISO 28002:2011
Latest Version of ISO Standards

“……specifies requirements for a resilience

management system in the supply chain to
enable an organization to develop and implement
policies, objectives, and programs, taking into
account legal, regulatory and other requirements
to which the organization subscribes; information
about significant risks, hazards and threats that
may have consequences to the organization, its
stakeholders, and on its supply chain; protection
of its assets and processes; and management of
disruptive incidents.”

CONFIDENTIAL 27 © StoneCross Group, LLC

 SCRLC
Supply Chain Risk Leadership Council

“A cross-industry organization including

world-class manufacturing and services
supply-chain organizations and academic
institutions that work together to develop
and share best practices in supply-chain risk
management. Its mission is to create supply-
chain risk management standards, processes,
capabilities, and metrics that reflect current
best practices and can be widely adopted.”

CONFIDENTIAL 28 © StoneCross Group, LLC

 Benefits of a Mature SC Risk Program

“Companies with mature capabilities in

supply chain management and risk
management do better along all
surveyed dimensions of operational and
financial performance than immature
companies.”
MIT Forum for Supply Chain Innovation 2013
[email protected]
Phone: 1-617-852-2708
CONFIDENTIAL 29 © StoneCross Group, LLC
 Questions

CONFIDENTIAL 30 © StoneCross Group, LLC