Report Details: The research for this report was conducted via an online survey from March 12 - May 11, 2018. Surveys were conducted among 93 respondents -- a mix of business users (manufacturers, wholesalers/distributors/co-operatives, and third-party logistics providers, n=34), vendors (software providers and consultants, n=39), and others (academics, analysts, unemployed, and others, n=20). Objective: To understand the current and expected future state of supply chain risk management, the biggest drivers of risk, and the impact on supply chain disruptions. NOTE: supply chain risk management is defined as the proactive identification and assessment of potential risks to the supply chain, as well as the development of strategies to avoid these risks. Highlight: Nearly two-thirds of respondents believe that their company performs better today on risk management practices than five years ago yet they had 3.5 disruptions last year on average. Managing risk requires a network approach. Today’s investments in end-to-end supply chain are by and large not effective in risk mitigation. Only 37% have visibility of extended-tier suppliers and most lack the solutions to manage global complexity.

1. How Can You Drive
Opportunity If You Cannot
Manage Risk?
Insights on Risk Management from a Quantitative Study
07/25/2018
By Lora Cecere
Founder and CEO
Supply Chain Insights LLC

2. Page 2
Contents
Disclosure
Open Content Research
Executive Overview
How Can You Drive Opportunity If You Cannot Manage the Risk?
Managing Risk and Ensuring Business Continuity
Deploying Risk Tactics to Avoid Business Discontinuity
Integrated Planning a Risk?
Technologist Versus Business Leaders: Gaps and Realities
Recommendations
Conclusion
Appendix
Other Reports in This Series
About Supply Chain Insights LLC
About Lora Cecere
3
3
4
6
7
8
10
14
16
17
18
22
23
23

3. Page 3
Disclosure
Your trust is important to us. In our business, we are open and transparent about our financial
relationships and our research processes; and, we never share the names of respondents or give
attribution to the open comments collected in the research. This research on risk management was
100% funded by the Supply Chain Insights team.
In the development of our research our philosophy is, “You give to us and we give to you.” As a part
of this philosophy, we share data with all respondents; and if interested, we will share our insights
with the respondents on a one-hour phone call with their team. We are committed to delivering
thought-leading content. It is our goal to be the place where visionaries turn to gain an understanding
of the future of supply chain management.
Open Content Research
This report is shared using the principles of Open Content research. It is intended for you to read,
share, and use to improve your supply chain decisions. Please share this data freely within your
company and across your industry. All we ask for in return is attribution when you use the materials in
this report. We publish under the Creative Commons License Attribution-Noncommercial-Share Alike
3.0 United States and you will find our citation policy here.

4. Page 4
Executive Overview
Risk. Reward. Business Continuity. Companies must manage risk to drive opportunity. While
companies believe that they have it under control, as will be shown in this report, few are mitigating
risk to drive opportunity.
This report shares insights on a recent quantitative study of 93 respondents. This included business
leaders, technology providers and industry thought-leaders.
Since there is no industry definition of risk management, we started the research process with one.
For the study, we defined risk management processes as “the proactive identification and
assessment of potential risks to the supply chain—as well as the development of strategies to avoid
these risks." The study included questions on the management of uncertainty, the prevention of a
disruption, and/or tactics to buffer volatility.
In the report, 64% of respondents believe their company performs better today on risk management
practices than five years ago. We question this since in the study, the average company had 3.5
supply chain disruptions in 2017. This data is similar to results from our prior research studies (listed
at the back of this report).
A disruption is defined as a major outage or discontinuity in operations. Few companies in the survey
have departments to focus on risk management. Instead, risk management is embedded in other
practices for nearly two-thirds of respondents. However, based on the results of this study, we
question if it is embedded effectively.

5. Page 5
Figure 1. Study Summary
When companies think about “risk,” the focus is on the management of “supply-side issues.” Few
companies think about the “demand-side impact” of risk, or the “growing issues of channel
complexity.” In the last recession, it took the average company six months to sense market shifts and
make adjustments. Not much has changed. For all, this is an opportunity.
Managing risk requires a network approach. Today’s investments on end-to-end supply chain are, by
and large, not effective in risk mitigation. As will be seen in this report, approximately one-third of
respondents report having visibility of second-tier suppliers, and most lack the solutions to manage
global complexity.
While supply chain technologists offer a range of solutions to improve risk management, most focus
on improving supply chain visibility. There is a gap between business requirements and technology
solutions. Few technologists understand the need for solutions to help companies manage the
complexity of operations, or the increasing requirements for regulatory compliance.

6. Page 6
How Can You Drive Opportunity If You
Cannot Manage the Risk?
The goal for most business leaders is to drive profitable growth. It sounds simple, but it is not. Global
growth is slowing to the levels of Gross Domestic Product (GDP). For example, for the period of
2010-2017 in consumer goods, as shown in Table 1, it was 1.7%. This is down dramatically from the
pre-recessionary growth rate of 6%.
Public markets reward growth. As the rate of year-over-year revenues slows, companies attempt to
deploy tactics to stimulate growth. Most fail. In consumer goods supply chains, this includes new
product launches, price incentives, and trade promotion management. In the digital world, traditional
broad-brush marketing programs become less effective. Yet, they are still widely deployed. The
residual effects drive higher demand error and increased complexity.
Table 1. Performance of Consumer Household Nondurables Companies for the Period of 2010-2017
While most leaders, early to the subject of risk management, think of business continuity and the
containment of risk as the mitigation of natural disasters, managing the event response is the easy
part of business continuity. As shown in Figure 2, the tougher issues lie with the management of
complexity and volatility. These risk areas are becoming more problematic. The deployment of tactics
to mitigate risk in these areas is critical.

7. Page 7
Figure 2. Risk Management: A Comparison of Perspective of Past Five Years vs Prior Five Years
Managing Risk and Ensuring Business
Continuity
While most companies focus on business continuity through plans for natural disasters, i.e.
earthquakes, floods, hurricanes and drought, this is not sufficient to meet the challenge of risk in
today’s supply chain. The good news is that corporate preparedness for natural disasters is equal to
the challenge and has helped global supply chains weather the many storms like hurricanes Harvey,
Irma, Maria, and Sandy.
Business continuity and risk mitigation requires more than just a focus on natural disasters. As shown
in Figure 3, the top events impacting companies were not always natural disasters. When asked
about the top three events which impacted their supply chains during the period of 2013-2018,

8. Page 8
respondents mentioned cyber security, port infrastructure issues, shifts in economic policy with Brexit,
and changes in truck regulation in North America.
Figure 3. Risk Management and Top Three Events Impacting Supply Chains for the Period of 2013-2018
Cyber-attacks are worthy to note. The impact is growing. It was not a major factor in our prior risk
management reports. It is expected to grow through the evolving decade.
Deploying Risk Tactics to Avoid Business
Discontinuity
Risk management is rooted in the deployment of winning tactics. It requires day-to-day attention. This
requires defining an end-to-end supply chain strategy, which extends past the four walls of the
enterprise, to design networks in order to drive a winning response. Supply chain design and the
business basics of relationship management (customer and supplier policy) are the basis for driving
business continuity. This includes alignment discussions with suppliers and customers, scorecarding,
and business alignment. These are shown in Figure 4.

9. Page 9
Figure 4. Risk Management Tactics
Inventory strategies are critical to risk management. Designing the supply chain with a focus on the
form and function of inventory (see Table 2), platform simplification, sourcing flexibility, and "what-if"
analysis capabilities are critical. Most companies are not good at these basics. Based on prior
research, only 1/3 have supplier development programs, 1/3 have “what-if” capabilities, and only 12%
design/modify the supply chain with a focus on form & function of inventory.1 Most are very focused
on transactional efficiency, but have a false sense of security on risk management prevention and
tactics to ensure business continuity.
Table 2. Form and Function of Inventory
1
Supply Chain Insights Research Report, http://supplychaininsights.com/portfolio/maximizing-the-roi-in-supply-chain-planning-
insights-from-quantitative-studies/, July 25, 2018

10. Page 10
In contrast, traditional supply chain planning processes only focused on the management of safety
stock. To mitigate risk, a sole focus on safety stock is not sufficient.
Let's learn from the story of Baxter International and the production of small IV bags in Puerto Rico.
The product was sole-sourced from Puerto Rico in a heavily regulated industry. So when hurricane
Maria decimated the island, and power became an issue, Baxter could not manufacture the product
at their three sites, all in Puerto Rico. The design of the supply chain did not allow for alternative
production sites. This is an example of needing to design the supply chain for alternate sourcing.
Few companies know the locations of their second and third tier suppliers. When a disaster hits,
many only know that there is an issue when a supplier cannot respond. This was the case for Ford in
the Japanese crisis.
In addition, item complexity is a silent killer of supply chain performance. It increases volatility,
operational complexity, and supplier risk. Complexity is like cholesterol. There is good and bad
complexity like there is good and bad cholesterol. Good complexity increases growth and improves
profitability, while bad complexity only adds cost and complexity. Unfortunately, less than 5% of
companies actively manage item complexity.2
Integrated Planning a Risk?
Most clients designed planning systems with tight coupling of planning to Enterprise Resource
Planning (ERP) without stepping back and asking the question, "What Does Integrated Planning
Mean?" Integrated planning usually includes the tight integration of supply chain planning to ERP.
ERP-based systems, by design, result in functional efficiency. Functional efficiency and alignment are
diametrically opposed. The ERP solutions optimize source, make, and deliver, within silos, but lack
the ability to drive alignment and improve agility. Consequently, companies are making systems more
efficient, but less effective. Risk management success depends on agility. They go hand-in-hand.
This includes the tactics of “what-if” analysis, alternate sourcing, platform simplification and
rationalization, postponement strategies, and common substrates.
When it comes to agility, there is no common industry definition. As a result, many people tout the
need to improve agility, but are unable to deliver. In Figure 5, we share the current state of supply
chains by attributes as assigned by the respondents in the study.
2
Supply Chain Insights Research Report, http://supplychaininsights.com/portfolio/improving-supplier-reliability/, July 25, 2018

11. Page 11
Figure 5. Attributes of Study Respondents
We define agility as the ability to have the same cost, quality, and customer service given a level of
demand and supply volatility. The first step in delivering an agile supply chain is a clear definition.
The second step to drive value is defining the flows and aligning the tactics. The most agile supply
chains are outside-in, using channel data. This decreases demand latency and improves market
sensing. The traditional supply chain process, with a focus on orders and shipments as a source of
demand (transactional efficiency), is like dancing on a back foot with your hands tied behind your
back. While reducing demand error is not always possible, companies can design the supply chain to
increase agility.
As shown in Figure 6, the expected state in the next five years is much different from what we have
today. Companies expect more than functional silo optimization and a reactive response. The goal is
alignment, agility, proactivity, and outside-in. It is for this reason that we must abandon the thinking of
silo-based optimization of ERP and conventional Advanced Planning solutions (APS). Instead, start
with network design. Build agility into the supply chain using tactics to buffer demand and supply, and
align push-pull decoupling points. Use this data as the targets for your cognitive and prescriptive
analytics. These solutions, based on machine learning and cognitive computing, are evolving fast in

12. Page 12
the market and ever so slowly in the labs of conventional ERP providers. Define ERP as only the
financial system of record for transactions. To drive agility, test multiple systems and implement best-
of-breed solutions which give the best answers. Test and learn with technologists. Sidestep big
projects and large consulting groups.
Figure 6. Future State
Risk Management Requires a Network
Effective risk management requires a shift in focus: a move from automating the enterprise to building
and managing a value network. This is a very different approach than most companies are adopting.
When we review clients’ supply chain strategies, nine out of ten are focused on only automating the
enterprise. While the strategy states “end-to-end,” the focus is from the order to procurement in most
companies. The focus is so intense within the four walls of the company that they are not network
focused. Today, there are three issues. The first is demand. Companies focus risk management on
“supply-side issues” not on “demand/channel sensing and translation.”

13. Page 13
Figure 7. Current Risk Management Focus
The second is active management of the extended supplier network. In the case of a natural disaster,
as shown in Figure 8, only 37% of companies have visibility of their second tier of suppliers or
beyond. Companies do not know the location of headquarters, much less manufacturing and
distribution centers. In our work with clients, we see that this is worse when companies have
outsourced procurement.
Figure 8. Supplier Visibility

14. Page 14
The third requirement is active monitoring of financial health and improving the design of the value
network to improve supplier viability. For most companies this is a gap.
Figure 9. Monitoring of Supplier Health
Technologists Versus Business Leaders:
Gaps and Realities
Technologists and consultants hawk wares for supply chain visibility, but their solutions are not
aligned with business users’ needs. While technology vendors are more likely to see supply chain
visibility as a major risk driver, business leaders are more likely to cite regulatory compliance and
product quality. This gap is one of the major reasons why supply chain risk management solutions
have not gained more market traction. This gap is shown in Figure 10.

15. Page 15
Figure 10. Vendor and Business User Perspectives of Importance

16. Page 16
Recommendations
Risk management requires holistic thinking. The focus is top-down and horizontal—working across
functional silos—and led by a business leader.
In building and rethinking risk management programs, keep these five elements in mind:
• Leadership Matters. Programmatic risk management is needed to drive holistic thinking. This is
not a program that can be effectively managed bottom-up. It also tends to get lost when managed
as part of other programs. Proactivity is key. Business continuity programs should not be an
afterthought.
• Build Agility in Operations. Actively define and proactively implement agility programs. Design,
implement, and reward agility improvements. Educate financial teams on the differences between
efficiency (lowest cost per unit) and agility (the ability to have the same cost, quality and customer
service level given a level of demand and supply variation).
• Implement Supplier Sensing and Supplier Visibility Programs. Visibility of suppliers—locations
of facilities and their suppliers—is the first step. The second is supplier financial sensing.
Companies with advanced risk management programs redesign the role of procurement to build,
not just audit, value chain relationships.
• Avoid Shiny Objects. While technology vendors espouse risk management as a technology, it is
much more than the deployment of a technology. While visibility technologies are an important part
of the solution, they are not the answer.
• Things Happen. Not All Risks Can Be Prevented. Be Prepared. Demand and supply risks are
increasing. Agility and sensing are key. Events cannot be totally prevented, but they can be
mitigated. The design of inventory buffers and supplier visibility programs are critical; but, it is also
important to have well-defined practices and drills to help the organization to mobilize quickly in the
face of a disaster. It is not a time for indecision. When a disruption happens, there needs to be a
clear definition of protocols and responsibilities. Many advanced companies implement drills and
practice deployment to ensure readiness.

17. Page 17
Conclusion
Risk management requires a focus on supply chain process basics designed to drive business
continuity. It is not sexy. While many companies believe that risk management initiatives center on
the purchase of a shiny new tool, this is far from the truth.
So, the next time you see a presentation on delivering an integrated end-to-end supply chain, ask,
"How are you managing the risk?" The sad reality is that in the majority of integrated supply chain
strategies we see, risk management is missing. Few teams understand the basics of demand
management, the reduction of complexity, the design of inventory buffers, robust supplier
development programs, or the inclusion of "what-if" analysis. To drive opportunity, you must manage
risk through a focus on fundamentals and business continuity.

18. Page 18
Appendix
In this section we share the demographic information of survey respondents, as well as additional
charts referenced in the report, to substantiate the findings.
Business users in this survey averaged $4.2 billion in annual revenue with 11,000 employees. Over
half of the respondents were physically located in the US or Canada. The participants in this research
answered the surveys of their own free will. There was no exchange of currency to drive an improved
response rate. The primary incentive made to stimulate the response was an offer to share and
discuss the survey results in the form of Open Content research at the end of the study.
The names, both of individual respondents and companies participating, are held in confidence. The
demographics are shared to help the readers of this report gain a better perspective on the results.
The demographics and additional charts are found in Figures A–G.
Figure A. Study Overview

19. Page 19
Figure B. Overview of Companies in the Research by Work Type
Figure C. Characteristics of Respondents (Business Users) by Industry

20. Page 20
Figure D. Characteristics of Respondents by Revenue
Figure E. Respondent Familiarity with Risk Management

21. Page 21
Figure F. Respondents by Geography
Figure G. Reporting Structures for Risk management

22. Page 22
Other Reports in This Series
Readers may gain added value by accessing additional complimentary reports on risk management
on the Supply Chain Insights website:
Research in Review, January 2016
Global Supply Chains Ups the Ante for Risk Management, August 2015
Can You Afford the Risk?, April 2014

23. Page 23
About Supply Chain Insights LLC
Founded in February 2012 by Lora Cecere, Supply Chain Insights LLC is in its sixth year of operation.
The Company’s mission is to deliver independent, actionable, and objective advice for supply
chain leaders. If you need to know which practices and technologies make the biggest difference to
corporate performance, we want you to turn to us. We are a company dedicated to this research. Our
goal is to help leaders understand supply chain trends, evolving technologies and which metrics
matter.
About Lora Cecere
Lora Cecere (twitter ID @lcecere) is the Founder of Supply Chain Insights LLC and
the author of popular enterprise software blog Supply Chain Shaman currently read
by 15,000 supply chain professionals. She also writes as a Linkedin Influencer and
is a a contributor for Forbes. She has written six books. The first book, Bricks
Matter, (co-authored with Charlie Chase) published in 2012. The second book, The
Shaman’s Journal 2014, published in September 2014; the third book, Supply
Chain Metrics That Matter, published in December 2014; the fourth book, The
Shaman’s Journal 2015, published in August 2015, the fifth book, The Shaman’s Journal 2016,
published in June 2016 and the sixth book, The Shaman’s Journal 2017, published in July 2017.
With over 14 years as a research analyst with AMR Research, Altimeter Group, and Gartner
Group and now as the Founder of Supply Chain Insights, Lora understands supply chain. She has
worked with over 600 companies on their supply chain strategy and is a frequent speaker on the
evolution of supply chain processes and technologies. Her research is designed for the early adopter
seeking first mover advantage.