traditional hazard risks

Supply_Chain_Risk_Management_An_Emerging_Disciplin..._----_7._Operational_Risk.pdf

Home >Business & Finance homework help >traditional hazard risks

127

7 Operational Risk

Imagine.a.company.that.sells.some.of.the.hottest.products.on.the.planet. with.just.a.few.products.representing.a.disproportionate.share.of.revenues.. Imagine. further. that. this. company. has. relied. on. a. single. Chinese. sup- plier.and.location.to.build.these.products..And.imagine.even.further.that. this.Chinese.supplier.is.secretive,.often.showing.an.unwillingness.to.share. information. publicly,. particularly. about. labor. problems.. If. this. scenario. sounds. operationally. risky. (and. strategically. risky. as. well),. you. just. fig- ured.out.why.Apple.has.made.a.decision.to.diversify.its.supplier.base.by. expanding.its.outsourcing.to.a.second.supplier.located.in.Taiwan.

This.chapter.will.discuss.the.many.potential.operational.failures.through. the.prism.of.the.four.pillars.of.supply.chain.risk—supply.risk,.demand.risk,. process.risk,.and.environmental.risk..We.will.profile.operational.risks.that. happen.every.day.in.these.four.areas..We’ll.also.discuss.these.risks.in.the. context.of.two.basic.operation.horizons.and.present.a.program.that.tradi- tionally.has.been.utilized.to.mitigate.and.manage.operational.risks.

OpeRatiOnal RiSkS

By. far,. a. disproportionate. set. of. supply. chain. risks. will. be. categorized. as. operational. since. this. category. includes. internal. and. external. quality. problems,.late.deliveries.anywhere.in.the.supply.chain,.service.failures.due. to.poorly.managed.inventory,.problems.related.to.poor.forecasting,.and.a. thousand. other. events. related. to. operational. performance. failures.. This. section.discusses.the.operational.risks.that.are.part.of.supply.risk,.demand. risk,. process. risk,. and. environmental. risk.. The. two. prevalent. horizons. affecting. supply. chain. risk. management. are. the. operational. horizon,.

Schlegel, Gregory L., and Robert J. Trent. Supply Chain Risk Management : An Emerging Discipline, Taylor & Francis Group, 2014. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/apus/detail.action?docID=1680353. Created from apus on 2021-06-09 03:57:47.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

128 • Supply Chain Risk Management: An Emerging Discipline

covering.0–45 days.into.the.future,.and.the.tactical.horizon,.which.nor- mally.covers.1–18 months.into.the.future.

Supply Risk

Referring. back. to. the. discussion. in. Chapter 2. regarding. the. four. pillars. of.supply.chain.risk,.the.supply.management.profession.is.by.far.the.most. mature. discipline. within. the. supply. chain. arena. when. it. comes. to. iden- tifying,. assessing,. mitigating,. and. managing. risk.. Procurement. profes- sionals. have. been. leveraging. techniques. to. mitigate. and. manage. risk. for. more.than.50 years..Let’s.briefly.identify.operational.and.tactical.risks.that. reside.within.this.risk.pillar.every.day..In.no.particular.order,.we.have.sup- plier.lead.times,.supplier.quality,.supplier.prices,.supplier.insolvency.and. bankruptcy,. supplier. delivery. issues,. fraud,. corruption,. counterfeit. parts. and.components.with.subtier.suppliers,.and.inbound.logistics..To.further. focus.our.discussion,.we’ll.classify.these.risks.into.supplier,.logistics,.and. fraud,.corruption,.and.counterfeiting..Table 7.1.can.be.used.as.a.reference. throughout.the.supply.risk.discussion.

Supplier Risks. As. mentioned,. procurement. professionals. have. been. trained. for. many. years. to. think. about. risk. and. contingencies,. probably. much.more.so.than.any.other.discipline.within.the.supply.chain.commu- nity..One.of.the.main.reasons.is.most.manufacturers’.cost.of.raw.material. represents.approximately.50%–70%.of.their.total.cost.of.goods.sold..That’s. a. huge. portion. of. the. total. cost. of. finished. products. and. an. abnormally. large.risk.element.to.the.organization.

As. shown. in. Table 7.1,. the. traditional. approach. to. handling. sup- plier. risk. has. been. to. use. buffer. inventory. or. statistically. derived. safety. stock.to.absorb.volume.shocks.or.delays.or.supplier.delivery.and.quality. issues..One.of.the.traditional.techniques.many.procurement.professionals. have.been.trained.to.execute.to.ensure.better.pricing.and.better.delivery. has.been.placing.more.and.more.of.their.raw.material.requirements.with. one. supplier.. This. traditional. thinking. and. training. was. driven. by. the. premise. that. when. a. company’s. purchase. requirements. become. a. larger. portion. of. a. supplier’s. order. board,. that. supplier. will. bend. in. terms. of. price. and. do. its. best. to. demonstrate. solid. delivery. performance. because. of.the.risk.of.losing.those.orders.and.volume.

This.procurement.strategy.worked.well.in.a.stable.environment.before. globalization. and. supply. market. volatility.. What. actually. took. place. is. many. companies. got. a. bit. complacent. performing. their. due. diligence..

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 129

Buyers. assumed. a. bit. too. much. in. terms. of. continued. performance. and. found.out.through.disruptions,.supplier.insolvency,.supplier.quality.issues. and.much.more,.that.relying.on.one.supplier.for.a.major.portion.of.a.com- pany’s. purchase. needs. might. not. be. the. best. strategy. when. it. comes. to. managing.risk.across.an.entire.organization.

Logistics Risks..Around.the.year.2000,.during.the.Internet.and.e-.business. boom.came.the.concept.of.Business.Process.Outsourcing.(BPO)..IBM.was. a.big.proponent.of.this.concept.within.its.own.supply.chain.and.promoted. doing.what.you.do.best.and.outsourcing.the.rest..Why.did.IBM.and.many. other. companies. embrace. this. approach. to. supply. chain. management?.

taBle 7.1

Supply.Risks

Supply Risk Cause Horizons Traditional Remedies

Supplier.lead. times

Material/.capacity.issues Both Buffer.stock,.larger.order. quantities

Supplier. quality

Manufacturing.processes Both Contract.verbiage,. penalty.clauses,.inbound. inspection

Transportation. lead.time

Breakdowns,.acts.of.God,. customs.issues

Both Contract.verbiage,. penalty.clauses

Subcontractor. availability

Initial.source.can’t.deliver Both Contracts.for.potential. capacity.reservation

Supplier. pricing

Performance.issues,.contract. changes,.breach.of.contract

Tactical Due.diligence,.phone-.fax,. and.possible.visits

Time.delay Customs,.lack.of. performance

Both Buffer.stock,.rescheduling. final.delivery

Disruption Labor.issues,.natural. disasters,.terror

Both Buffer.stock,.safety.stock,. second.source.capacity

Import.delays Customs.paperwork,.port. strikes,.labor.issues

Both Additional.freight. forward.companies,.calls. to.government.contacts

Supplier. insolvency

Poor.management,.acts.of. God,.force.majeure

Both Loans,.law.suites,. litigation,.and.second. sourcing

Fraud/. corruption

Poor.government.oversight Both Fines,.penalties,.and. operating.restrictions

Counterfeit. material

Poor.government.oversight Both Fines,.penalties,.and. operating.restrictions

Supplier. delivery

Manufacturing.issues,. quality.issues,.customer. requirement.changes

Both Buffer.stock,.warehouse. inventory,.second.source

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

130 • Supply Chain Risk Management: An Emerging Discipline

One. reason. was. companies. found. that. there. were. many. organizations. around. the. globe. that. could. do. certain. business. functions. better,. faster,. and.cheaper..And.at.that.time,.as.the.Internet.was.exploding.on.the.sup- ply.chain.scene,.there.was.renewed.interest.in.exploiting.the.World.Wide. Web.to.collaborate.with.these.new.BPO.organizations.and.new.partners. to.drive.overwhelming.top-.line.growth.

With.that.belief,a.new.industry.called.third-.party.logistics,.or.3PLs,.was. born..A.quick.story.about.the.chemical.industry.in.2000.will.perhaps.pro- vide.some.context.regarding.the.growth.of.3PLs..During.this.period.the. chemical.industry.was.still.vertically.(i.e.,.functionally).aligned.in.terms.of. supply.chain.management..There.were.several.reasons.that.many.organi- zations.had.not.embraced.the.concept.of.supply.chain.management..First,. many.organizations.had.very.good.profit.margins.and.did.not.see.the.need. for. change.. Second,. the. “chemists”. were. still. running. chemical. compa- nies.and.lacked.supply.chain.knowledge..And.third,.the.chemical.industry. was.still.an.asset-.intensive.industry.that.believed.in.the.benefits.of.verti- cal.integration.

During. this. time,. a. few. leading-.edge. chemical. organizations. began. benchmarking.their.total.logistics.costs.associated.with.inbound.and.out- bound.material.delivery.as.a.percent.of.total.sales..The.numbers.were.alarm- ing.. On. average,. the. chemical. industry’s. transportation. costs. were. more. than.10%.of.sales..As.the.industry.benchmarked.against.other.industries,. it. came. to. the. conclusion. that. while. chemical. companies. were. good. at. breaking.down.hydrocarbons,.these.companies.were.not.so.good.at.logis- tics.. As. a. result. these. companies,. like. so. many. in. other. industries,. out- sourced. their. logistics. to. companies. that. could. service. their. needs. at. a. much.reduced.rate.

If.we.scan.Table 7.1.and.view.the.logistics.risks,.we’re.not.saying.the.BPO. approach. has. totally. eliminated. logistics. risk.. However,. these. outsource. providers. have. developed. many. tools. and. techniques. to. manage. risk. for. their.customers..Many.of.the.traditional.remedies.are.still.being.leveraged. but.by.a.new.industry.that.tends.to.have.much.more.experience.in.global. trade.and.has.invested.in.more.advanced.tools.and.techniques.

Fraud, Corruption, and Counterfeiting Risks. The.European.Banking. Board.has.developed.a.set.of.baseline.definitions.for.their.employees.and. their.customers.to.follow..Fraudulent.practice.means.any.action.or.omis- sion,. including. misrepresentation,. that. knowingly. or. recklessly. misleads. or. attempts. to. mislead. a. party. to. obtain. a. financial. benefit. or. to. avoid. an. obligation.. Corrupt. practice. means. the. offering,. giving,. receiving,. or.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 131

soliciting,.directly.or.indirectly,.of.anything.of.value.to.influence.improp- erly.the.actions.of.another.party.1.Counterfeiting.occurs.when.something. is.made.in.imitation.so.as.to.be.passed.off.fraudulently.or.deceptively.as. genuine.2.This.portion.of.supplier.risk.is.far.too.large.to.dig.deeper.into.at. this.time,.but.we.will.talk.at.length.about.fraud,.corruption,.and.counter- feiting.in.Chapter 8.

demand Risk

Demand. management. has. always. been. a. difficult. discipline. by. defini- tion..Part.of.this.is.due.to.the.tendency.of.forecasts.that.are.almost.always. wrong.to.some.degree..Demand.management.and.forecasting.techniques. and.solutions.have.been.available.to.the.supply.chain.profession.for.over. 80 years..There.are.hundreds.of.deterministic,.statistical.solution.provid- ers.that.provide.companies.with.the.ability.to.scan.historical.sales.to.arrive. at. a. forecast. using. techniques. such. as. least. squares,. time. series. analysis,. and.regression.analysis..We’ll.talk.in.more.detail.about.these.techniques. in.Chapter 10,.but.for.now.we’ll.segment.the.demand.risk.discussion.into. customer.risk,.product.risk,.and.logistics.risk.

Customer Risk..As.shown.in.Table 7.2,.there.are.plenty.of.risks.on.the. customer. side. of. the. equation.. The. demand. issue. tends. to. get. the. most. focus.because.the.purpose.of.demand.estimation.is.to.project.what.a.cus- tomer.will.buy,.when.they.will.buy.it,.and.how.many.they.will.buy..With. complex.supply.chains.and.large.product.portfolios,.not.even.considering. global.markets,.seasonal.products.and.other.extraneous.factors,.the.task. is.somewhat.daunting.

Forecast.error.is.a.key.risk.in.demand.management.that.requires.atten- tion.. The. reason. we. focus. on. this. risk,. is. that. it. runs. from. 10%. error. of. forecast. versus. actual. at. the. aggregated. product. family. level. to. more. than.40%.error.at.the.stock-.keeping.unit.or.item.level..(Forecasts.almost. always.become.less.reliable.as.the.forecasts.become.more.granular.rather. than.aggregated.)

The.traditional.remedy.to.mitigate.forecast.error.has.been.to.statistically. calculate.safety.stock.and.develop.buffer.stocks.at.choke.points.through- out. the. supply. chain.. The. supply. chain. profession. has. been. working. for. more.than.50 years.to.mitigate.the.risk.of.attempting.to.project.what.their. customers.will.buy.and.balancing.supply.to.ensure.superior.service.levels. to.those.customers..And.industrial.customers.are.in.no.way.exempt.from. providing. additional. risk. to. this. pillar. of. supply. chain. risk.. Customers.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

132 • Supply Chain Risk Management: An Emerging Discipline

taBle 7.2

Demand.Risks

Demand Risk Cause Horizons Traditional Remedies

Forecast.error Seasonal.issues,.lead. times,.poor.information,. inadequate.systems,. poor.communications,. inadequate.skills

Both Statistically.derived.safety. stock,.buffer.stock.points,. excess.inventory. throughout.supply.chain

Time.delays Customer.changes,. systems.issues,.product. issues

Both Rescheduling,.price. concessions

Outbound. transit.times

Carrier.issues,.acts.of. God,.customers’.issues

Both Carrier.discussions,. customs.calls,.freight. forwarding.follow-.ups

Customer. pricing

Poor.communication,. inadequate.contract. verbiage,.poor. performance

Operational Concessions,.Rescheduling. deliveries

Customer. promotions

Poor.communications,. poor.execution.on.both. sides

Operational Constant.conference.calls,. rescheduling. manufacturing.and. deliveries,.stealing.product. form.other.customers

Customer. bankruptcy

Poor.execution,.fraud,. corruption,.sell.out.by. owner

Both Possible.loans,.possible. merger.or.partnership

Product. failure

Poor.quality.control,. material.issues,. incorrect.specifications

Both Rescheduling,.modifying. the.specifications,.price. concessions

Warranty. issues

Poor.communications,. poor.specification. management,.recall.of. product,.death.and.more

Both Law.suites,.litigation,. government.involvement,. fines.and.penalties

Customer.loss All.of.the.above.issues. and.more

Both Sell.off.material.designated. for.customer,.write.off.if. specific.and.scan.for.new. customers

New.product. introduction

Poor.planning,.poor. communication. throughout.organization,. poor.execution,.poor. assumptions

Both Ad.hoc.meetings,.excessive. overtime,.price. modifications,.new. promotions,.rescheduling. of.manufacturing.plans

Fraud.and. corruption

Poor.government. oversight

Both Fines,.penalties,.and. operating.restrictions

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 133

have. a. nasty. habit. of. continually. arguing. about. changes. to. pricing. and. delivery.dates.and.have.a.propensity.to.surprise.suppliers.with.unplanned. or.poorly.communicated.product.promotions.of.the.supplier’s.products.at. their.stores.

When.a.customer.surprises.a.supplier.with.a.promotion.of.the.supplier’s. product,.the.resulting.demand.tends.to.be.at.least.three.to.four.times.the. forecasted. level. of. sales,. something. that. wreaks. havoc. on. the. supplier’s. supply.chain..The.typical.approach.to.respond.to.this.situation.is.to.reallo- cate.product.within.the.supplier’s.bill.of.material.to.satisfy.the.promotion.. This. approach. tends. to. result. in. excessive. overtime. at. the. supplier,. total. disruption.of.the.supplier’s.supply.chain–.planning.processes,.and.aggra- vation.to.other.customers.when.their.delivery.promises.are.rescheduled.. And. finally,. if. this. risk. is. perpetuated,. or. becomes. chronic. at. a. supplier,. the. outcome. tends. to. be. a. reduction. in. customer. relationships. and. ulti- mately.a.loss.of.customers.

Product Risk..Poor.product.portfolio.management.is.another.important. aspect. of. this. risk. pillar.. By. far. the. largest. risk. in. this. category. is. product. failure. and. warranty. issues.. An. example. we. all. have. witnessed. over. the. last. couple. of. years. is. Toyota’s. issues. with. braking. systems,. accelerators,. and. massive. product. recalls.. Automobile. manufacturers. run. the. num- bers. on. their. risks. associated. with. product. liability. and. warranty. prob- ably. better. than. most. manufacturers.. Their. risk. appetite. is. usually. quite. high. and. they. utilize. many. diverse. liability,. tort,. and. warranty. insurance. packages. to. mitigate. those. risks.. However,. continued. product. recalls,. regardless. of. the. industry,. can. lead. to. customer. loss,. fines,. penalties,. and. potential.bankruptcy..Witness.what.has.happened.at.General.Motors.

One.of.the.most.difficult.elements.in.this.pillar.is.new.product.introduc- tion.. Forecast. error. for. products. continually. produced. and. sold. to. cus- tomers.can.become.as.large.as.40%.for.a.given.product..Forecast.error.and. the.impact.on.the.company.of.poorly.launched.new.products.can.be.even. more. dramatic.. We. mentioned. this. aspect. of. demand. management. and. supply.chain.management.in.Chapter 4..Poor.assumptions.for.poor.plan- ning.and.poor.communications.relative.to.new.product.launches.can.be. devastating..An.example.is.the.growth.of.Apple’s.iPhone.and.Samsung’s. Galaxy.products.at.the.expense.of.Blackberry’s.product.portfolio.

There. are. traditional. approaches. to. mitigate. product-.planning. risks. including.collaborative.planning,.forecasting,.and.replenishment.(CPFR). tools. that. provide. a. vehicle. for. demand. collaboration. between. suppliers.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

134 • Supply Chain Risk Management: An Emerging Discipline

and. customers.. CPFR. is. utilized. in. the. consumer. packaged. goods. and. retail. industries.. The. sales. &. operational. planning. (S&OP). process. acts. as.a.framework.to.assist.companies.in.their.efforts.to.balance.supply.with. demand.to.minimize.surprises.and.maximize.profits.for.the.entire.enter- prise..We.will.discuss.these.in.more.detail.in.Chapters.9.and.12.

Logistics Risk.. In. this. risk. pillar,. logistics. relates. to. outbound. mate- rial.that.perhaps.goes.to.a.final.assembly/.package.partner,.a.distribution. or.warehouse,.or.the.final.customer..Most.of.the.logistical.discussion.we. engaged.in.within.our.supplier.risk.segment.applies.in.this.arena.as.well.. Most.manufacturers.do.not.maintain.their.own.truck,.barge,.rail,.or.ship. fleet..As.mentioned.earlier,.thousands.of.3PL.companies.will.haul.freight. better,. faster,. and. cheaper. than. most. manufacturers.. One. nuance. is. the. approach. that. utilizing. 3PLs. to. deliver. finished. goods. to. customers. is. a. form.of.risk.mitigation.due.to.better.performance,.or.if.contract.verbiage. with.that.carrier.includes.sharing.or.pooling.of.the.risk.in.case.of.an.acci- dent.. In. the. chemical. industry,. contracts. specify. not. only. what. we. call. service.level.agreements.(SLAs).but.also.language.that.shares.the.liability. risk.of.an.accident.with.both.parties..This.has.been.a.traditional.remedy. to.improve.service.deliveries,.reduce.the.cost.of.transportation,.maximize. profits,.and.minimize.risk.

process Risk

In.this.risk.pillar,.which.a.cursory.glance.at.Table 7.3.reveals.to.be.exten- sive,.the.risks.are.inherently.positioned.within.an.organization..Another. way.to.think.about.this.is.that.the.organization.has.better.control.of.these. risks.because.they.occur.within.their.own.domain..The.frequency.of.occur- rence.and.the.remedies.many.organizations.utilize.to.solve.these.issues.lie. within.their.own.four.walls..Our.categories.for.this.risk.pillar.discussion. will.be.known.or.hard.risks,.unknown.or.soft.risks,.and.chronic.risks.that. can.arise.within.a.company’s.four.walls.

Known Risks..These.are.risks.that.are.measurable.and.can.be.planned. for.. Known. risks,. also. called. hard. risks,. include. process. breakdowns,. poor. material,. poor. quality. control,. criminal. activity,. poor. and. unreli- able.systems,.and.failure.of.a.company’s.facilities.and.assets..Known.risks. from.Table 7.3.could.include.manufacturing.yield,.capacity,.information. delays,. systems,. receivables,. payables,. inventory,. and. planning.. Most. of.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 135

taBle 7.3

Process.Risks

Process Risk Cause Horizons Traditional Remedies

Manufacturing. yield

Equipment.failure,. material.issues,.human. error

Operational Reschedule.run,.cut.into. existing.capacity.plan

Capacity Equipment.failure,.poor. performance,.poor. communications,.poor. planning

Both Reschedule.runs,. reschedule.deliveries,. possible.use.of. contractors

Information. delays

Poor.planning,. inadequate.systems,. outages

Both Backup.systems,.ad.hoc. meetings,.extreme. overtime

Time.delays All.of.the.above.and. below

Both Ad.hoc.meetings.and. excessive.overtime

Disruption Labor.issues,.systems,. material,.inbound. material,.natural. disaster.or.act.of.God

Both Ad.hoc.meetings.and. excessive.overtime

Systems Outages,.terror,.hackers,. internal.errors

Both Backup.systems,.ad.hoc. meetings,.vendor. outreach.and.excessive. overtime

Receivables Poor.execution,.poor. contract.verbiage,.poor. relationships,.customer. financial.issues

Both Phone.calls,.e-mails,.faxes,. visits.and.possible. collection.agencies

Payables Cash.flow.issues. in-.house,.cash.flow. strategy,.poor. relationships.with. suppliers,.poor.supplier. performance

Both Phone.calls,.e-.mails,.visits. and.possible.contract. renegotiations

Inventory Forecast.error,.product. life.cycles,.poor. planning.systems,.poor. supply.chain. management.execution

Both Excessive.safety.stock,. write-.downs.and. write-.offs

Intellectual. property

Outsourcing,.contractors,. partnerships,.and. espionage.

Both Vertical.integration,. contract.verbiage,.fines. and.penalties

continued

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

136 • Supply Chain Risk Management: An Emerging Discipline

these. risks. are. known,. albeit. not. particularly. popular,. because. they. are. indicative. of. a. management. style. and. attitude. or. a. lack. of. investment. of.time.and.resources..Many.of.the.risk.remedies.are.reactive.and.many.of. the.risks,.without.proper.attention.can.become.chronic,.which.we’ll.dis- cuss.shortly.

The.critical.issue.with.known.risks.is.that.without.addressing.them.with. permanent.solutions,.an.organization.tends.to.be.plagued.with.these.risks. daily.to.the.point.where.they.lose.visibility,.confidence,.and.commitment,. leading.to.a.potential.major.internal.disruption..This.breakdown.within.a. company’s.processes.can.be.as.impactful.as.a.catastrophic.event.emanat- ing.externally.

Unknown Risks.. These. risks. are. difficult. to. determine. and. are. some- times. called. soft. risks.. Examples. of. soft. risks. might. be. a. radically. new. product.or.technology.that.renders.a.company’s.existing.approach.to.the.

taBle 7.3 (continued)

Process.Risks

Process Risk Cause Horizons Traditional Remedies

Human/. process.error

Operator.issues,.fraud,. corruption,.systems. breach

Both Process.revalidation,. employee.reeducation,. law.suites/.or.discharge

Planning Inadequate.systems,. inadequate.training,. poor.supervision,.poor. management.style

Both Systems.upgrades,. reeducation,.additional. collaboration,.and. metrics.of.success

Product.failure Poor.material,.poor. quality.control,.poor. communication,.poor. management.oversight

Both Enhance.communications,. customer.visits,.supplier. visits,.contract. renegotiations

Equipment. failure

Poor.maintenance. schedules,.operator. error,.material.issues,. component.failure

Both Perform.assessment,. revalidation.of.alternative. equipment/.routings,. vendor.visits.in-.house

Organizational. management

Poor.performance,.poor. communication,. inadequate. measurements,.fraud

Both Ad.hoc.meetings,. assessment.of.skill.sets. and.possibly. enhancement.of.roles,. goals.and.measurements

Strategy Poor.planning,.poor. execution,.poor. communication,. competition

Both Same.as.above.with. possible.change.in. strategy

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 137

market.obsolete..Unknown.risks.could.also.be.a.fire.that.destroys.a.plant,. an.attack.on.a.plant,.a.weather.event,.and.from.Table 7.3,.areas.such.as.time. delays.or.any.unforeseen.disruption..An.effective.way.to.respond.to.these. risks.is.to.develop.and.practice.response.scenarios,.what.we.call.business. continuity. planning. (BCP).. The. disconcerting. aspect. of. soft. risks. is. that. most.companies.do.not.develop.or.practice.scenario.response.plans.or.risk. response.plans..In.fact,.as.you.scan.down.the.traditional.remedies.column. for.the.soft.risks.in.Table 7.3,.you.will.notice.that.almost.all.are.reactive. rather.than.proactive.

Chronic Risks..The.primary.characteristic.of.chronic.risks.is.that.when. these.occur.they.tend.to.cause.only.minor.internal.disruptions..They.may. occur.continually.and.because.of.the.nature.of.their.low.impact,.organiza- tions.tend.to.absorb.the.risk.and.develop.work-.arounds..The.disruptions. could.be.persistent.and.the.root.causes.may.not.be.obvious.and.therefore. become. tolerated. over. time.. Some. of. the. risks. from. Table 7.3. that. could. fall.into.this.category.include.manufacturing.yield,.capacity.issues,.time. delays,.human.errors,.and.equipment.failure.

environment/ ecosystems Risk

The.fourth.risk.pillar.is.probably.the.most.immature.pillar.since.there.are. so.many.new.government.rules.and.regulations,.weather.events,.and.fraud. and. corruption. possibilities. emerging. around. the. globe.. Furthermore,. most. organizations. are. operating. global. supply. chains. in. areas. where. they’ve.never.operated.before..This.is.all.in.an.effort.to.grow.top-.line.reve- nues.and.penetrate.new.markets..Globalization.strategies.bring.additional. risk,.which.Table 7.4.profiles.

Known Risks..In.this.arena.we.could.categorize.risks.such.as.currency. rates,. customs. regulations,. environmental. regulations,. industry. regula- tions,.and.country.regulations..We.may.not.like.all.the.regulatory.statutes. placed.upon.us,.but.they.tend.to.be.known.and.developed.over.a.wide.time. span,.thus.providing.organizations.ample.time.to.prepare.for.and.comply. with.these.rules..Many.companies.do.not.have.the.skill.sets.to.understand. and.manage.all.the.rules.and.regulations.and.therefore.rely.on.3PLs.and. freight. forwarders. to. ensure. compliance.. One. caveat. before. we. move. to. the.unknown.risks.is.that.all.companies.have.a.distinct.style.and.attitude. regarding.risk,.and.sometimes.their.risk.appetite.is.not.what.it.should.be.. Subsequently,.they.may.or.may.not.choose.to.adhere.to.all.the.rules.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

138 • Supply Chain Risk Management: An Emerging Discipline

Unknown risks..Risks.within.this.category.could.be.political,.weather. and.acts.of.God,.fraud,.corruption,.counterfeiting,.and.competition..The. bulk.of.these.risks.is.mitigated.and.managed.through.the.use.of.scenario-. based.planning.approaches,.be.it.at.a.specific.facility.level.or.throughout. an.entire.supply.chain.network..Most.of.the.unknown.or.soft.risks.in.this. category.can.and.should.be.planned.for.using.scenario-.based.BCP.or.risk.

taBle 7.4

Environment/Ecosystem.Risks

Environment/ Ecosystem Risk Cause Horizons Traditional Remedies

Currency. exchange.rates

Central.banks,.country. issues,.conflicts

Both Use.of.financial.hedging. techniques

Political. environment

Conflicts,.political.upheaval. Both Calls.with.country. officials,.tapping.own. government.contacts.

Customs. regulations

Improper.paperwork,. poorly.packaged.material,. terror

Both Use.of.3rd.party.logistics. partners,.conversations. with.customs,.enhanced. paperwork

Weather/acts.of. God

Floods,.tornados,. hurricanes,.fires,. volcanoes,.war

Both Disaster.insurance

Environmental. regulations

Lack.of.discipline,.failure.of. audit,.poor.management. and.diligence

Both Excessive.overtime.for. remedial.compliance

Industry. regulations

Same.as.above Both Same.as.above

Country. regulations

Same.as.above Both Same.as.above

Fraud/ corruption

Country.policies.or. lack-thereof,.suspect. partners,. misrepresentation.by.3rd. party.contractors

Both Fines,.penalties,. shutdowns.and.remedial. policy.enhancements,. including.discharge

Counterfeiting Same.as.above Both Same.as.above,.including. alternative.sourcing.and. partnerships

Competition Lack.of.focus,.poor. company.communication,. poor.product.introduction. process,.poor.execution

Both Price.reductions,. marketing.promotions,. customer.visits,.enhanced. product.portfolio.and. extended.warranties

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 139

response.plans..However,.a.few.of.these.risks,.such.as.fraud,.corruption,. theft,.and.counterfeiting.lend.themselves.to.a.more.reactionary.approach.

Historically,. almost. every. soft. risk. is. event-.driven. in. nature.. Theft. has. traditionally. been.a.reactionary.risk,.followed.by.countermeasures,.inci- dent.follow-.ups,.and.bulletins.to.recover.the.loss..Counterfeiting.has.tra- ditionally. been. much. more. of. a. sensitive. subject,. because. based. on. the. industry,.when.it.occurs.governments.tend.to.get.involved.to.protect.citi- zens.. And. fraud. and. corruption. is. a. sensitive. subject. since. no. company. wants.its.brand.on.the.news.or.the.web.for.the.wrong.reasons.

When. these. soft. risks. emerge,. whether. inside. or. outside. a. company,. organizations.should.address.the.issue.as.quickly.as.possible..Many.fraud. events. emanate. from. within. the. organization. and. are. dealt. with. quietly. using.third-.party.fraud.investigative.companies..When.fraud,.bribery,.and. corruption. emerge. outside. the. organization,. in. countries. where. a. com- pany’s.products.are.being.manufactured.or.sold,.that’s.when.the.brand.is. most.at.risk..The.bottom.line.in.this.area.of.risk.is.that.it.will.continue.to. grow. in. terms. of. scope. and. scale. as. long. as. companies. continue. to. pen- etrate.new.global.markets..The.approaches.to.manage.these.risks.will.also. continue.to.emerge.and.perhaps.migrate.from.reactive.to.more.proactive. in.nature..We’ll.share.many.of.those.new.proactive.approaches.in.subse- quent.chapters.

BuSineSS COntinuity planning

Adopting. a. business. continuity. plan. (BCP). is. the. start. of. a. journey. that. ensures.continuous.operations.of.critical.processes.within.a.company.and. expands.to.include.critical.suppliers.as.the.program.matures..It.is.a.concept. that.is.absolutely.central.to.effective.risk.management..In.reality,.this.topic. could.appear.in.one.of.many.chapters..We.simply.made.a.decision.to.place. business.continuity.planning.in.this.chapter.because.so.many.supply.chain. risks.are.operational.in.nature..Before.describing.business.continuity.plan- ning.in.detail,.we.will.define.some.important.concepts.and.definitions.

Business. continuity. is. the. process. of. planning. for. and. implementing. procedures. that. are. designed. to. enable. continuous. operations. of. critical. business.processes.and.functions..Incident.management.is.the.process.that. is.responsible.to.guide.the.company.through.an.incident.or.disaster.and. execute. the. overall. business. continuity. plan.. The. incident. management.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

140 • Supply Chain Risk Management: An Emerging Discipline

team.focuses.on.incidents.that.have.escalated.beyond.emergency.response. and.that.could.impact.business.operations.(i.e.,.business.continuity)..The. responsibilities.of.the.incident.management.team.include.the.following:

•. Activate.department.business.continuity.plans.and.disaster.recovery. plans.as.appropriate

•. Make.workplace.recovery.decisions •. Activate.disaster.recovery.decisions •. Allocate.resources.among.recovering.departments/.groups •. Coordinate.efforts.between.recovery.and.response.teams •. Approve.disaster-.related.purchases •. Develop.and.distribute.messages.to.employees,.customers,.and.vendors •. Provide.direct.updates.to.the.executive.team •. Carry.out.governance.board.and.executive.directives

Emergency.response.is.the.process.that.is.responsible.for.human.and.life. safety.issues.during.an.incident..The.emergency.response.team.leads.the. evacuation.and.assembly.or.shelter-.in-.place.activities.

BuSineSS COntinuity planning OBjeCtiVe5

The.objective.of.a.business.continuity.plan.is.to.ensure.the.availability,. reliability,. and. recoverability. of. business. processes. servicing. a. compa- ny’s.customers,.partners,.and.stakeholders..In.order.for.business.conti- nuity.to.be.effective,.it.must.be.an.integral.part.of.the.business.planning. life. cycle.. Whenever. business. changes. impact. a. process. or. function,. business. continuity. considerations. must. be. evaluated. and. adjusted. as. necessary. to. understand. the. effect. to. existing. recovery. strategies. and. plans.. We. all. make. plans. based. on. trade-.offs. of. cost. and. benefits.. Business.continuity.formalizes.a.company’s.overall.approach.to.effective. risk.management.and.should.be.closely.aligned.to.a.company’s.incident. management,.emergency.response.management,.and.information.tech- nology. disaster. recovery.. Successful. business. continuity. management. requires.a.commitment.from.the.company’s.executive.team.in.order.to. show. commitment,. raise. awareness,. and. implement. sound. approaches. to.build.resilience.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 141

the Business Continuity life Cycle

The.business.continuity.life.cycle.includes.six.stages:

. 1.. Governance

. 2.. Business.Impact.Analysis

. 3.. Risk.Assessment

. 4.. Recovery.Strategies

. 5.. Business.Continuity/.Disaster.Recovery.Planning

. 6.. Test.and.Verification

Governance..Senior.management.involvement.and.support.are.critical.to. the.success.of.a.company’s.business.continuity.program..Executive.buy-.in. enables.the.business.continuity.program.to.be.in.alignment.with.the.com- pany’s. strategic. direction. and. business. objectives.. This. also. ensures. that. the.program.is.able.to.obtain.appropriate.resources.and.visibility..Without. adequate. senior. management. involvement. and. support,. a. business. con- tinuity. program. risks. losing. effectiveness. and. alignment. with. business. strategy,.misspent.or.unfit.resources,.gaps.between.capability.and.require- ments,.or.in.the.worst.case,.senior.management.eliminating.business.con- tinuity.altogether.because.they.do.not.see.the.value.in.the.investment.

A. key. component. for. governance. is. the. creation. and. enforcement. of. business.continuity.standards.and.policies..These.standards.and.policies. outline.the.what.and.how.of.business.continuity..This.allows.for.program. consistency.across.the.company.and.supports.corporate.audits..The.gov- ernance.board.has.the.responsibility.to.support.and.oversee.the.business. continuity.program.

No.company.can.implement.a.robust.business.continuity.program.over- night;.it.can.take.years.for.a.complex.global.company.to.fully.implement. a.business.continuity.program..Business.continuity.is.a.journey.that.must. be. evaluated,. maintained,. and. aligned. with. an. organization’s. three-. to. five-.year.strategy..The.governance.board.is.responsible.for.business.conti- nuity.oversight.and.direction;.the.board.is.in.charge.of.the.journey.

Business Impact Analysis (BIA).. A. BIA. is. a. methodology. to. identify. critical. business. processes. and. functions. based. on. operational. and/.or. financial.impacts..This.is.accomplished.by.interviewing.business.process. owners.and.asking.them.to.describe.their.business.processes..This.inter- view. includes. the. identification. of. critical. resource. requirements. (staff,. equipment,.etc.),.vital.records.and.data,.along.with.internal.and.external.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

142 • Supply Chain Risk Management: An Emerging Discipline

dependencies.. Analysis. of. the. data. gathered. through. these. interviews. paints.a.picture.of.the.critical.paths.within.a.business.at.any.given.time.. This.step.also.identifies.the.business.threshold.for.disruption.loss,.includ- ing.applications,.systems,.platforms,.and.infrastructure.

The. business. impact. analysis. identifies. the. preliminary. recovery. time. objective. (RTO)3. and. recovery. point. objective. (RPO).4. It. is. important. to. remember. when. designing. a. business. continuity. solution. that. it. is. not. restoring.business.to.normal,.but.it.is.the.restoration.of.what.is.most.cru- cial. at. a. given. time.. For. example,. if. the. company. issued. payroll. the. day. previous.to.an.“event,”.restoring.the.payroll.process.would.not.be.critical.. But.if.payroll.was.to.be.released.the.day.after.the.event.then.restoring.the. payroll. process. would. be. critical,. especially. to. employees.. The. business. process.owners.also.describe.work-.around.procedures.that.can.be.imple- mented.until.the.process.can.be.resumed.or.the.staff.can.return.to.work.

Risk Assessment.. The. risk. assessment. stage. identifies. business. conti- nuity. risks. that. could. result. in. a. business. process. disruption. or. hinder. recovery.. A. risk. assessment. usually. includes. a. facility. assessment. and. an. environmental. analysis.. A. high-.level. physical. inspection. of. a. facil- ity. should. include. a. review. of. the. electrical. design,. mechanical. heating. ventilation. and. air-.conditioning. (HVAC). design,. communications. and. network. architecture. review,. physical. security. evaluation,. emergency. egress/.ingress,. and. structural. design. of. the. data. center. and. call. center. (as. applicable).. The. environmental. risk. analysis. includes. the. analysis. of. the. likelihood. of. natural. and. man-.made. disasters. at. a. specific. location.. After.the.risks.are.identified,.they.should.be.ranked.and.rated.by.criteria. specified.in.the.business.continuity.standards.

Recovery Strategies..The.data.gathered.from.the.BIA.and.risk.assessment. portray. the. existing. business. continuity. capabilities. and. gaps.. Recovery. strategies.are.developed.to.mitigate.these.potential.risks..Recovery.strate- gies.and.the.associated.estimated.costs.for.implementation.are.developed. and.presented.to.the.business.continuity.governance.board.for.review..It. is.up.to.the.governance.board.to.approve.and.fund.the.chosen.recovery. strategies..Note.the.governance.board.should.also.sign.off.on.high-.ranked. business.risks.with.the.reasoning.on.any.decisions.not.to.remediate.a.risk.

Business Continuity/ Disaster Recovery Plans.. Business. continuity. planning.allows.for.the.availability.of.critical.business.processes.in.the.event. of. an. incident. that. renders. facilities,. computer. systems,. and/.or. employees. inoperable.or.inaccessible..The.goal.of.the.creation.and.implementation.of. business. continuity. and. disaster. recovery. plans. is. to. minimize. economic.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 143

losses.resulting.from.disruptions.to.business.functions..These.plans.provide. steps. and. procedures. to. facilitate. an. orderly. recovery. of. critical. business. functions. and/.or. systems.. Business. continuity. plans. address. the. recovery. of.business.functions.and.workspaces;.disaster.recovery.plans.address.the. recovery.of.the.information.technology.environment.and.systems.that.sup- port. the. business.. The. provisions. in. these. types. of. plans. are. used. as. the. basis. for. providing. guidance,. preparing. for,. and. effecting. recovery. activi- ties.in.connection.with.executive.management’s.discretion..Tactically,.the. business.continuity/.disaster.recovery.plans.address.how.to.do.the.following:

•. Minimize. business. losses. resulting. from. disruptions. to. business. processes

•. Provide. a. plan. of. action. to. facilitate. an. orderly. recovery. of. critical. business.processes.and.technical.infrastructure

•. Identify. key. individuals. or. teams. who. will. manage. the. process. of. recovering. and. restoring. the. business. and/.or. technology. after. an. incident.or.disaster

•. Specify.the.critical.business.and.technical.activities.that.need.to.con- tinue.after.an.incident

•. Outline. the. logistics. of. recovering. critical. business. processes. and. technical.infrastructure

Proper.execution.of.these.plans.facilitates.the.timely.recovery.of.critical. business. processes.. Business. continuity. and. disaster. recovery. plans. are. effective.only.if.they.are.maintained.properly.and.the.content.information. is.current..A.key.element.of.business.continuity/.disaster.recovery.plans.is. the.coordination.between.information.technology.and.business.processes. to.align.RTO.and.RPO.with.business.requirements.over.time.

Test and Verify..The.business.continuity.standards.will.guide.the.business. continuity.program’s.roadmap.to.the.development,.testing,.and.maintenance. of.continuity.and.disaster.plans.and.reporting.to.the.governance.board..The. tests. are. used. to. train. associates. and. create. an. awareness. of. the. business. continuity.program.model.and.individual.roles..This.is.done.through.exer- cising. the. plan.. Different. levels. of. plan. testing. range. from. tabletop. “walk-. throughs”.to.the.actual.mobilization.of.plans..Actual.mobilization.of.plans. requires.increased.resources.but.will.provide.more.thorough.results.

The.key.to.a.thriving.business.continuity.program.is.that.it.is.never.stag- nant.. It. is. a. living. process,. and. as. it. matures. it. should. evolve. into. being. part.of.regular.business.operations,.not.viewed.as.simply.an.add-.on.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

144 • Supply Chain Risk Management: An Emerging Discipline

BCp exercises

A.tabletop.or.structured.walk-.through.exercise.is.a.paper.evaluation.of.a. portion. of. a. business. continuity. plan. without. the. expenses. or. personnel. resources. associated. with. a. full. test.. The. exercise. scope. can. vary. from. a. review. of. a. portion. of. the. BCP. to. a. review. of. the. entire. plan.. The. walk-. through.has.many.worthwhile.objectives:

•. Verify.the.contents.of.the.plan •. Prepare.for.simulation.testing •. Train.new.members.and.create.employee.awareness •. Maintain.preparedness.while.limiting.use.of.resources •. Affirm.that.the.strategy.documented.in.the.plan.is.viable •. Educate.critical.personnel.on.their.responsibilities.in.a.disaster •. Confirm.that.the.information.in.the.plan.is.current.and.accurate •. Identify.areas.of.the.plan.that.need.revision.or.updates

The. primary. benefit. of. a. tabletop. exercise,. besides. offering. the. oppor- tunity.to.realize.an.impressive.set.of.objectives,.is.that.it.is.cost-.effective. and.noninvasive.

A.second.type.of.exercise,.called.a.component.exercise,.is.usually.per- formed. during. off-.hours. and. tests. a. particular. segment. of. the. recovery. plan..It.differs.from.the.structured.walk-.through.in.that.it.involves.actual. recovery.activities..The.overwhelming.benefit.of.a.component.exercise.is. that.it.is.nondisruptive.and.focused..Various.types.of.component.tests.can. include.the.following:

•. Tests.of.the.emergency.notification.system •. Evacuation.tests •. Data.center.or.application.recovery.test •. Remote.or.dial-.in.access.test •. Critical.business.function.recovery.test

A.mobilization.exercise.is.an.integrated.simulation/.full.operations.test. that.includes.an.exercise.performed.at.the.actual.recovery.sites.and.utiliz- ing.backup.resources.that.would.be.used.during.an.actual.event..A.struc- tured.walk-.through.and/.or.a.component.exercise.test.should.precede.the. mobilization.exercise..The.primary.objective.of.a.mobilization.exercise.is. to.test.an.entire.plan.or.a.portion.of.the.plan.under.emergency.scenarios,.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

Operational Risk • 145

validate. operational. effectiveness. and. business. unit. interdependencies,. and. provide. technical. and. administrative. measurable. results.. Measures. of.test.results.should.be.compiled.during.the.exercise.and.then.compared. against.expected.results.

An.exercise.of.this.proportion.is.normally.scheduled.to.take.place.after. hours.or.during.a.weekend..While.the.most.costly.in.terms.of.resources,.the. major.benefit.of.a.mobilization.exercise.is.that.it.requires.interdepartment. coordination.and.is.the.best.true.test.of.the.business.continuity.program.

After.the.exercise.type,.identification. of.recovery.priorities,.objectives,. timeline,. and. scenario. have. been. determined,. a. company. conducts. the. test,.analyzes.the.findings,.and.develops.corrective.actions..The.final.step. is. to. update. the. business. continuity/.disaster. plan. to. incorporate. lessons. learned.from.testing.

COnCluding thOughtS

The.supply.chain.management.concept.has.come.a.long.way.from.the.days. of. materials. management,. inventory. cycle. counting,. expediting. orders,. and. fighting. fires.. The. concept. has. become. a. profession. and. many. out- side.the.industry,.including.executive.managers,.have.come.to.the.realiza- tion. that. supply. chain. excellence. is. a. critical. success. factor. for. business.. However,.many.of.the.risks.we.have.discussed.within.the.arena.of.business. operations. are. still. traditionally. mitigated. and. managed. by. reactionary. metrics. and. methodologies.. As. supply. chain. risk. management. unfolds. from.a.concept.into.a.more.mature.discipline,.many.of.the.new.tools,.tech- niques,.mitigation.strategies,.and.metrics.that.we.present.will.become.an. effective.way.to.identify,.assess,.mitigate,.and.manage.operational.risks.

Summary of key points

•. Operational.risks.are.by.far.the.most.frequent.number.of.risk.events,. not.only.for.those.who.manufacture.products,.but.for.service.orga- nizations.as.well..Operational.risks.are.contained.in.each.of.the.four. pillars. of. supply. chain. risk. that. include. supply. risk,. demand. risk,. process.risk,.and.environmental.risk.

•. Operational. risks. cross. several. planning. and. execution. horizons.. The. two. most. prevalent. horizons. are. the. tactical. horizon,. which.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .

146 • Supply Chain Risk Management: An Emerging Discipline

normally. covers. 1–18 months. into. the. future,. and. the. operational. horizon,.covering.0–45 days.into.the.future.

•. Supply.risk.can.be.further.classified.into.supplier.risk,.logistics.risk,. and.fraud,.corruption,.and.counterfeiting.risk.

•. Demand. risk. consists. of. customer. risk,. product. risk,. and. logistics. risk.

•. The. categories. for. the. process. risk. pillar. are. known. or. hard. risks,. unknown. or. soft. risks,. and. chronic. risks. that. can. arise. within. a. company’s.four.walls.

•. The. fourth. risk. pillar,. environment/.ecosystems. risk,. is. probably. the.most.immature.pillar.and.also.contains.known,.unknown,.and. chronic.risk.categories.

•. One. traditional. and. effective. proactive. approach. to. identifying,. assessing,.mitigating.and.managing.operational.risks,.business.con- tinuity.planning,.has.been.around.for.many.years..It.is.still.consid- ered.a.cost-.effective.approach.to.being.prepared.for.and.responsive. to.risk.events,.particularly.operational.risk.events.

•. The. business. continuity. life. cycle. includes. six. stages:. governance,. business.impact.analysis,.risk.assessment,.recovery.strategies,.busi- ness.continuity/.disaster.recovery.planning,.and.test.and.verification.

•. A.tabletop.or.structured.walk-.through.exercise.is.a.paper.evaluation. of. a. portion. of. a. business. continuity. plan. without. the. expenses. or. personnel.resources.associated.with.a.full.test..A.second.type.of.exer- cise,. called. a. component. exercise,. is. usually. performed. during. off-. hours,.tests.a.particular.segment.of.the.recovery.plan,.and.involves. actual.recovery.activities.

endnOteS

. 1.. Accessed.from.The.European.Banking.Authority.(EBA).and.The.European.Bank.for. Reconstruction. and. Development. (EBRD). at. www.eba.europa.eu. and. www.EBRD. com.

. 2.. Accessed.from.www.dictionary.com.

. 3.. RTO. =. Recovery. Time. Objective:. The. maximum. tolerable. time. to. recover. critical. business.functions.and.the.existing.resources.that.support.each.function.

. 4.. RPO.=.Recovery.Point.Objective:.The.maximum.amount.of.data.loss.allowable.

. 5.. The. authors. would. like. to. acknowledge. the. contribution. of. Betty. Barnes. to. this. section.

C o p yr

ig h t ©

2 0 1 4 . T

a yl

o r

& F

ra n ci

s G

ro u p . A

ll ri g h ts

r e se

rv e d .