Until relatively recently, business continuity management for most companies focused primarily on the risks associated with IT failure or the loss of a building. The increasing reliance upon outsourcing in a more global business environment, however, has pushed supply chain risks firmly onto the business continuity agenda.
For many organisations, the supply of raw materials, manufacturing processes, and product storage are now regularly outsourced. Even those functions that were traditionally considered ‘in house’ activities, such as finance, purchasing, internal auditing, HR and occupational health are now considered “outsourceable” activities. In this supply chain-reliant environment, the loss of just a single supplier can have a devastating impact on a company.
The price of failure
One of the largest losses due to a supply-chain failure occurred in March 2000, when a small fire at a Philips semiconductor plant in Albuquerque, New Mexico resulted in a loss of $2.34 billion for Ericsson’s mobile phone division.
Philips was under contract to supply a new generation of mobile phone chips to Nokia and Ericsson, the two mobile telephone companies. On March17, 2000, a small fire broke out at the silicon chip fabricator. While it took less than 10 minutes to put out, the fire had contaminated the factory and as a result production was halted. When Nokia and Ericsson were informed of the fire the following day, they were told that there would be minimal disruption. In fact, the plant took several months to return to full production.
The two companies responded to the crisis in very different ways. Nokia monitored the situation closely, and when they realised they would be short of the chips they required to launch a new range phones, they worked with Philips and other suppliers to establish alternative suppliers. Ericsson, however, did not react to the incident, and several weeks later, when they realised that they became aware of the chip shortage, discovered that all spare production capacity in the market had been taken by Nokia. That year Ericsson sustained a massive loss in their mobile phone division, failed to get a new generation of handsets onto the market, and their market share dropped from 12 percent to 9 percent.
The nature of the supplier
Suppliers by their very nature can be more susceptible to incidents than the organisations which they supply. Often smaller, leaner, providing ‘just in time’ services and in many cases supplying only a single product, these factors amplify the impact which a disruption can have.
It is often the case, particularly with niche suppliers, that their services are being used by a number of different companies. As such, any disruption can have a much more pronounced ripple effect, impacting on multiple organisations. A good example of this occurred during the fuel stoppages of 2001 in the UK, when the water industry suddenly became aware of how over-reliant it was on ICI at Runcorn which produced 70 percent of the chlorine used in water treatment.
An organization should also be fully aware of the risk posed by disruption to second or third tier suppliers in the chain to their ability to continue operating.
In the firing line
The threats to the supply chain are many and varied, as can be seen in the following diagram. The risks can vary from a natural disaster to political instability, to getting caught up in a company dispute.
BS25999 does not effectively deal with supply chain risk. The standard states that accountability for business continuity remains vested within the organisation, that the organisation’s dependency on suppliers should be understood, suppliers should have effective business continuity arrangement in place, awareness programmes may extend to suppliers, and that the suppliers’ business continuity arrangements should be audited. Part 1 section 7.7 provides some information on developing a supplier strategy but it is limited.
Managing the risks
To effectively manage supply chain risks a BCM needs three key pieces of information:
- They should identify the organisation’s critical activities so that they can ascertain the critical suppliers.
- They should ascertain the potential impact of the loss of a supplier by conducting a BIA.
- They should undertake a full risk assessment to understand the potential risks which could affect the supplier.
Only once this information has been gathered can they start to mitigate the supplier’s risks.
A three-pronged approach
The strategy for dealing with supply chain risks should be in three parts. Firstly, the BCM must educate purchasers in how to make “risk aware” purchasing decisions. To do this they must make sure that buyers are aware of which suppliers are critical to the organisation and which are not. Purchasing of non-critical services can be made on a pure commercial basis, but decisions relating to critical suppliers should be risk based. Buyers should be aware of the consequence of the loss of a supplier so they can weigh this against the commercial element of the deal.
A supplier strategy should then be drawn-up detailing these buying strategies that can be used to mitigate supplier risk. These could include: diversification (buying from more than one supplier); asking suppliers to stockpile stock; ensuring that the supplier has excess capacity; and establishing stringent failure to perform clauses.
The BCM should also educate buyers in how to examine the supplier itself and not just the product being supplied. This is usually carried out as part of the tender process, but often without sufficient rigour. In reviewing the supplier, the buyer should consider: the quality of all of the organisation’s products - not just those being supplied; their incident history; key personnel dependencies (is the person who deals with the product liable to move to another organisation?), financial stability, volume flexibility and their business continuity plans.
The BCM is key to reviewing the supplier’s level of business continuity planning as they are best placed to assess it validity and its quality. According to research conducted recently by the BCI: “Where organisations insist on the supplier having a business continuity management plan also, 18 percent are happy to rely on no more than a statement from the supplier; 27 percent ask only to read the supplier’s business continuity plans and a further 27 percent don’t know how the supplier’s plans are verified.”
Secondly, the BCM should ensure that operational staff are fully aware of which suppliers are critical to the organisation, and the potential impact of their failure. All operational personnel should also be trained in incident management so that if there is a failure they can respond quickly and effectively.
The BCM should also encourage staff to closely monitor suppliers to ensure any problems are detected early. Near misses, or any drop in quality should be investigated as they may suggest a more serious problem which can then be dealt with. The BCM should also monitor the media for any negative press relating to the company. A key part of supply chain risk mitigation is recognising the signs early and dealing with them in the proper manner. In the case of Nokia, for example, the company actually increased their market share of the world mobile phone market from 27-30 percent because they became aware of chip shortfall from the Albuquerque fire early and were able to capitalise of Ericsson’s inability to do the same.
Thirdly, the BCM can also play a key role in helping the suppliers themselves improve their business continuity planning. As mentioned previously, suppliers are often much smaller than the organisations which they supply, and may not have a dedicated BCM resource or the necessary skills to implement an effective business continuity strategy. The BCM should therefore work in partnership with their firm’s suppliers to help them develop their BCPs and should then involve them in any exercises or awareness sessions.
Loss of a supplier is major risk, and one which will only increase as organisations continue to extend their outsourcing networks. The BCM can play a vital role in reducing this risk by educating buyers in how to adopt a risk-based approach to selecting critical suppliers, educating operational staff on the risks posed by suppliers, and helping suppliers themselves improve their business continuity strategy.Charlie Maclean-Bristol, MBCI, FEPS, is a director of PlanB Consulting. For more information visit www.planbconsulting.co.uk