What Every Procurement Professional Should Know About Supplier & Supply Chain Risk - Louis Ferretti, Project Executive at IBM

1. photo of the "Ital Florid by NASIM4248
© 2015 IBM Corporation1
What Every Procurement Professional Should
Know About Supplier & Supply Chain Risk
Louis Ferretti, Project Executive
Product Environmental Compliance and Supply Chain Social Responsibility Programs
… and How to
Uncover, Assess,
Manage and Mitigate
Supplier and Supply
Chain Risk
Celtic Manor Resort
Wales June 17 - June 18, 2015

2. RISK is one of the SIX mega-trends impacting
enterprises around the world
• Managing market and political
uncertainty is more complex than ever
• Accelerating global shifts pose new risks;
resiliency/responsiveness differentiate
• Evolution to a holistic view of risk
management
• Risks can be hedged through intelligence
Risk
Complexity
IBM Chief Supply Chain Officer Study Identified
The Top Five Challenges
Risks, both operational and financial, is the #2
concern of supply chain executives worldwide
Supply chains have become increasingly more
global and complex, bringing with them greater
challenges and risks
• Japan earthquake / tsunami
• Thailand Flooding
• Hynix China Fire
• Philippines Typhoon
• Thailand State of Emergency/Martial Law
• Ukraine Political Unrest
• Russian Sanctions
• Gaza Bombings
• Greece Euro
• Manage risks within the extended supply chain
based on continuous risk assessment
• Utilize a collaborative and structured approach
• Reduce vulnerability, increase resiliency and
ensure supply continuity via mitigation planning
Risk Management System
Risk
Assessment
Risk
Mitigation
Planning
On-going
Risk
Monitoring
and Control
1. Globalization Redefined
2. Technological Progress
3. Population Migration
4. Risk Complexity
5. Sustainability Imperative
6. Informed Customer
Major factors affecting the enterprise today
Managing Risk is an imperative for Business Continuity Planning
2
Business Continuity Planning & Supply Chain Risk – An Overview
2

3. 3
External Environment
Senior
Leadership
Approval and
Ownership
Business Strategy
Operational Model
Financial Model
Emerging
Risks
LowMedium-LowMedium-HighHigh
HighMedium-HighMedium-LowLow
 Sample
 Sample
 Sample
 Sample
 Sample
 Sample
 Sample Sample
 Sample Sample Sample
 Sample
 Sample
 Sample
 Sample Sample
 Sample
 Sample
 Sample
LowMedium-LowMedium-HighHigh
HighMedium-HighMedium-LowLow
 Sample
 Sample
 Sample
 Sample
 Sample
 Sample
 Sample Sample
 Sample Sample Sample
 Sample
 Sample
 Sample
 Sample Sample
 Sample
 Sample
 Sample
Impact
Likelihood
Reputation
Board / Audit
Committee
Review
Relationship with critical suppliers:
Ability to manage the end-to-end supply chain, including
the dependency on critical suppliers
Risk
Management
Competitive
Advantage
Enablement
Effectiveness
Program
and Practices
Leadership
Report Communicate
Monitor Implement
External
Research
Executive
Interviews
 A systematic approach to Identify, Assess and Address risk
 Enterprise-wide view
 Focus on both hazards and missed opportunities
 Improve business results and drive competitive advantage
IBM has developed a robust Risk Management program – and Supply Chain risk
management is an important focus area
3
IBM Enterprise Risk Management

4. Supplier Failure
Currency
Political
Fuel Costs Social Responsibility
Intellectual
Property
Attrition Rates
Labor Disputes
Labor Costs
EnvironmentalRegulatory Compliance
Product Safety
Taxes
Responsiveness
Brand Impact
Geophysical
4
Supply Chain Risks
Cyber Security
4

5. 5
How “Risky” is the Supply Chain ?
Supply chain failures continue to be the top concern for
US and Canadian business leaders. …
The CHUBB Multinational Risk Survey finds that
 ….. Businesses cite supply chain failure as the top
concern. …
 ……[only] 56% of the companies report having a
business continuity plan..
… The lack of continuity plans … is disturbing
From Inside Supply Management – June/July 2014
Global Trends – news in a changing world
5

6. 6
Initial and On Going Risk Compliance – to legal and internal policies
 Ethics, Bribery and Corruption
 Import / Export & Embargoed Country Restrictions
 Environmental, Product Safety, Electromagnetic Compatibility (EMC)
 Chemical Management and clean up
 Quality and defective products reporting, corrective action and recalls
 Diverse business relationships
 Data security
 Sustainability and code of conduct
 Financials
 Supply chain risk / business continuity planning

7. 7
- successfully uncover and manage supplier and supply chain risk
 Well defined “on boarding” check list and tool
 Risk profile assessment
 Documented process, line ownership and management system
 Data base / tool to house data and perform computations
 Impact / likelihood weighing algorithm
 Risk ranking methodology
 Mitigation and business continuity plans
 Real time alerts
 Experienced cross functional, multi cultural core team
Key ingredients necessary to

8. Setting the Context
Executive Direction
c. 2009
….. will initiate a broad piece of work to evaluate the risks in our extended
supply chain….. will prioritize based upon known or anticipated issues.
 The gas supply
 …. Israeli situation
 …. ongoing issues in Thailand
 …..effects of a lower economic growth rate on political and social stability
 And many other risks including but not limited to transportation
costs/climatic/political/economic/social/environmental/health, etc...
 …. globalizing our supply chains have introduced additional risks
8

9.  2 x year complete Supply Base Assessment
 Country / Hub / Supplier / Supplier Site / Commodity
 External and Internal Market Intelligence
 Real Time Alerts
 Critical elements of the Supply Chain for Countries,
Hubs, Suppliers, Sites, Commodities
 External and Internal Market Intelligence
 Additional Market Intelligence Feeds and Actions
 White Paper, Advisories, Weekly Reports
 Bi-Weekly Updates to the Management Team
 Quarterly Briefing to IBM‘s Chief Risk Officer
 Central Repository (aka community) for all Risk Related Topics
 External Data Source focusing on selected growth market countries
and hubs
 Providing specialized alerts
 External Data Source Provider searching upstream supply chain, e.g.
 Conflict minerals, rare earth metals
9
Highlights - Risk Process and Management System

10. Our objective is not to eliminate risk, because without risk there is no progress.
Instead it is to ensure we can manage and mitigate risks.
Social
Listenin
g
Market
Intelligence
Social
and
Environmental
Leadership
Business
Analytics
Supplier Total Risk Tool & Process
Risk
Assessme
nt
Risk
Mitigation
Planning
On-going
Risk
Monitoring
and
Control
• Comprehensive risk assessment
• Ongoing mitigation
Protections against loss of
revenue and profits by minimizing
likelihood and severity of supply
chain disruption
Solution
ISC Risk Management Tools
Managing market and political uncertainty is
more complex than ever
Risks can be hedged through intelligence and holistic view
of risk management
1. Incorporating key
information about
global supply chain
from market
intelligence
communications
2. Augmenting
existing information
not available via
current market
intelligence
processes
3. Listening for
sentiment and
trends for critical
items and events
• IBM Outstanding Innovation Award
• Patent for impact likelihood algorithm
• CSCMP finalist for Supply Chain Innovation Award
10
Uncovering and Managing Supplier / Supply Chain Risk
Key BenefitsRecognition
• Uncovers multiple risks, assesses likelihood & impact of each
• Addresses risks with formal mitigation plans
• Provides consistent risk management approach across
brands/commodities
• Trends and patterns are revealed by systematic risk analysis

11. Risk Mitigation Plans
(via Lotus Notes database)
Plans formulated to address
identified risk
Plans reviewed and approved by
management
Supplier Financial Risk
Assessment (SFRA) Tool
Supplier-Site & Pandemic
Questionnaires
Commodity
Lead
Council Lead
Supplier &
Commodity
Questionnaires
Country & Hub
Questionnaires
Market
Intelligence
External Data
Source Provider
Country & Hub
Questionnaires
Cognos Business
Intelligence Reporting
• Risk ratings by …
Country
Hub
Supplier
Supplier Site
Commodity
Reports Generated …
- Global View
- Supply Chain Report
- Questionnaire Report
-
Risk
Identified
Total Risk
Assessment Tool
(Determines Risk Rating for
combination of all entities and risks)
Business Continuity
Planning Supplier
Assessment Ratings
Complemented by
Real Time Alerts from External Data Source Provider
– anytime, re. potential disruption threat
Supply Chain Social
Responsibility Audit
Compliance Reference
11
Total Risk Tool and Process Landscape

12. Categories Supplier Site Supplier Commodity Country Hub
Pandemic 
Disaster Production Stoppage,
Pandemic related
Raw Material
related
War and Civil
Unrest related
Shut Down
related
Communication &
Cooperation 
Environment &
Natural Hazards   
Economic /
Financial  
HR  
Infrastructure,
Logistics & Energy    
Labor & Health  Includes
Pandemic
Political, Legal &
Social   
Product & Market
Requirements 
Quality 
Security 
Strategic
Importance 
12
Categories and Types of Risk Evaluated

13. Supplier Risk Assessment
0.000%
10.000%
20.000%
30.000%
40.000%
50.000%
60.000%
70.000%
80.000%
90.000%
100.000%
0.00% 20.00% 40.00% 60.00% 80.00% 100.00%
L
I
y = 1 / (10 * (x + 0,05)) + 0,1 y = 1 / (10 * (x + 0,20)) - 0,1 Supplier
High Risk
Medium Risk
Low Risk
Impact
Likelihood
13
Impact / Likelihood Assessment

14.  Real time alerts from External Data Source Provider of specific aspects as events unfolded
provided an assessment damage and how quickly supply could be restored
 Based on tool out put, immediately knew number of suppliers in Japan, which categories
affected (e.g. commodities, logic, memory) and what tier supplier impacted
 Able to immediately contact suppliers and understand
- Extent of damage
- Whether in exclusion zone or not
- Ability to produce / maintain measure of supply continuity
- Supplier contingency plans
- Mitigation Actions (e.g. moving manufacturing to alternative locations)
 Can look for supply continuity down through multiple levels of supply chain where IBM has
qualification / sourcing relationships with sub tier suppliers
- Through use of related tool and process
 12-24 hour head start in securing supply and implementation of mitigation actions
14
2011 Japan Earthquake / Tsunami and Thailand Flooding
- Demonstrated value of tool and process
Case Study

15.  Likelihood Impact Model
 Risk = Probability of Risk Event x Impact to Business
 Heat Map with modified Thresholds
 Thresholds set to capture 10 – 15% High Risk Supplier
 ~95%+ Spend Coverage ($6 bn)
 ~450 High to Low Impact Suppliers
 ~2400 Supplier Site-Commodity Combinations
 Main driver Component and Memory
 Subtier Supplier include certified Fab locations
 Differentiation between Fab, Assembly and Test
 Components, Logic, Microcomponents, test
 ~ 60 Commodities Tracked
 From finished Boxes to Assemblies to Chip Families
 ~50 Country and Regions Tracked
 All Growth Markets covered
 ~50 Key Transportation Hubs Tracked
 ~ Main Country Entry and Exit Transportation Points
15
Factoids

16.  Past (examples)
 Bangkok Political Unrest 2009 / 2010
 Russia – Ukraine Gas Dispute 2009 / 2010
 Japan Tsunami and Reactor Melt Down 2011
 Thailand Flooding 2011 / 2014
 Super Typhoon Haiyan – Philippines 2013
 Hynix Wuxi, China DRAM plant fire 2013
 Thailand State of Emergency 2014
 Ukraine political unrest 2014
 Madagascar hurricane 2014
 Chilean earth quake and tsunami 2014
 Mexico City earth quake 2014
 WTO ruling and China Appeal re. Rare Earth Metal ruling
 Export of ore restrictions 2014
 Continued Focus on Youth Unemployment in Europe
 Youth Unemployment trigger to Social Unrest 2013/5
 Russian Sanctions 2014/5
 Vietnam roits against Chinese businesses 2014
 Thailand Martial Law/New Regime 2014
 Ukraine 2014/5
 Argentina Bond Repayment 2014
 Greece and EU 2014/5
 Korea/Hong Kong MERS 2015
Source http://www.abc.net.au/news/2014-01-10/fresh-
protests-at-rio-expulsions2c-demolitions/5193272
Source
http://en.wikipedia.org/wiki/Typhoon_Haiyan
16
Assessment of Major Risk Events

17.  Supplier Sourcing
 Consider Supplier Risk in Sourcing Process
 Use as decision support tool to award
business
 Business Continuity Planning
 Consider BCP Readiness into Supplier Risk
 Inadequate BCP Readiness require Mitigation
Action to Improve Risk Score
 Risk of Flooding
 Multiple input parameters like topography,
historical weather pattern, soil type, ...
 Selected Countries
 GPS tagging of Supplier Location
 Publicly Available Data Maps
 Views provided to Sourcing teams
 Use of Mobile Communication
(under development)
 Bi-directional Communication with Suppliers
 Share Risk Events
17
Pro-Active Elements of Risk Management

18. 18
Real time order
status visibility and
exception alerts
 Credibility and reliable
information
 Increased customer
satisfaction levels
Effective supplier
collaboration
 Reduced inventory levels
and operations cost
 Improved sharing of
demand information and
collaboration
Intelligent Operations & Resolution Center
Key Benefits
IBM
Client
Business
Partners
Suppliers
Improved visibility
into finished goods
inventory
 Better service level
commitments
 Order status
notifications
Transparent operations
management
 Issues / risks identification
and correlation to assess
impact to supply chain
 Next best action initiation
 Alert / exception driven
(mobile & web) model
 Single version of truth
Transparent Supply ChainCloud SocialAnalytics Mobile
TSC Functions
Mobile App for alerts
Global Level KPIs
with drill downs
Geo spatial & other
visualizations
Our vision is to create the most transparent supply chain in the
world: predictive, social, real-time, and global

19. Transparent Supply Chain – Geospatial Map Alerts
- Possible Supplier/Supply Chain Opportunities for Disruptions
22

20. World Wide Risk Events 2014
23

21. 21
Risk Rover using Watson Content Analytics (WCA)
 Project funded via IBM internal ISC Venture Captial
 Sole Supply Chain Project nominated in 2015 for Extreme Blue™
 Extreme Blue™ is IBM's incubator for new Talent and Technology
 Analyse Climatic Risk Events using WCA utilizing
– Social Listing
– Analytics & Big Data
– Mobile
– Cloud
 Top Talent Interns selected to support 12 week event
 IBM Risk Team consists of technical and business Mentors
 Project’s 3 Objectives
– Minimum - Proof of Concept Validation
– Target - Expand to additional predictive analytics
– Stretch - Expanded into Watson Q&A type insights

22. Predicting Risk with Certainty
Domain:
Risk team receives many reports and updates re. threats (man made and natural) that can impact supply
continuity. Most do not come to fruition causing a supply interruption. Taking action to move the business,
when threats do not materialize, produces a measure of distraction, lost time and wasted effort by the
teams.
Concept:
Search recent and past social, political, economic unrest events to determine if they: a) do come to
fruition, and b) if they do, is there an impact to in country commerce, aka disruption transportation, roads,
airports, etc.? Conduct same exercise for climatic events.
Evaluation of data can show what is the likelihood of an event a) coming to fruition (e.g. disruption) and b)
if it is disruptive, what is the likelihood that supplier’s business being interrupted in terms of continuity of
goods and services?
Data Sources:
Collect and analyze vast array of news reports of social, political, economic unrest events as well as
climatic events – over last x years.
Benefits / Opportunity:
Procurement, Engineering and Supplier resource conserved and only expended when situation indicates
a high likelihood of an event materially impacting the supply chain.
22
“Risk Rover” – Watson Project

23. Executive Interest and Support
Vice President and Controller –
 In response to the IBM Board of Directors Audit Committee Meeting, acknowledged our current work is the
right strategy and vision. “The Data Analytics presentation was very well received by the Audit Committee. I
walked them through our strategy, … and wrapped up by outlining the impact of Analytics on the
Enterprise Risk Map. The Audit Committee was very engaged throughout the presentation and
acknowledged that this was the right strategy and vision”
IBM Vice President & Chief Risk Officer --
“I personally reference the tool internally and externally as a prime example of IBM's use of Analytics to
support risk management initiatives which clearly underscores our thought leadership in this area. ”
IBM Corporate Office, Director, Global Risk and Insurance Management –
“This tool has been a huge differentiator for IBM when we present our risk profile to the property
insurance underwriting community. Business Interruption and Contingent Business Interruption are ever
expanding exposures to an organization and not only can impact income to the organization but also our
ability to meet our commitments to our customers.”
IBM VP & Chief Procurement Officer –
“Managing and reducing risk in the supply chain … will be key to IBM’s global growth in the future”
23
Corporate-wide Supply Chain Risk Assessment - viewed as the
right strategy and vision, key to global growth and a differentiator

24.  Risk management is a fundamental building block to a supply chain strategy
 Supply Chain Leaders are integrating process controls in their logistics and
operations, supplier compliance programs and planning process
 Procurement can deliver true value using an intelligent and comprehensive risk
assessment program with suppliers
 A strong supplier / supply chain risk management program, can
- demonstrate to clients that IBM can be a reliable supplier, and
- be a key factor in preserving and growing revenue
- be featured to insurance underwriters as rationale for reduced
premiums
 Objective of these processes is not to eliminate risk
- without risk there is no progress
- instead it is to ensure we can manage and mitigate risks
 “Managing and reducing risk in the supply chain …
will be key to IBM’s global growth in the future”
- John Paterson, former IBM VP & CPO
24
Supplier / Supply Chain Risk Management
– Key Takeaways