HLSS603Wk4

out1.pdf

W I N T E R 2 0 1 5

Joseph Fiksel Mikaella Polyviou

Keely L. Croxton Timothy J. Pettit

From Risk to Resilience: Learning to Deal With Disruption To prosper in the face of turbulent change, organizations need to improve how they deal with unexpected disruptions to complex supply chains. Companies can cultivate such resilience by understanding their vulnerabilities — and developing specific capabilities to compensate for those vulnerabilities.

Vol. 56, No. 2 Reprint #56223 http://mitsmr.com/1uOW55d

http://mitsmr.com/1uOW55d

PLEASE NOTE THAT GRAY AREAS REFLECT ARTWORK THAT HAS BEEN INTENTIONALLY REMOVED. THE SUBSTANTIVE CONTENT OF THE ARTICLE APPEARS AS ORIGINALLY PUBLISHED.

WINTER 2015 MIT SLOAN MANAGEMENT REVIEW 79

IN AN INTERCONNECTED, volatile, global economy, supply chains have become increas-

ingly vulnerable. Disruptions — even minor shipment delays — can cause significant financial

losses for companies and substantially impact shareholder value. Globalization has made anticipat-

ing disruptions and managing them when they do occur more challenging. The potential risks of

disruptions are often hidden, and the potential impacts may not be understood. This often results in

“black swan” events that can be understood only after the fact. As author Nassim N. Taleb has

warned, “Our world is dominated by the extreme, the unknown, and the very improbable ... while

we spend our time engaged in small talk, focusing on the known and the repeated.”1

THE LEADING QUESTION How can companies learn to be- come more resilient?

FINDINGS �Processes such as enterprise risk management and business continuity management, while useful, have limitations.

�Every disruption represents a learn- ing opportunity that may suggest shift- ing to a different state of operations.

�Companies need to identify their supply chain vulnerabilities and target the capa- bilities that need to be strengthened.

R I S K M A N A G E M E N T

80 MIT SLOAN MANAGEMENT REVIEW WINTER 2015 SLOANREVIEW.MIT.EDU

R I S K M A N A G E M E N T

Although companies originally moved produc-

tion offshore to countries such as India and China to

take advantage of lower labor costs, events like Ice-

land’s 2010 volcanic eruption and the Japanese

tsunami in 2011 have shown that the vulnerabilities

of extended supply chains are real and serious. For

example, according to the U.S. Federal Reserve, 41%

of Minnesota manufacturers said that Japan’s tsu-

nami had affected them negatively.2 As a result, many

manufacturers have reevaluated their sourcing op-

tions, and some are shifting operations back to their

home markets. While these companies perceive

other advantages to reshoring, including improved

responsiveness and domestic job creation, reducing

their exposure to risk has been an important driver.

The reality is that supply chain practices de-

signed to keep costs low in a stable business

environment can increase risk levels during disrup-

tions. Just-in-time and lean production methods,

whereby managers work closely with a small num-

ber of suppliers to keep inventories low, can make

companies more vulnerable due to the lack of buf-

fer capacity. For example, many companies that

followed the lean inventory model were severely

impacted by Japan’s tsunami: Within a week, Gen-

eral Motors Corp. temporarily shut down its

Chevrolet Colorado and GMC Canyon plant in

Shreveport, Louisiana, because it lacked compo-

nents supplied from Japan.3

While companies tend to focus on the supply side

of their operations when scanning for potential risk

factors, they also need to pay attention to the cus-

tomer side. Increasing demand volatility is an

important factor that can affect a company’s opera-

tions and ultimately its revenue. For example, in

March 2013 Cardinal Health Inc., a distributor of

pharmaceuticals and medical products based in

Dublin, Ohio, announced that its contract with the

drugstore chain Walgreens would not be renewed.

Walgreen Co., based in Deerfield, Illinois, had been

one of Cardinal Health’s largest customers, account-

ing for more than 20% of revenue for 2012. The news

caused Cardinal Health’s share price to plummet by

8.2%.4 However, the company was able to recover

quickly and continue its growth thanks to deliberate

efforts to expand and diversify its customer base.

Coping With Supply Chain Risks Traditional methods for coping with supply chain

risks are based on the notion of stability as the “nor-

mal” state of affairs: Events such as explosions or

floods are seen as unwanted deviations from the

norm. In recent decades, most large private enter-

prises adopted systematic approaches to managing

their risks, notably through insurance and active mit-

igation of supply chain risks. The importance of risk

management was elevated by a number of high-

profile disasters, including the deadly release of poi-

sonous gas from a Union Carbide plant in Bhopal,

India, in 1984, which resulted in thousands of deaths.

Further motivation came from standards set by non-

governmental organizations such as the International

Organization for Standardization and from govern-

ment legislation, including the U.S. Securities and

Exchange Commission’s requirements for disclosure

of “material” business risks and the German “Law for

Control and Transparency in Business Entities.”5

A more integrated approach to risk management,

called “enterprise risk management (ERM),” became

popular in the mid-1990s and has been widely ad-

opted by large corporations.6 It gives company

executives a detailed and comprehensive view of the

risks associated with different business activities,

enabling managers to make more informed deci-

sions about how to manage risk portfolios. Another

risk management process, known as business conti-

nuity management (BCM), incorporates elements

from disaster recovery planning and crisis manage-

ment, including how to respond to disruptions and

maintain backup capacity for operational systems.7

Supply chain practices designed to keep costs low in a stable business environment can increase risk levels during disrup- tions. Just-in-time and lean production methods, whereby managers work closely with a small number of suppliers to keep inventories low, can make companies more vulnerable.

SLOANREVIEW.MIT.EDU WINTER 2015 MIT SLOAN MANAGEMENT REVIEW 81

While processes such as ERM and BCM can help

companies avoid supply chain disruptions and re-

cover normal operations quickly, they also have

serious limitations. To begin with, they rely too

heavily on risk identification. In a complex and tur-

bulent global supply network, many of the risks

that a company faces are unpredictable or unknow-

able before the fact. These “emergent” risks are

often triggered by improbable events whose causes

are not understood, and their potential cascading

effects are difficult to understand a priori. Clearly, it

would be impractical for companies to identify and

investigate all the potential risks that may be hid-

den in their global supply chains.

Second, ERM and BCM depend on statistical

information that may not exist. Risk assessments

are limited by the quality and credibility of the

assumptions upon which they are based, and faulty

assumptions or data can lead to misallocation of

resources. Of particular challenge are low-proba-

bility, high-consequence events for which there is

little empirical knowledge; managers may underes-

timate the probabilities of these events or the

magnitudes of their consequences because they

have never experienced them.8

Third, the traditional ERM process of risk iden-

tification, assessment, mitigation and monitoring

is based on a simplified, “reductionist” view of the

world. Each risk is identified and addressed inde-

pendently, and hidden interactions are seldom

recognized. This procedural approach can lull

organizations into a false sense of complacency that

could be shattered by an unexpected event (for

instance, an oil spill in the Gulf of Mexico). The

complex, dynamic nature of global supply chains

requires constant vigilance to discern systemic vul-

nerabilities, as well as exceptional agility and

flexibility when disruptions occur.

Finally, traditional risk management is predi-

cated on the goal of returning to a stable operating

condition; risks represent potential deviations

from this “normal” state. However, a more realistic

view is to recognize that every disruption repre-

sents a learning opportunity that may suggest

shifting to a different state of operations. For ex-

ample, a company that anticipates increased

flooding in Southeast Asia might migrate its supply

base elsewhere. Identifying latent opportunities in

the risk landscape will enable a company to exploit

those opportunities faster than its competitors.

The Need to Cultivate Resilience We believe that organizations need to improve how

they deal with supply chain complexity and unex-

pected disruptions so that they can prosper in the

face of turbulent change. Organizations tend to be-

come less resilient as they grow more complex.

However, they can cultivate resilience by under-

standing their supply chain vulnerabilities and

developing specific capabilities to cope with dis-

ruptions. They can try to emulate some of the

behaviors seen in natural systems — tolerance for

variability, continuous adaptation and exploitation

of opportunities created by disruptive forces. Resil-

ient systems don’t fail in the face of disturbances;

rather, they adapt. Depending on the type of dis-

turbance, the adaptation can be rapid or gradual.

SUPPLY CHAIN VULNERABILITIES AND CAPABILITIES Our SCRAM (supply chain resilience assessment and management) framework enables a business to identify and prioritize the supply chain vulnerabilities it faces as well as the capabilities it should strengthen to offset those vulnerabilities.

DEFINITION PRINCIPAL FACTORS IN SCRAM FRAMEWORK

Supply chain vulnerabilities

Factors that make an enter- prise susceptible to disruptions

•Turbulence

•Deliberate threats

•External pressures

•Resource limits

•Sensitivity

•Connectivity

Supply chain capabilities

Attributes that enable an enterprise to anticipate and overcome disruptions

•Flexibility in sourcing

•Flexibility in manufacturing

•Flexibility in order fulfillment

•Capacity

•Efficiency

•Visibility

•Adaptability

•Anticipation

•Recovery

•Dispersion

•Collaboration

•Organization

•Market position

•Security

•Financial strength

•Product stewardship

82 MIT SLOAN MANAGEMENT REVIEW WINTER 2015 SLOANREVIEW.MIT.EDU

R I S K M A N A G E M E N T

A decade ago, authors Gary Hamel and Liisa

Välikangas described the quest for resilience as

seeking “zero trauma.”9 Few corporate managers

believe that zero trauma is a realistic goal today, but

some now recognize that resilience can be an im-

portant success factor that complements their

traditional risk management processes. We define

resilience as “the capacity of an enterprise to sur-

vive, adapt and grow in the face of turbulent

change.”10 In practical terms, resilience means im-

proving the adaptability of global supply chains,

collaborating with stakeholders and leveraging in-

formation technology to assure continuity, even in

the face of catastrophic disruptions. Resilience goes

beyond mitigating risk; it enables a business to gain

competitive advantage by learning how to deal with

disruptions more effectively than its competitors11

and possibly shifting to a new equilibrium.

A classic example of supply chain resilience oc-

curred in 2000 when one of Finland-based Nokia’s

key cellphone part suppliers suffered a major fire. By

identifying the crisis quickly, Nokia was able to

secure alternative supplies and modify the product

design to broaden its sourcing options. By contrast,

Swedish multinational Ericsson, which was reliant

on the same supplier, lost about $400 million in sales

due to its slowness in crisis response and eventually

exited the cellphone business.12 (However, Nokia

subsequently made serious missteps in its efforts to

compete in the smartphone market and ultimately

sold its devices business to Microsoft Corp.)

Over the past seven years, we have worked with a

number of companies, including fashion retailer L

Brands Inc. (formerly known as Limited Brands),

Dow Chemical, Johnson & Johnson and Unilever to

develop a comprehensive framework for assessing

supply chain vulnerabilities and addressing them

through enhanced resilience capabilities. (See “Supply

Chain Vulnerabilities and Capabilities,” p. 81.) To

develop our taxonomies of vulnerabilities and capa-

bilities, we studied existing literature and also

conducted interviews and focus groups with manag-

ers and employees at Limited Brands and other

companies that had experienced supply chain disrup-

tions.13 Subsequently, we identified linkages between

specific vulnerabilities and capabilities, enabling us to

suggest proactive strategies for improvement, and we

developed an assessment tool for business use.14 The

resulting framework, which we call supply chain resil-

ience assessment and management (SCRAM), is

based on an explicit characterization and prioritiza-

tion of an organization’s vulnerabilities and

capabilities. (See “About the Research.”)

Identifying Resilience Factors and Linkages Based on our research, we identified six major types of

supply chain vulnerabilities, which we define as “fun-

damental factors that make an enterprise susceptible

to disruptions.” A frequently cited factor was turbu-

lence. In the context of our framework, turbulence is

defined as changes in the business environment that

are beyond a company’s control, including shifts in

customer demand, geopolitical disruptions, natural

disasters and pandemics. Another category of vulner-

ability is deliberate threats, such as theft, sabotage,

terrorism and disputes with labor or other groups.

Additional vulnerabilities came from external pres-

sures that create constraints or barriers (such as

innovations, regulatory shifts and shifts in cultural

attitudes); resource limits that have the potential to

constrain a company’s capacity (such as availability of

raw materials or skilled workers); the sensitivity and

complexity of the production process; and the degree

of connectivity in the company’s supply chain, which

implies a need for coordination with outside partners.

Finally, supply chains are vulnerable to disruptions

that could affect their multiple tiers of customers and

suppliers. (See “Supply Chain Vulnerability Factors.”)

In addition to helping us formulate the list of

vulnerabilities, focus groups also helped us define a

list of capabilities that companies can call upon to

ABOUT THE RESEARCH We have been researching the concept of enterprise resilience for more than seven years. This article synthesizes the managerial implications of that research and describes how the practice of enterprise resilience can help companies to manage their global supply chains in an increasingly turbulent business environment. Our initial research led to the development of the SCRAM tool for supply chain resilience assessment and management, which we validated with data from seven global manufacturing and service organizations. Mixed-method triangulation was used to identify specific linkages between the inherent vulnerability factors and controllable capability factors, enabling the tool to produce recommendations for capability improvement to overcome high-priority vulnerabilities. After the initial research phase, we worked extensively with Dow Chemical to establish a process for imple- menting the tool, which has been applied in more than 20 of its business units. We gained additional insights through interviews and interactions with other organizations, including Zurich Financial, Johnson & Johnson, Owens Corning, Shell Oil and Unilever.

SLOANREVIEW.MIT.EDU WINTER 2015 MIT SLOAN MANAGEMENT REVIEW 83

respond to their particular vulnerability patterns. In

all, we identified 16 relevant capabilities, which we

define as “factors that enable an enterprise to antici-

pate and overcome disruptions.” These are:

(1) flexibility in sourcing, (2) flexibility in manufac-

turing, (3) flexibility in order fulfillment,

(4) production capacity, (5) efficiency, (6) visibility,

(7) adaptability, (8) anticipation, (9) recovery,

(10) dispersion, (11) collaboration, (12) organization,

(13) market position, (14) security, (15) financial

strength and (16) product stewardship. (See “Supply

Chain Capability Factors,” p. 84, for explanations of

these 16 capabilities.) Using the lists of vulnerabili-

ties and capabilities as a template, we tested them at

eight companies to understand their interrelation-

ships, with the goal of creating a managerial tool

for improving performance. We identified 311 sep-

arate “linkages” whereby specific capabilities can

counteract specific vulnerabilities.

Our resulting SCRAM framework provides a

general methodology for companies to identify

their most important supply chain vulnerabilities

and to set priorities for capabilities that need to be

strengthened. For example, a company that faces

unpredictable market demand could strengthen

a number of capabilities: flexibility in manufac-

turing to satisfy surges in demand; accurate,

up-to-date visibility of demand status to support

timely decision making; early anticipation and rec-

ognition of market changes to enable strategic

responses; and close collaboration with customers

and suppliers to ensure coordinated action. Simi-

larly, a company concerned with dependence on a

complex supply network could work on flexibility

in sourcing by identifying alternative sources,

flexibility in manufacturing by reducing lead times,

and anticipation by recognizing early warning

signals of possible disruptions. Based on the re-

sults of their SCRAM analysis, managers can

develop a portfolio of capabilities to address im-

portant resilience gaps and strengthen overall

competitiveness.15

SUPPLY CHAIN VULNERABILITY FACTORS Our framework includes six major vulnerability factors, each broken into subfactors. Vulnerabilities are typically inherent to the business and difficult to avoid.

VULNERABILITY FACTOR DEFINITION SUBFACTORS

Turbulence Environment characterized by frequent changes in external factors beyond the company’s control

Unpredictability in demand, fluctuations in currencies and prices, geopolitical disruptions, natural disasters, technology failures, pandemics

Deliberate threats Intentional attacks aimed at disrupting operations or causing human or financial harm

Terrorism and sabotage, piracy and theft, labor disputes, special interest groups, industrial espionage, product liability

External pressures Influences, not specifically targeting the company, that create business constraints or barriers

Competitive innovation, government regulations, price pressures, corporate responsibility, social/ cultural issues, environmental, health and safety concerns

Resource limits Constraints on output based upon availability of the factors of production

Raw material availability, utilities availability, human resources, natural resources

Sensitivity Importance of carefully controlled conditions for product and process integrity

Restricted materials, supply purity, stringency of manufacturing, fragility of handling, complexity of operations, reliability of equipment, safety hazards, visibility of disruption to stakeholders, symbolic pro- file of brand, customer requirements for quality

Connectivity Degree of interdependence and reliance on outside entities

Scale and extent of supply network, import/export channels, reliance on specialty sources, reliance on information flow, degree of outsourcing

NOTE: A company is indirectly vulnerable to disruptions that affect its multiple tiers of customers and suppliers. The framework can also be used to assess the resilience of selected external organizations.

84 MIT SLOAN MANAGEMENT REVIEW WINTER 2015 SLOANREVIEW.MIT.EDU

R I S K M A N A G E M E N T

CAPABILITY FACTOR DEFINITION SUBFACTORS

Flexibility in sourcing Ability to quickly change inputs or the mode of receiving inputs

Common product platforms, supply contract flexibility, supplier capacity, supplier expediting, alternate suppliers

Flexibility in manufacturing

Ability to quickly and efficiently change the quantity and type of outputs

Product/service modularity, multiple pathways and skills, manufacturing postponement, changeover speed, batch size, manufacturing expediting, reconfigurability, scalability, rerouting of requirements

Flexibility in order fulfillment

Ability to quickly change the method of delivering outputs

Multisourcing, demand pooling, inventory management, alternate distribution modes, multiple service centers, transportation capacity, transportation expediting

Capacity Availability of assets to enable sustained production levels

Backup utilities, raw materials, reserve capacity, labor capacity, ecological capacity

Efficiency Capability to produce outputs with minimum resource requirements

Labor productivity, asset utilization, quality management, preventive maintenance, process standardization, resource productivity

Visibility Knowledge of the status of operating assets and the environment

Information technology, status of inventory/equipment/personnel, information exchange with supplies/customers/carriers, market visibility, external monitoring

Adaptability Ability to modify operations in response to challenges or opportunities

Seizing advantage from disruptions, alternative technology development, learning from experience, strategic gaming and simulation, environmental sustainability

Anticipation Ability to discern potential future events or situations

Demand forecasting methods, risk identification and prioritization, monitoring/communicating deviations and “near misses,” recognition of early warning signals, business continuity planning, emergency preparedness, recognition of opportunities, business intelligence gathering, government lobbying, awareness of global change

Recovery Ability to return to normal operational state rapidly

Equipment repairability, resource mobilization, communications strategy, crisis management, consequence mitigation

Dispersion Broad distribution or decentralization of assets

Distributed suppliers/production/distribution, distributed decision making, location-specific empowerment, dispersion of markets

Collaboration Ability to work effectively with other entities for mutual benefit

Collaborative forecasting, supply chain communication, collaborative decision making, supplier/customer involvement in innovation, postpone- ment of orders, product life cycle management, supplier/customer collaboration, risk/reward sharing with partners

Organization Human resource structures, policies, skills and culture

Creative problem-solving culture, accountability, diversity of skills and experience, substitute leadership capacity, benchmarking/feedback, culture of caring for employees, workforce flexibility

Market position Status of a company or its products in specific markets

Brand equity, customer loyalty/retention, market share, product differentia- tion, sustainability position

Security Defense against deliberate intrusion or attack

Layered defenses, access restriction, employee involvement in security, collaboration with governments, cybersecurity, personnel security

Financial strength Capacity to absorb fluctuations in cash flow

Financial reserves and liquidity, portfolio diversification, insurance coverage, price margin

Product stewardship Sustainable business practices throughout the product life cycle

Proactive product design, resource conservation, auditing and monitoring, supplier management, customer support

SUPPLY CHAIN CAPABILITY FACTORS The framework includes 16 capability factors, each of which is broken into subfactors. Companies can strengthen appropriate supply chain capabilities to offset the vulnerabilities they have.

SLOANREVIEW.MIT.EDU WINTER 2015 MIT SLOAN MANAGEMENT REVIEW 85

Putting the SCRAM Framework to Work Although similar organizations are likely to share

some similar features, different companies — and

even business units within companies — will have

their own distinct profile of vulnerabilities and ca-

pabilities. An organization with high vulnerabilities

that does not have adequate capabilities will be

overexposed to risks; in response, it should invest

resources in improving the particular capabilities

in question. Conversely, an organization that faces

low vulnerabilities but invests heavily in capabili-

ties may be eroding its profits unnecessarily. (See

“Finding the Zone of Balanced Resilience.”) Clearly,

there is no “one-size-fits-all” approach. Organiza-

tions need to pursue a balanced resilience strategy

by developing the right portfolio of capabilities to

fit the pattern of vulnerabilities that they face.

One company that has incorporated the

SCRAM framework into its way of doing business

is the Dow Chemical Co. Since 2010, Dow has im-

plemented this framework at more than 20 of its

global business units, achieving significant busi-

ness benefits. For example, after applying the

SCRAM process to its P-Series family of glycol

ether products, Dow identified several disruption

scenarios, including a production site shutdown, a

raw material supply outage and an internal raw ma-

terial allocation shortage. The company developed

a simulation model to test the consequences of

these scenarios and was able to confirm a 95% ser-

vice level with its existing capabilities. Moreover,

the analysis revealed opportunities for reduction

of fixed assets and working capital, resulting in

$1.1 million in annual savings.16 Another Dow

business used SCRAM to improve its resilience to

raw material supply shortages and identified more

than $1.5 million in preventable losses.

The SCRAM approach represents a systems

view of supply chain dynamics, helping companies

to understand the inherent vulnerabilities that

could lead to disruptions and the capabilities that

are within their control. By learning from experi-

ence and developing a better understanding of

their vulnerabilities and capabilities, companies

can reduce the frequency of disruptions and the

severity of their impacts, resulting in increased cus-

tomer satisfaction and reduced supply chain

operating costs. While reducing inherent vulnera-

bilities may be difficult, there are many options for

improving capabilities. The cost of the improve-

ments must be balanced against the expected

supply chain performance benefits.

Early adopters of resilience thinking have

already demonstrated how they can augment tra-

ditional risk management practices with new

capabilities that help them to anticipate, prepare for,

adapt to and recover from disruptions. In some

cases, they are able to treat disasters as opportunities

for gaining competitive advantage. For example,

before the 2010 eruption of the Eyjafjallajökull

volcano in Iceland grounded millions of air cargo

shipments, DHL, the international shipping com-

pany, had an emergency plan in place. It was thus

able to rapidly redirect 100 flights from its hub in

Leipzig, Germany, to destinations in southern

Europe that were less affected, and also to shift

many deliveries to ground vehicles. Ultimately,

DHL was able to avoid significant financial impact

while strengthening customer loyalty.17

Building resilience is not a substitute for other

methods of ERM. Rather, it is an ongoing process

that enables companies to embrace change in a

turbulent and complex business environment by

expanding their portfolio of capabilities. The field

of supply chain resilience is still young, and there

is a great need for additional research, both to