To those that follow my LinkedIn Profile, you may recognize this article, however I have decided that it requires a little updating as things have changed significantly since 2016. Now that we have that out of the way, lets dive into Supply Chain resilience.
Supply Chain Resilience is an integral part of the overall Business Continuity Management (BCM) process, especially within an organization that is highly reliant on suppliers in order to manufacture their goods. In the case of a retail outlet, ensuring that products are on hand in order to continue trading is an extremely important aspect of business continuity for these entities.
So, what is Supply Chain Resilience?
Most businesses rely on a supply chain in order to do business, therefore the supply chain could be the single most important part of an organization's ability to continue day to day business operations.
Supply Chain Resilience refers to the ability of an organization to identify areas within its supply chain that could impact the business directly and indirectly, and to implement appropriate mitigation strategies — ensuring the risks identified are appropriately qualified and catered for, so that the business is able to respond to both direct and indirect disruptions to its supply chain.
Why should you worry about Supply Chain Resilience?
When the supply chain is critical to an organization, the entities that provide services and/or products are critical to the organization's continued existence. From a business continuity perspective, it is essential to understand how important these suppliers are, based on what service or product is provided. This should be explored through the Business Impact Analysis (BIA) process when understanding critical third parties.
The trouble is that most BIAs are still done once a year, sit in a document, and go stale the moment a supplier changes a subcontractor or a shipping route changes. A supplier that looked low-risk in January can quietly become your single point of failure by June, and nobody revisits the BIA to notice. That gap - between when a dependency changes and when the business realizes it's changed - is where most supply chain surprises actually come from.
Though an organization may not have direct input into how a supplier runs its business and continuity processes, it is important to cater for eventualities that may affect your business - especially if your business is highly reliant on that supplier. For instance, if your business (an automobile manufacturer) is reliant on a supplier that sells an engine component in order to manufacture vehicles, it would be a good idea to ensure that if anything were to happen to the supplier - an act of God or any other disruption - this would not impact your manufacturing process in any way.
A recent example of this comes to mind: the earthquake and subsequent tsunami in Japan. Imagine for a moment that your company is extremely reliant on a business that has experienced such a disruption, and they are no longer able to fulfill your order requirements. This could effectively stop your business, or at the very least cost a significant amount of money as well as damage to the reputation of the organization, as you "rush around" trying to find a new supplier in order to continue business as usual processes.
This is also why single-supplier dependencies are so dangerous, and often invisible until it's too late. A single component from a single supplier can sit three tiers deep in a bill of materials, feeding half a dozen product lines you'd never think to connect it to. Mapping those dependencies - not just "who do we buy from" but "what actually breaks if this one link goes down" - is what turns a vague sense of exposure into a prioritized list of what to fix first.
What should the Strategy be for your Supply Chain?
During the BIA process, it should be discussed which suppliers are critical and what services or products they provide. Additionally, these suppliers should then be qualified in terms of how long the business can go without having these suppliers available, and what impact it would have on the business in terms of financial constraints, impact to reputation, and possible regulatory effects, if these suppliers were no longer able to fulfill their commitments to the business.
Once that information is identified, discussions around the business strategy to cater for such eventualities can take place, which may include options such as:
- Do nothing.
- Identify alternate suppliers for the same product or service.
- Keep additional stock on hand.
- Request that the supplier store additional stock in alternative premises.
Though it is rare that an organization would do nothing if a critical supplier were to experience a prolonged disruption, this often still happens. This usually leads to the business impacted by the supply chain disruption to reconsider their strategy around suppliers and how to deal with such scenarios in future.
It's worth adding a fifth option to that list, one that's only become practical recently: watch for the disruption before it reaches your suppliers at all. Geopolitical instability, port congestion, regulatory changes, extreme weather - the early signals of most of these show up in open-source and news intelligence well before they show up as a late shipment. Businesses that are building this in aren't necessarily hiring analysts to watch the news; they're layering automated trend and threat monitoring on top of their existing supplier register, so a flare-up in a supplier's region surfaces as a flag against that specific dependency, rather than as a headline someone happens to read three weeks later.
Supply chain resilience reviews?
Though it's difficult to enforce something on a supplier, more and more companies are requesting that their suppliers have their own business continuity plans in place. This helps to improve confidence in the supplier, as it shows they take the day-to-day running of their business seriously, and also shows that the supplier values the business of their clients.
Having said that, requests for BCM reviews being done on an organization's critical suppliers would typically form part of a service level agreement (SLA) which is put in place with the respective supplier before business is conducted. This ensures that the organization has an additional level of comfort that the supply chain is being considered, especially when it involves critical suppliers of either products or services.
When performing BCM testing or simulations, incorporating scenarios that simulate the loss of key suppliers is essential. This allows specific strategies to be work-shopped during BCM testing, and also prepares the organization's personnel to deal with such an eventuality, should it materialize.
The organizations getting the most value out of this today tend to treat supplier resilience as a living register rather than an annual exercise — one place where the BIA findings, the SLA commitments, the dependency mapping, and the early-warning signals all sit together and stay current, instead of living across five different spreadsheets that only get reconciled once a year.
Platforms like ResilienceHub are built around exactly that idea: keeping supplier dependencies, risk signals, and continuity plans connected and current, so the next disruption is something you saw coming, not something you're reacting to.