Abstract
The COVID-19 pandemic and the ensuing disruptions to global supply chains have brought risk management to the fore. While guidance on risk management is proliferating, an area that is largely untapped is risk measurement. The pandemic has made us realize the criticality of risk measurement and the need to develop a culture of continuous measuring. Based on our interviews with purchasing and supply management (PSM) professionals about how they measure and manage risk, we offer a framework integrating how to rethink risk measurement, how to continuously measure risk, how to translate measurement into action, and how to establish a culture of continuous measuring. It captures a shift in mindset that is needed to truly take risk measurement to the next level. Once this is accomplished, it can help PSM professionals build more resilient supply chains.
Keywords: Risk management, Risk measurement, Global supply chains, Resilient supply chains
1. The need for risk measurement
Triggered by the COVID-19 pandemic, risk management has come front and center for companies as they adapt their purchasing and supply management (PSM) strategies. The dramatic impact of the pandemic's repercussions on supply chains caught many companies offguard, providing an impetus for better preparation and recovery in the future. This has led many governments across the world to take initiative and implement mandates and guidance on how to make supply chains more robust. Examples include The White House's executive order on America's supply chains (Biden, 2021) to make them more resilient (The White House, 2021) and Germany's law for companies to provide better supply chain oversight (Reuters, 2021). The question that arises for companies is then “How can supply chains be made truly more robust and resilient in a post-pandemic world?” And specifically, “How can we sense more quickly when a disruption emerges, and how can we respond more promptly to the disruption?”
While research on risk management is proliferating (Pournader et al., 2020; Uenk and Taponen, 2020), especially also within the PSM realm (e.g., Glas et al., 2021; Lenderink et al., 2022; Meyer et al., 2022) many firms are struggling to think about risks strategically (Kırılmaz and Erol, 2017; Loader, 2015). Within this context, one area still largely untapped is risk measurement (Glas et al., 2021; Hoffmann et al., 2013), which can be challenging due to the intangibility and uncertainty of many risks, particularly for previously unobserved black swan events (Taleb, 2007). The best way to tackle such unknown risks is by measuring on many fronts constantly, with an attitude of measurement engrained in everyone. This is what we refer to as a culture of measuring. We provide guidance on how to build such a culture, since while supply risk management is undoubtedly on every PSM executive's mind, knowledge on how to best measure risks in their broad context is still developing (cf. Hoffmann et al., 2013). Too often risk measurement is a self-serving activity that is merely done for the sake of doing it. This behavior mutes the benefits of risk measurement and its underlying objectives. We attribute these missed opportunities to risk measurement being treated as a stand-alone activity in many firms. With this Notes and Debates article, we intend to offer suggestions on how this can be rectified.
Continuous measuring on all fronts, engrained in a culture of measuring, enables firms to identify and prioritize situations that need immediate attention. It offers objective grounds upon which to make decisions, and enables PSM professionals to be always vigilant and put risks into a context that everyone can identify with. This can help in risks not being forgotten, which can happen especially for those that had not manifested for a long time. Within the context of pandemics, this behavior is illustrated by Dr. Jim Yong, a former president of the World Bank, who noted that “For too long, we have allowed a cycle of panic and neglect when it comes to pandemics: we ramp up efforts when there's a serious threat, then quickly forget about them when the threat subsides” (WHO, 2018). Many companies likely wished that they should have done more before the COVID-19 pandemic, but it is easy to fall back to old behaviors if risks do not manifest (Choi et al., 2020). One notable exception in this regard is H-E-B, a retailer in Texas, whose pandemic response action plan dates back all the way to 2005, as triggered by the H1N1 flu (Solomon and Forbes, 2020).
Given these challenges, this paper calls attention to the development and nurturing of a risk measurement culture, which can serve as a foundation to create more robust and resilient supply chains. We believe that having established this culture can enable companies to respond to disruptions more quickly and directly. Our paper is also a response to the call for a deeper understanding of risks (Knight et al., 2020), which can be accomplished by a culture of measuring, which in turn would enable PSM professionals to “walk the talk”.
Our insights are based on interviews with PSM leaders proficient in supply risk measurement and management, which were conducted as part of a CAPS Research study (Schoenherr et al., 2019). Findings from that study were then complemented by the experiences of the cofounder and CEO of a major risk management software company, who has worked with over 150 supply management executives across 100 companies from various industries. This comprehensive approach enabled us to formulate a broad and practice-informed perspective on risk measurement and management.
Our central arguments are structured around four insights. First, we issue a call to action for PSM professionals to rethink risk measurement. We highlight what risks should be measured at multiple levels (suppliers, sites, parts, products, etc.) across supply chains and their risk sources (financial, quality, cybersecurity, compliance, etc.). Critical here is to be vigilant at all levels. We outline how measuring can help identify, prioritize, and allocate relevant risks, and the level of measurement for each level. In this vein, we also emphasize the need to capture a wide spectrum of supply chain elements. We further make the case for a new approach to incorporate risk exposure in the measurement, which involves evaluating what would happen to a firm's supply chain performance in terms of the potential revenue loss should a risk manifest. Quantifying this exposure is crucial to prioritizing risks and justifying the costs of risk management.
Second, we make the case for continuous risk measurement, recognizing that this is both an art and a science, and that there is no right or wrong way. We illustrate how companies have approached this challenge, with the ultimate objective to ensure supply continuity. We showcase how advances in information technology can be leveraged, and suggest an automated system for analytics based on measurement that can be scaled up to support the entire supply chain ecosystem.
Third, we provide guidance on how to translate measurement into action by prioritizing efforts. We share approaches that have worked well for some of the leading companies. We also discuss how companies have successfully scaled these approaches across supply chains spanning thousands of suppliers and sites, and developed a risk mitigation methodology based on measurement across globally dispersed teams.
Finally, we arrive at creating a culture of continuous measuring. Effective risk measurement and management demand the presence of a measuring culture, which involves a deep understanding of a company's risk exposure and confidence in the way risks are managed. Communication and learning are essential elements to create and nurture this culture, as is a shift in mindset that serves as a foundation to take risk measurement and management to the next level. We report which approaches have been successful for companies to foster this risk measurement culture.
Overall, our message is that a culture of measuring is not about eliminating all risks, but finding an optimal balance across cost efficiency, risk exposure, and resilience. We also stress that a single snapshot of risk is not sufficient, but the continuous tracking of risks is required in coming up with action items. Similarly, benchmarking of risks against other companies is essential to understand the gaps. As such, we lay out how to develop a well-rounded risk measurement methodology and illustrate how it is used in practice. We present approaches for segmenting and classifying suppliers, sites, or parts by their risk exposure and risk score, and discuss the best ways in which the risk measure can be used to drive appropriate actions. Our overall framework for creating robust and resilient supply chains is captured in Fig. 1 , which will be further described in the remainder of the paper.
Fig. 1.
Creating resilient value chains in a post-pandemic world.
2. Literature review
2.1. Risks in purchasing and supply management
Risk captures the likelihood of loss, and within the context of purchasing and supply management, refers to the “loss or interruption of access to raw materials, manufactured goods, capacity, or other key materials, products, or services required by the buying organization to execute its business plans” (Cavinato et al., 2015). Risk measurement and management within a supply management context thus requires the “identification, analysis, and mitigation for what could go wrong within a given process or entity. Options for risk management include acceptance, mitigation, transfer, and control among others” (Cavinato et al., 2015).
Risk impacts on the supply chain are multifarious, with some of the most prominent examples being the earthquake and subsequent tsunami in Japan on March 11, 2011, or the floods in Thailand that same year. In addition to the incomprehensible human tragedies, the impact on supply chains worldwide were significant. For example, HIS Global Insight estimated a loss of about 4 million units of vehicle production due to the tsunami, with the primary damage being experienced at tier-one suppliers of the major carmakers (Congressional Research Service, 2011), and the floods in Thailand were estimated to have affected close to 10,000 plants and more than 650,000 jobs (Reuters, 2011). Most recently, the COVID-19 pandemic has brought to the fore the need to measure and manage the supply chain's inherent risks (van Hoek, 2021), consistent with President Biden's executive order in this regard (Biden, 2021). Other recent risk impacts on the supply chain include the cybersecurity attacks through the SolarWinds hack (Uberti and Nash, 2021), or the blocking of the Suez Canal by one of the largest container ships in March 2021 (Farrer and Safi, 2021).
While these are vivid examples that make the news, risks can come in a variety of shapes and forms, and can include a worker picking the wrong item for an order or specifying the wrong ship-to address. While these risks are not likely to impact supply chain performance significantly, they still lead to unwanted consequences such as missed deliveries. It is thus important to be vigilant of these functional risks, too, since they can easily spiral into something unmanageable. The literature is rich in categorizing risks based on different criteria, such as the source of the risk (e.g., Christopher and Peck, 2004; Rao and Goldsby, 2009; Zsidisin et al., 2004), the organizational level at which the risk manifests (e.g., Ghadge et al., 2012; Ho et al., 2015), or the types of problems they cause (e.g., Rangel et al., 2015). Table 1 presents some of the most prominent categorizations in the extant literature, reflecting the complexity of supply chain risks. This multitude of risks indicates that different approaches may be required to tackle each risk type, and that their measurement is at the core of effectively addressing them.
Table 1.
Risk classifications in the literature.
| Reference | Supply Chain Risks |
|---|---|
| Miller (1992) |
|
| Ritchie and Brindley (1993) | (1) Environment characteristics; (2) Industry characteristics; (3) Supply chain configuration; (4) Supply chain members; (5) Organization's strategy; (6) Problem specific variables; (7) Decision making unit |
| Jüttner et al. (2003) | (1) Environmental risk sources; (2) Network risk sources; (3) Organizational risk sources |
| Harland et al., (2003) | (1) Strategic risk; (2) Operational risk; (3) Supply risk; (4) Customer risk; (5) Asset impairment risk; (6) Competitive risk; (7) Reputation risk; (8) Financial risk; (9) Fiscal risk; (10) Regulatory risk; (11) Legal risk |
| Christopher and Peck (2004) | (1) Supply risk; (2) Process risk; (3) Demand risk; (4) Control risk; (5) Environmental risk |
| Zsidisin et al. (2004) | (1) Design; (2) Quality; (3) Cost; (4) Availability; (5) Manufacturability; (6) Supplier; (7) Legal; (8) Environmental, health and safety |
| Chopra and Sodhi (2004) | (1) Disruptions; (2) Delays; (3) Systems; (4) Forecast; (5) Intellectual property; (6) Procurement; (7) Receivables; (8) Inventory; (9) Capacity |
| Finch (2004) |
|
| Jüttner (2005) | (1) Environmental risk sources; (2) Demand and supply risk sources; (3) Process Risk sources; (4) Control risk sources |
| Wagner and Bode (2006) | (1) Demand-side risks; (2) Supply-side risks; (3) Catastrophic risks |
| Manuj and Mentzer (2008a) | (1) Supply risks; (2) Demand risks; (3) Operational risks; (4) Other |
| Manuj and Mentzer (2008b) | (1) Supply risks; (2) Operational risks; (3) Demand risks; (4) Security risks; (5) Macro risks; (6) Policy risks; (7) Competitive risks; (8) Resource Risks |
| Rao and Goldsby (2009) |
|
| Tummala and Schoenherr (2011) | (1) Demand; (2) Delay; (3) Disruption; (4) Inventory; (5) Manufacturing; (6) Capacity; (7) Supply; (8) System; (9) Sovereign; (10) Transportation |
| Christopher et al. (2011) | (1) Supply risk; (2) Environmental and sustainability; (3) Process and control; (4) Demand |
| Ghadge et al. (2012) | (1) Organizational risks; (2) Network risks; (3) Environmental risks |
| Hoffmann et al. (2013) | (1) Environmental risks; (2) Financial risks; (3) Operational risks; (4) Strategic risks |
| Ho et al. (2015) |
|
| Rangel et al. (2015) | (1) Production flow problems; (2) Relationship problems; (3) Competitiveness problems; (4) Global problems; (5) Core competencies problems; (6) Problems due to lack of control over the external environment; (7) Regulatory, legal and political problems; (8) Financial market problems; (9) Financial capacity problems; (10) Demand forecast problems; (11) SC inbound problems; (12) Transport system problems; (13) Information system problems; (14) Cultural problems; (15) Strategic problems; (16) Production capacity problems; (17) Infrastructure problems; (18) Customer services problems; (19) Organizational problems |
| van Hoek (2021) | (1) Supply; (2) Demand; (3) Manufacturing; (4) Transportation; (5) Process; (6) Control; (7) Environmental; (8) Financial |
2.2. The increasing importance of supply chain risk measurement and management
Supply chain risk management and associated measurement are more important now than ever before. While risk management in business dealings has always been of concern, the importance of such management has reached an entirely new dimension with the advent of modern supply chain management (Blome and Schoenherr, 2011; Heckmann et al., 2015). Contributing factors involve globalization, outsourcing, stricter regulations, increased economic volatility and uncertainty, shorter product lifecycles, increasing customer demands, greater public scrutiny of corporate behavior, and the impact of natural disasters and geopolitical tensions and conflicts. Risk measurement and assessment have, therefore, gained heightened criticality. According to Deloitte's most recent chief procurement officer survey, procurement risk is the second-most important concern, and the importance attributed to it has never been higher (Umbenhauer and Younger, 2017).
Despite these elevated risks, some industries and organizations are making choices that exacerbate their risks. A report released in June 2018, for instance, notes that within the European retail sector, 10 percent more buyer relationships in the first quarter, when compared to the previous quarter, were with suppliers located in high-risk countries. In addition, reliance on key suppliers yielded a dependency of more than 75 percent (Russel, 2018). This can put companies in significant jeopardy: the seminal study by Hendricks and Singhal (2005) on the impact of supply disruptions on a company's performance reported price drops of 10 percent or more upon the announcement of such disruption in the news; operating income even fell by more than 30 percent if the disruption was caused by a supplier. The criticality for appropriate risk measurement and effective management has been increasing ever since (Umbenhauer and Younger, 2017).
While supply risk management is undoubtedly on the mind of every supply management professional, how to best measure such risks in their broad context is still largely lacking—just consider the challenges associated with the sheer multiplicity and interrelatedness of risks at various levels triggered by the COVID-19 pandemic. These challenges are exacerbated by companies’ greater dependence on suppliers and the move toward leaner supply chains. In addition, the new, digitally-networked economy has presented us with a whole host of additional risks (Albinson et al., 2016). Because companies share more data, technology, and infrastructure, they also share more risks. As a consequence, disruption has become a constant concern; disruptions in terms of technologies, business models, and ecosystems must be anticipated and managed. Different approaches are thus needed over and above what has been applied in the past—risk management “as usual” is not sufficient anymore. For example, reputation risk has taken on an entirely new dimension as, within minutes, the public perception of a company can be altered via social media, further heightening the criticality of successful risk measurement and monitoring.
2.3. Approaches to risk measurement
Various supply chain risk management approaches have been discussed in the literature (Table 2 ). These approaches have been enhanced by modern tools like supply chain finance, which provides some ability to mitigate risks associated with commodity price volatility (Pellegrino et al., 2019), or innovative ways to involve supply chain intermediaries. Such intermediaries can for instance help with the management of sustainability risks associated with information asymmetry and goal incongruence within buyer-supplier dyads (Cole and Aitken, 2020).
Table 2.
Approaches and tools for risk management.
| Reference | Risk management approaches and tools |
|---|---|
| Miller (1992) |
|
| Ritchie and Brindley (1993) | (1) Risk insurance; (2) Information sharing; (3) Relationship development; (4) Agreed performance standards; (5) Regular joint reviews; (6) Joint training and development programs; (7) Joint proactive assessment and planning exercises; (8) Developing risk management awareness and skills; (9) Joint strategies, (10) Inter-partnership structures; (11) Relationship marketing initiatives |
| Jüttner et al. (2003) | (1) Avoidance; (2) Control; (3) Co-operation; (4) Flexibility |
| Christopher and Peck (2004) | (1) Supply chain (re-)engineering; (2) Supply chain collaboration; (3) Agility; (4) Creating a supply chain risk management culture |
| Zsidisin et al. (2004) | (1) Formal risk assessment process; (2) Quality; (3) Supplier improvement; (3) Supply interruption |
| Chopra and Sodhi (2004) | (1) Add capacity; (2) Add inventory; (3) Have redundant suppliers; (4) Increase responsiveness; (5) Increase flexibility; (6) Aggregate or pool demand; (7) Increase capability; (8) Have more customer accounts |
| Jüttner (2005) |
|
| Sheffi and Rice (2005) | (1) Vulnerability maps; (2) Redundancy; (3) Flexibility; (4) Control systems; (5) Culture |
| Tang (2006) | (1) Supply management; (2) Demand management; (3) Product management; (4) Information management |
| Manuj and Mentzer (2008a, 2008b) | (1) Avoidance; (2) Postponement; (3) Speculation; (4) Hedging; (5) Control; (5) Security; (6) Transfer/share; (7) Security |
| Thun and Hoening (2011) |
|
| Christopher et al. (2011) | (1) Network (re-)engineering; (2) Collaboration; (3) Agility; (4) Creating a risk management culture |
| Ghadge et al. (2012) | (1) Proactive; (2) Reactive; (3) Holistic |
| Hoffmann et al. (2013) | (1) Risk monitoring; (2) Risk mitigation |
| Ho et al. (2015) | (1) Risk identification; (2) Risk assessment; (3) Risk monitoring; (4) Risk mitigation |
| Chang et al. (2015) | (1) Redundancy-dominant strategy; (2) Flexibility-dominant strategy; (3) Combine redundancy and flexibility; (4) No action |
| Fan and Stevenson (2018) | (1) Risk acceptance; (2) Risk avoidance; (3) Risk transfer; (4) Risk sharing; (5) Risk mitigation; (6) Risk monitoring |
| van Hoek (2021) | (1) Reduce reliance on single/few factories; (2) Ensure multiple, flexible and alternative sources; (3) Include near and local sourcing in the supply chain; (4) Inventory buffering; (5) Active information sharing throughout the supply chain; (6) Use information technology to improve visibility into demand and transparency of inventory; (7) Use event management systems and leading indicators; (8) Focus on ensuring supply and collaboration with strategic suppliers; (9) Negotiate savings with selected suppliers only |
| Choudhary et al. (2022) | (1) Fuzzy Sets; (2) Analytic hierarchy process (AHP + ANP); (3) Failure Mode and Effect Analysis (FMEA); (4) Bayesian Networks; (5) Conditional Value at Risk; (6) Grey theory; (7) Interpretive structural modelling (ISM); (8) Delphi; (9) TOPSIS; (10) Data Envelopment Analysis (DEA); (11) DEMATEL; (12) Matrix; (13) MICMAC; (14) Critical analysis; (15) Fault Tree Analysis; (16) Mean–Variance |
Most risk measurement approaches utilize one or several parameters to describe the risk, such as impact and probability. In our subsequent brief review of these parameters, we rely on the framework developed by Choudhary et al. (2022), who, as part of their comprehensive literature review on supply chain risk assessment, identified these risk decision-making parameters and integrated them into a common framework (Fig. 8 in Choudhary et al. (2022)). Table 3 , which is also based on the review of Choudhary et al. (2022), briefly describes these parameters and provides illustrative references.
Table 3.
Risk parameters (adapted from Choudhary et al., 2022).
| Parameter | Brief Description | Illustrative References |
|---|---|---|
| Impact | The severity or intensity of a risk's impact on company performance | Costantino and Pellegrino (2010); Di Mauro et al. (2020); Glas et al. (2021) |
| Probability | The likelihood with which a risk will occur | Kara et al. (2020); Meyer et al. (2022); Tummala and Schoenherr (2011) |
| Detectability | The likelihood with which risks can be uncovered before they manifest | Kara et al. (2020); Meyer et al. (2022); Padhi and Mohapatra (2011) |
| Exposure | The potential negative impact on a firm's performance measures | Foerstl et al. (2010); Montgomery et al. (2018); Roehrich et al. (2014); Simchi-Levi et al. (2014) |
| Avoidance | The ease and/or practicability with which risks can be avoided | Caniëls et al. (2018); Ma et al. (2021); Malacina et al. (2022) |
| Duration | The length of time a risk persists, potentially also including the recovery time | Simchi-Levi et al. (2014); Tucker and Daskin (2022); Wieland and Durach (2021) |
| Cost | The cost to predict, prevent, and/or recover from risks | Meyer et al. (2022); Micheli et al. (2009); Simchi-Levi et al. (2014); |
| Expected utility | The benefits associated with taking greater levels of risks | Kaufmann et al. (2012); Qazi et al. (2018); Schniederjans and Khalajhedayati (2021) |
One of the most frequently used measures to assess risks is their disruptive impact on company operations, which refers to the risk's severity or intensity. It has also been described as the significance of the loss, which can be reduced by robustness and resilience management (Glas et al., 2021). These can include the pursuit of a multi-sourcing strategy (Costantino and Pellegrino, 2010) or the keeping of safety stock (Di Mauro et al., 2020). Since it can be difficult to approximate the monetary impact of a disruption, a risk's impact can also be assessed on a subjective scale ranging for instance from ‘negligible’ to ‘catastrophic’.
Risk probability assesses the likelihood with which a risk will occur. Examples within the PSM context include the probability of a supplier encountering quality or delivery challenges. Similar as with risk impact, since quantifying a risk's probability can be challenging, it has often been assessed on a subjective scale ranging for instance from ‘very improbably’ to ‘very probable’ (Hallikas et al., 2004).
Risk detectability refers to the likelihood with which a risk can be uncovered before it manifests or becomes more severe. Examples within the PSM realm include the detection of unethical behavior by PSM employees, collusion among suppliers, or impending quality problems. Just like with a risk's impact and probability, detectability is generally assessed on a subjective scale, ranging for instance from ‘not detectable at all’ to ‘highly detectable’.
Risk exposure captures the degree and form of impact a risk can have on a company's performance, for instance in the form of negative publicity or reputational impact. As an illustrative example within the PSM context serve risks associated with a supplier's sustainability (Foerstl et al., 2010), and the degree to which this supplier is potentially going to expose the firm to these risks (Simchi-Levi et al., 2014).
Risk avoidance refers to a strategy that purposefully does not engage in actions that could potentially increase the risk of the company. Within the PSM realm, this could be in the form of multi-sourcing, geographic diversification, or other means that would decrease the potential dependency on a supplier (cf. Ma et al., 2021).
Duration refers to the length of time a risk persists, which can also include the recovery time. This time to recovery can be critical, since only then would a supplier be fully functional again. For suppliers on which a firm is highly dependent on, contractual safeguards may be put in place that would guarantee prioritized deliveries as the supplier is building up its full functionality again; similar contracts ensuring prioritized treatment in case of disruptions can be negotiated with back-up suppliers (Simchi-Levi et al., 2014).
The cost parameter describes the expense associated with predicting, preventing, and/or recovering from risks. The cost for predictive and preventive measures needs to be weighed against the potential recovery cost, to determine whether it is worthwhile from a cost perspective to engage in risk mitigation.
Related to the cost parameter is the expected utility, which refers to the benefits that may be associated with taking more risks, true to the saying “high risks—high rewards”. Judging when the expected costs in a sourcing decision exceeds the expected benefits is thus a difficult task that PSM professionals need to make (Kaufmann et al., 2012).
The aforementioned risk parameters have been integrated in a range of methodologies. In our following discussion of some of the most prominent methodologies, we rely on the approaches/techniques as identified and critically analyzed by Choudhary et al. (2022) in their review of supply chain risk assessments, and illustrate the application of these methodologies within the PSM realm. Table 4 , which is also based on the review and methodologies identified by Choudhary et al. (2022), briefly describes these methodologies and provides illustrative references.
Table 4.
Methodologies for risk measurement (adapted from Choudhary et al., 2022).
| Methodology | Brief Description | Illustrative References |
|---|---|---|
| Fuzzy logic | Assessment of risks through the modeling of humans' logical reasoning, accounting for uncertainty by “degrees of truths” | Aqlan and Lam (2015); Lee (2017); Pournader et al. (2016) |
| Analytic Hierarchy Process (AHP) | Assessment of the relative importance of each risk, together with an assessment of how likely the risk would manifest with each alternative (e.g., supplier) | Bruno et al. (2012); Schoenherr et al. (2008); Viswanadham and Samvedi (2013) |
| FMEA (Failure Mode and Effects Analysis) | Assessment of failures modes based on impact severity, likelihood of occurrence, and detectability. | Giannakis and Louis (2011); Liu et al. (2013); Tummala et al. (2014); Tummala and Schoenherr (2011) |
| Bayesian statistics | Assessment of risk parameters that have a random probability distribution based on beliefs, with the distribution being updated based on experience | Lawrence et al. (2020); Van Poucke et al. (2016); Zheng and Zhang (2020) |
| Grey theory | An approach that overcomes the vagueness of individual assessments, especially when they need to be made with numerical values | Chand and Tarei (2021); Rajeh and Ravi (2015); Rao et al. (2017) |
| Interpretive Structural Modeling (ISM) | An approach that allows the assessment of risks by taking into account their interdependencies | López and Ruiz-Benítez (2020); Pfohl et al. (2011); Venkatesh et al. (2015) |
Specifically, to account for the uncertainty inherent to risk, fuzzy logic has great potential to be applied in the PSM domain. For instance, while fuzzy logic has been applied more generally for supplier selection decisions within the PSM context (Wu and Barnes, 2011), it has also more specifically been used to determine resilient supply portfolios under supply failure risks (Lee, 2017). This seems prudent, due to the associated subjectivity inherent to risk severity and probability ratings (Ma and Wong, 2018), as also noted above. As such, fuzzy logic accounts for vague or imprecise information by “degrees of truths”, rather than restricting itself to a binary choice (true or false).
The Analytic Hierarchy Process (AHP) has become one of the most frequently-used methodologies to facilitate complex supplier selection decisions (Bruno et al., 2012; Wetzstein et al., 2019; Wu and Barnes, 2011). With this approach, the relative importance of risks can for instance be developed, together with the prevalence of each risk for each alternative. With the PSM context, this can be a supplier or a supply chain (Schoenherr et al., 2008). If risk interdependencies need to be considered, a modified approach in the form of the Analytic Network Process (ANP) can be used (Ramkumar et al., 2016).
FMEA (Failure Mode and Effects Analysis), which dates back to the 1940s, is an approach with which potential failures in products, services, or processes can be identified with the objective to then redesign them so that the failure does not occur (ASQ, 2022). Using this structured method, failures can be assessed based on their severity, probability of occurrence, and detectability. Within the PSM context, this was for instance done by Giannakis and Louis (2011) for estimating the probability of a disruption to become reality. Multiplying the scores obtained for these three dimensions can also provide a risk priority number (RPN), which helps in indicating the importance with which the potential failures should be addressed. The dimensions of severity and occurrence probability can also be plotted on so-called heat maps or risk grids, creating a nice graphical illustration that highlight risks that are of most immediate need to be addressed.
Bayesian statistics assume that parameters are random and can be described with a probability distribution based on beliefs. Through experimentation, these parameter values can be updated, which is useful within the context of risk management as the likelihood of events is not necessarily know with great precision, but can be updated based on experiences made (Choudhary et al., 2022). Within the PSM realm, Bayesian statistics were for instance used to assess supply risk parameters (Zheng and Zhang, 2020), or to model supplier vulnerability to severe weather risk (Lawrence et al., 2020).
The vagueness inherent to risk measurement is also accounted for by grey theory, which can consider information that is only partially known (Bruno et al., 2012). Grey theory has been applied within the PSM risk measurement realm together with other approaches, such as AHP (Bruno et al., 2012) or DEMATEL (decision making trial and evaluation laboratory), with the latter being an approach to evaluate interrelationships between decision variables (Chand and Tarei, 2021).
Interpretive structural modeling (ISM) provides a similar mechanism to consider interdependencies between risks by leveraging expert knowledge via a structured and iterative learning process López and Ruiz-Benítez (2020). Through the approach, complex mental models can be translated into well-defined hierarchies. Within the PSM context, ISM was used for instance to identify and understand the interdependencies among supply chain risks at different supply chain tiers (Pfohl et al., 2011).
2.4. A new approach to risk measurement
As is evident from the review in the prior sections, PSM has been faced with a continuously increasing number of risks (section 2.1), which makes their measurement and management so critical (section 2.2). This is also why there have been an abundance of risk measurement approaches, considering a multitude of parameters integrated in a variety of methodologies (section 2.3). Based on these valuable foundations, one could now argue that nothing further is needed. We however believe that what is still missing in many companies is a culture of measuring.
A culture of measuring refers to a wholistic and integrated approach to risk measurement, which is reflected in a mindset where risk measurement is not considered as a self-serving or one-time task, but where risk measurement influences supply management professionals’ every action. This is not to say that every single decision should be preceded with a comprehensive risk measurement exercise. Instead, while risk measurement should always be on the minds of PSM professionals, their experience and intuition should determine the degree of rigor and extent with which risk measurement needs to be undertaken for specific decisions. This is where the culture of measuring comes in, which has as its objective to develop this intuition that enables PSM professionals to make effective decisions. Developing a culture of measuring commences with rethinking risk measurement, recognizing how to continuously measure risk, and translating the measurement into action, which then culminates in a culture of continuous risk measurement. We describe in the remainder of this article on how this can be accomplished.
Why is this culture of measuring needed? Companies have been struggling with determining the best measures to gauge risks in their environment, which especially comes to the fore when companies are caught off guard by an unexpected disruption (e.g., Blome and Schoenherr, 2011). In addition, since most measures are inherently backward-looking, or at least rely on past experiences to gauge future events, this measurement can never be perfect. Further, despite significant advances in risk management, most companies suffer from at least one supply chain disruption per year (Alcantara and Riglietti, 2015). This likely stems from supply risk management often being poorly understood, which, we suggest, may be due to the lack of commonly accepted metrics, the lack of applicable measurement models, and the difficulty to communicate the measures effectively to senior leadership. We therefore make the case in this paper for establishing a culture of measuring.
Part of developing a culture of measuring also implies that risk measurement and management approaches are integrated within the structure of the firm and its supply base (cf. Tummala and Schoenherr, 2011), tapping into the notion of a “risk culture” in the supply chain ecosystem (Christopher and Peck, 2004; Christopher et al., 2011). Appropriate supply base structures are thus required to effectively address the risks identified. This speaks to the importance of integration and associated capabilities in the supply base (Schoenherr and Swink, 2012), which is also evident within the context of measuring and managing supplier innovation (Yan and Dooley, 2017).
We emphasize that this perspective does not discount the traditional approaches to risk measurement, some of which have been reviewed earlier. Instead, we suggest that they need to be viewed in a broader context. Taking this viewpoint, they can serve as a foundation to support an integrated culture of measuring. We suggest that this is needed, since what makes supply risk measurement in our current world so challenging is that it has become a moving target as new risk issues are constantly emerging.
We suggest that these trends, developments, and advances necessitate a new approach to risk measurement that offers a foundation for delineating opportunities. This makes our paper both relevant and timely. We, therefore, propose the nurturing of a risk measurement culture, and, in order to move towards it, we offer guidance on how to rethink risk measurement, how to continuously measure risk, how to translate measurement into action, and how to eventually then establish a culture of continuous measuring.
While the changing supply management landscape is the source for many of these risks, there are also new opportunities to identify, measure, prioritize, mitigate, and manage risks today. Consider, for instance, the leveraging of increased computing power, global data, and real-time predictive data analytics (Schoenherr and Speier-Pero, 2015). Deloitte anticipates the power of cognitive technologies to augment human decision-making related to risks, leveraging pervasive controls at every stage to monitor and manage risks in real-time (Albinson et al., 2016). We view these advances as essential for establishing an effective risk measurement culture. The Deloitte study also positioned the behavioral sciences to provide insights into risk perceptions and decision-making, and highlighted the role of risk transfer via, for instance, insurance, contracts, and novel financial instruments, which is again based on measurement that can help identify those risks that should be transferred. Integrating these technological advances and leveraging them for enhanced risk measurement (and knowing when and how to use them), we believe, necessitates a culture of measuring.
Therefore, it is not sufficient for supply management to just gradually evolve with these emerging realities. What is needed is for companies to proactively measure and manage risk, to be at the forefront of their industries, and to push the boundaries of what is currently being done—all of this can be enabled by a culture of measuring. This is also indicated in another study by Deloitte (Umbenhauer, 2013), which called on PSM to transform from merely applying risk management programs to becoming the “arbiter of risk,” proactively anticipating, measuring, and sensing multi-tier risks. We suggest that this transformation hinges on a culture of risk measurement.
3. Research approach
The paper relies on research conducted as part of a larger study commissioned by CAPS Research (Schoenherr et al., 2019), which involved semi-structured interviews with 18 PSM executives from 13 companies in 2018. Participating companies were Fortune 500-type companies and were selected based on their active risk management and measurement approaches. Table 5 provides more detail about the interviewees, and Appendix 1 includes the interview protocol. Interviews ranged between 30 and 90 min and were recorded with the permission of the interviewee. In addition to addressing the questions, interviewees provided supporting documents, such as risk management presentations and frameworks. Interviews were transcribed verbatim and coded promptly after data collection. The coding emerging from the interviews allowed us to gauge data saturation as more interviews were conducted. We consider saturation accomplished, as no new significant insights emerged from the last few interviews. Thus, we feel confident that best practices in supply chain risk measurement and management have been captured comprehensively.
Table 5.
Study participants.
| Company | Industry | Participants |
|---|---|---|
| 1 | Energy | Director Strategic Planning |
| 2 | Technology | Manufacturing & Supply Risk Manager Risk Manager Risk Manager |
| 3 | Manufacturing | Manager, Enterprise Risk Management |
| 4 | Banking | Chief Procurement Officer & Financial Operations Officer Head of Strategic Sourcing & Category Management |
| 5 | Energy & Automation | Senior Supply Chain Management Consultant |
| 6 | Technology | Vice President Worldwide Procurement & Logistics Manager Supply Chain Responsibility |
| 7 | Manufacturing | Vice President, Global Supply Chain Management |
| 8 | Oil Refining | Director, Procurement Senior Manager, Procurement Operations |
| 9 | Shipping & Logistics | Manager, Supply Chain Management Strategies |
| 10 | Banking (public) | Head of Governance & Vendor Management |
| 11 | Oil & Gas | Regional Director, Purchasing and Supply Chain Management |
| 12 | Global Non-profit Organization | Chief Procurement Officer |
| 13 | Furniture | General Manager, Corporate Procurement |
Data analysis was supported by a software tool called Atlas. ti. We coded the interviews and supporting documents in three stages: (1) open coding, which involved identifying the constructs directly used by the interviewees, resulting in 341 distinctive codes; (2) grouping of the codes into families representing central topics of the research; and (3) axial coding, which was used to identify relationships among the codes (such as characteristics, typologies and possible causal relationships). This final stage involved a combination of inductive and deductive approaches.
The insights derived from these interviews were enhanced by the cofounder and CEO of a leading cloud provider of supply chain risk management (who is part of the author team), relying on experiences gathered with 150 supply management executives across more than 100 companies, private and public, from various sectors. Most of these companies are in the life science/pharma (27%), healthcare (19%), high tech (13%), and semiconductor (9%) industries, and include industry leaders like Amgen, GM, and EMC.
4. Results
4.1. Rethinking risk measurement: a call to action
4.1.1. Being vigilant at all levels
Risk is defined as the exposure to a chance of loss or damage. Measuring and managing risks in the supply management context involves the “identification, analysis, and mitigation for what could go wrong within a given process or entity” (Cavinato et al., 2015). Risks come in all shapes and sizes; it can be a worker picking the wrong item for an order, a bridge collapse near a supplier plant, an E. coli outbreak in a food supply chain (Taylor, 2018), or a pandemic. The magnitude of their impact may vary from an isolated incident to the breakdown of the entire supply chain. Common to all risks is that they lead to undesirable consequences. It is thus vital for PSM professionals to be vigilant of all kinds of risks, since even small risks can spiral into something much larger. Appropriate risk measurement, assessment, and monitoring against identified metrics are instrumental for effective risk management.
Based on the insights derived from our interviews, we developed a taxonomy that places risks into seven broad categories, ranging from the specific to the generic. Table 6 presents our matching of the various risk types to the seven risk categories.
Table 6.
A taxonomy of risks.
| Risk Category | Risk Type | Definition, Illustrations, and Measurement Examples |
|---|---|---|
| Supplier Performance Risks | Supplier financial risk | Risk associated with the financial health of the supplier, which could result in bankruptcy, causing supply interruptions and other potential losses. “They said all the right things; they had all the right equipment; but nobody ever understood what their financial position was.” |
| Supplier quality risk | Risk associated with the quality of products and/or services provided by a supplier. “… we're making sure that before [the product] gets on the boat, before it gets on its six-week journey, that we're pretty certain that the product is of good quality.” |
|
| Contract risk | Risk of the supplier not fulfilling its responsibilities and obligations as stipulated in the contract. “… we always have to be monitoring and making sure … that the suppliers are living up to … the scope of work that we have with them, as well as the other obligations under the contracts.” |
|
| Supplier capacity risk | Risk of the supplier not having sufficient capacity to satisfy demand. “We're trying to get more protection when supplier capacity may be running out, …you have to rely heavily on the supplier to provide you that information.” |
|
| Supplier delivery risk | Risk of the supplier failing to deliver the product and/or service on time. “For instance, delivery performance measures (on-time delivery parts per million) and delinquent orders are universal metrics.” |
|
| Corporate Social Responsibility (CSR) and Compliance Risks | Social responsibility risk | Risk associated with ethical violations by suppliers, including human rights issues, anti-slavery, corruption, conflict minerals, land grabbing, and conflict of interest. “You've got social risks, human rights, modern slavery … local content is a big challenge for us especially when you operate in countries where we're trying to develop local supply chains.” |
| Health and safety risks | Risk associated with contractor infringements to health and safety regulations in the workplace. “When it comes to suppliers, we do have processes for managing near misses … when it comes to safety, which of course, as a utility that does a lot of construction … that's priority number one. It's got to be fundamental table stakes for everything that we do.” |
|
| Reputation/brand risk | Risk associated with negative effects on the brand or reputation of the buying firm caused by supplier practices. “It's a little bit harder for people to see the impact of reputational risk if they've never seen it before. So I'm constantly trying to make the case … [for] beefing up our efforts around social responsibility and environmental responsibility … so [a supplier reputation issue does not] … disrupt our supply … [or] directly impact our product.” |
|
| Environmental risk | Risk associated with supplier's actions that cause environmental degradation and/or natural resource depletion. “Waste, air, water … certainly something we have to manage and support.” |
|
| Supply Market Risk | Category risk | Risk associated with a specific supply category, which for instance could include multiple suppliers at different tiers in the supply chain. “We have a category risk management approach. So, if we do a construction project we have developed specific due diligence measures and risk management templates and checklists for construction.” |
| Raw material risk | Risk associated with specific raw materials, which can include global shortages, changes in power dynamics, and competition from other industries. “There are also specialized types of risk identification and assessments … that focus heavily on materials, especially critical materials that are specialized.” |
|
| Logistic risk | Risk associated with the transportation and storage of products across the supply chain. “… shipping risks we have in the United States come with our own ports and unions and longshoremen and stuff …” |
|
| Technology Risks | Cybersecurity risk | Risk associated with the theft and damage to the buying company's or to the suppliers' hardware, software, or information, including possible disruption to their operations. “Emerging risks relative to data loss prevention is very important for us … there are only two types of companies in the world: those that have had a data breach and those that have not discovered yet that they've had a data breach.” |
| IP risk | Risk involving a potential loss of intellectual property (IP). “… there are very robust, restricted-use NDAs in place … it protects both companies, but it also enables us to protect our manufacturing process and the output quality.” |
|
| Geopolitical Risks | Country risk | Risk associated with doing trade with suppliers in a particular country. “For country risk we evaluate country rating … through Coface.” |
| Labor-related risks | Risk associated with labor disputes that could disrupt the production and delivery of products and services. “Even in the United States I think it's the Los Angeles port which is notorious for strikes.” |
|
| Legal risk | Risk that exposes the buying firm to potential legal actions or disputes in international trade. “… we measure the company's legal exposure related to the relationship with the supplier.” |
|
| Domestic risk | Risk associated with changes in policy in the domestic market of a buying company that can affect its ability or costs of sourcing, such as changes in tariffs, trade restrictions, and trade sanctions. “… fortunately, the government decided to exempt Canada and Mexico from the steel and aluminum tariffs but we're still buying a lot of very expensive electrical steel out of China, and we are right now spending a lot of time trying to figure out, what can we do.” |
|
| Macro-economic Risk | Currency risk | Risk associated with currency volatility that might negatively affect the company's profitability. Also termed foreign exchange risk or FX risk. “We get an alert on D&B; we use index data for currency risk volatility; we use indexes in that calculation.” |
| Inflation/volatility risk | Risk associated with inflationary pressure or swift changes in the price of raw materials and labor in source countries. “Back in 2015 we had a significant run-up on a key raw material, in this case steel, and we had to use hedge pricing along with a multiple sourcing strategy to mitigate its impact.” |
|
| Natural Disaster Risks | Risk associated with disruptions affecting the operation of suppliers or the flow of products, due to major natural catastrophes such as earthquakes, tsunamis, tornados, hurricanes, fires, and floods. “… we're starting with our sourcing mostly looking at [geography] to enhance our ability to look at risk.” |
The taxonomy represents a formidable way for companies to embark on their risk measurement journey. Specifically, the risk categories and types, and the corresponding definition and examples, can serve as a template for PSM executives to identify and narrow down the risks that are most pertinent to their contexts. Importantly, the specific quotes offer illustrative guidance on how the various types of risks can be measured, demonstrating that there is no one best way to measure a particular risk. It is the specific context, importance, and risk appetite of the company, in addition to an individual's background and expertise in managing a commodity, supplier, or region, that can influence to what extent risks are measured. The taxonomy is not meant to be exclusive but rather a starting point for companies to develop their own frameworks. A category that certainly needs to be added is the risk emanating from pandemics and other health-related disruptions. While the companies in our sample did not indicate having this category, one company that has been lauded for its planning and response to the COVID-19 pandemic is the retailer H-E-B (Solomon and Forbes, 2020).
4.1.2. Identifying and allocating relevant risks
We observed two main approaches companies use to organize risks: a generic process to identify all potential risks that might affect the company and a more focused supplier/commodity-specific effort across the supply chain. The generic process involves a series of “risk ID” meetings, in which stakeholders (internal and external) and different functional experts (supply chain functions, finance, information technology, sales, and marketing) brainstorm relevant risks. This cross-functional approach ensures a diversity of thoughts and guards against groupthink (Bruce, 2014). To make the case for a risk, stakeholders may present prior exposure to that risk or “near misses,” which would then lead to the articulation of potential metrics to assess the risk a priori and a posteriori. Even though quantifiable risk measurement is beneficial, more frequently, risks can only be articulated via individuals’ subjective judgments, based on their knowledge of the business context. The cross-functional setting is particularly valuable because different perspectives are offered on the same risk, enabling a holistic assessment.
These risk ID meetings are also used to tag, classify, and allocate risks to individuals or business functions, as well as to capture the generated information in a “risk register.” The risk register is a database of risks that might affect the company, together with notes from the discussions, including potential risk measures and individuals who should be involved in addressing these risks. Once approved, the risk register is used to monitor and manage the risks. As risks are dynamic, it is essential for PSM professionals to review and update the risk register, especially when there are changes in the company's supply chain strategy.
A more focused supplier/commodity-specific effort for risk identification can be part of the regular procurement process. As such, risk considerations and risk measurement should be an integral part of supplier evaluation and selection. Risks should include both supplier-specific risks (e.g., capabilities and financial strength) and their specific context (e.g., geographic location and political stability). Once a supplier has been successfully on-boarded, its performance and behavior need to be continuously monitored, including any identified and emerging risk areas.
4.1.3. Capturing a granular spectrum of supply chain elements
Measuring risks associated with suppliers' overall capabilities, financial health, and geographic location are important. Nonetheless, this is not sufficient—a more granular approach is needed. Specifically, part-level risks should be assessed, which captures whether the part is single- or multi-sourced. The various risks should also be “inherited down” to more granular levels. For example, a part purchased from a supplier should be inherited down from a financial health score and other relevant scores from the supplier's overall scorecard, offering an integrated perspective.
Similarly, risks measured at granular levels should roll up to a higher level. For example, all single-sourced parts purchased from a supplier should roll up to measure that supplier's overall sourcing risk (i.e., a supplier providing a large number of single-sourced parts should have a higher risk score). Likewise, a supplier with strong financial health and sites in low-risk locations might still experience frequent quality problems or have late delivery performance. In this case, the sites' location risk scores should be rolled up to compute an overall supplier location risk score, and delivery and quality performance should be rolled up to an overall supplier risk score. This can be effectively accomplished via automated systems that are continuously updated based on specified events.
4.1.4. Making the case for risk exposure
We further advocate a new approach that incorporates risk exposure to the risk measurement methodology. Measuring exposure involves evaluating what would happen to supply chain performance in terms of a revenue loss given the disruption to a supplier, site, or part/raw material. Consider a product being comprised of various materials and parts (i.e., a bill of material)—losing just one of these inputs could impact the company's ability to complete the product. This causes a loss of revenue until the part delivery can resume.
We suggest two methodologies to compute revenue impact as a proxy for risk exposure: (1) considering the annual revenue of the product, or (2) pursuing a more detailed approach considering the expected time to recovery, adjusted for inventory or substitutability of part or site. The latter is more accurate since materials may be substitutable and recovery time may be short. This approach, however, requires a subjective estimation of recovery time, potentially introduces user bias, and is computationally intensive since it needs to capture dynamic variables such as inventory depletion rates and supplier-supplier relationships/dependencies. In the interest of cost efficiency and scalability, most companies quantify risk by estimating quarterly, six month, or annual revenue impacts. Revenue impact is one of the most important tools to help leadership focus, set priorities, and develop a roadmap for risk mitigation and action.
4.2. Continuous risk measurement
4.2.1. The art and science of measuring risk
Measurement is central to evidence-based management and, therefore, for effective risk management. We, however, recognize the difficulties in obtaining accurate and reliable measures for all risks. Common challenges include data availability and quality (Nagle et al., 2020), credibility of sources, possible risk interactions, and measurement costs. Some risks, such as supplier quality and delivery, are relatively easy to measure using objective data. Others, such as brand, environmental and social sustainability risks (Foerstl et al., 2010), not to mention risks emanating from black swan events, are more complicated to measure, and objective data would be difficult to obtain.
For some risks, the term measurement might also be inappropriate, especially for risks that are assessed on a more implied basis, such as risks associated with political instability and corruption (see for instance the corruption perception index by Transparency International (2021)). While metrics are available and values can be assigned, they serve at best as proxies for underlying risks. As one interviewee noted, the term risk assessment may be more suitable for denoting the subjective nature of the task. The degree of measurability appears to be an important factor in deciding how risks are interpreted and how they underpin decision-making, especially going forward in our post-pandemic world.
We observed a range of risk measurement practices. While some interviewees follow a very structured approach, having tailored risk management templates for specific suppliers, others do not. In addition, while some companies combine objective and subjective approaches, others prefer to focus only on objective data. The exclusive reliance on objective metrics is appealing; it may, however, expose companies to overlook important risks. For instance, corporate social responsibility (CSR) risks, such as the use of child labor or modern slave labor by suppliers, are difficult to quantify reliably (cf. Arogyaswamy, 2017). Some subjective components should thus always be part of the evaluation. An additional layer of complexity for supply chain risk measurement is a company's ability to measure risks beyond tier 1 suppliers (Choi et al., 2020). While PSM professionals in our study see value in gaining multitier visibility of supply chain risks, they also acknowledge that this is difficult to do.
Risk monitoring is central to risk management. However, monitoring risks can also consume valuable management resources. For this reason, the frequency of monitoring should be carefully considered and can be tied to the risk's type and importance. Some risks, like natural disasters, may require monitoring during a particular period. When they occur, real-time data is needed for a quick response. Other risks, such as supplier quality, require regular monitoring. Finally, risks such as country risk might require infrequent or exception-based monitoring. Third-party providers may be useful in these instances, due to their ability to issue alerts only when a particular incident has occurred or when a specific metric reaches a threshold. As such, risk measurement needs to be viewed as both an art and a science, necessitating a shift in mindset that views risk measurement and management not as a mere process or a set of tools, but as a way of approaching supplier relationships and doing business.
4.2.2. Measuring to ensure supply continuity
While companies measure risks in different ways, based on their management approach and risk management maturity, the benefit of measuring is void if appropriate actions are not taken to ensure supply continuity based on the insights gained. A common approach involves evaluating each risk using two dimensions—the likelihood of occurrence and the severity of impact (Tummala and Schoenherr, 2011), which is often complemented with a third dimension—detectability, as discussed above.
It is important to note that the rating process for the three dimensions can have a subjective element. While historical data can sometimes be used to support judgments, some risks simply lack sufficient data. It is, thus, crucial to involve stakeholders with different knowledge and expertise to ensure a holistic and well-rounded assessment. When rating a risk, it may be useful to include an explanation for why it was rated as such. Currently, many companies approach measurement in a static fashion, capturing risks with a single assessment at one point in time. The challenge is to make it dynamic, using real-time data to identify moving risks. Technology can be a tremendous enabler in this regard (Albinson et al., 2016).
Starting with the most commonly mentioned risk types (Table 6), we suggest in Table 7 an illustrative set of metrics. For more specific risks, such as supplier and market risks, the metrics tend to be objective, and companies can rely on their own data sources. However, for more generic risks, such as geopolitical, macroeconomic, and natural disasters, the metrics tend to be composite indexes, often sourced from third parties, usually at a cost.
Table 7.
Illustrative risk metrics and data sources.
| Risk Category | Risk Type | Illustrative Metrics | Data Sources |
|---|---|---|---|
| Supplier Performance Risks | Supplier financial risk | Liquidity Solvency Profitability |
For publicly traded companies: third party providers (e.g., D&B and Rapid Ratings) For private companies: Supplier data |
| Supplier quality risk | Defects in parts per million (PPM) | Own company; suppliers | |
| Contract risk | Contract defaults | Own company; third party providers | |
| Supplier capacity risk | Capacity utilization (%) | Supplier | |
| Supplier delivery risk | On time in full (OTIF) On-time delivered parts per million |
Own company | |
| CSR and Compliance Risks | Social responsibility risk | Multiple measures depending on the issue | Third party audits |
| Health and safety risk | Accidents and deaths Near misses |
Own company; third party providers; competitors | |
| Reputation/brand risk | Brand equity | Own company (difficult to measure) | |
| Environmental risk | Waste to landfill CO2 emissions |
Supplier; third party providers | |
| Supply Market Risks | Category risk | Supply base capacity | Own company; suppliers |
| Raw material risk | Availability of supply Cost of raw materials |
Own company; third party providers | |
| Logistic risk | On-time in full (OTIF) Delivered Parts per Million (DPPM) |
Own company; third party providers; logistics providers | |
| Technology Risks | Cybersecurity risk | Security breaches Customers affected |
Own company; third party providers |
| Intellectual property risk | IP related legal proceedings Cost of IP protection |
Own company; third party providers | |
| Geopolitical Risks | Country risk | Risk index (composite measure) | Third party providers; publicly available data |
| Labor-related risks | Composite measure (often included in country risk) | Third party providers; publicly available data | |
| Legal risk | Composite measure (often included in country risk) | Third party providers | |
| Domestic risk | Composite measure (often included in country risk) | Third party providers; publicly available data | |
| Macro-economic Risks | Currency risk | Value-at-risk (VaR) | Third party providers; publicly available data |
| Inflation/volatility risk | Purchasing Managers' Index (PMI) Commodity price index |
Third party providers; publicly available data | |
| Natural Disaster Risks | Occurrence of natural disaster | Frequency and severity (measures depend on the type of the disaster) Insurance losses |
Third party providers; publicly available data |
While selecting risk metrics may be daunting, the biggest mistake is to not utilize any. At the onset of the risk measurement journey, metrics that make the most sense should be chosen, with the realization that they may need to be modified. This emphasizes the criticality of reviewing the chosen assessment approaches and the associated metrics, and modifying them accordingly as more is learned about their effectiveness.
4.2.3. Leveraging information technology
Risk measurement relies on data. Generally, the more data is available to capture certain risks, the better. At a minimum, more data means better triangulation for greater confidence. Fortunately, access to global, real-time data, coupled with increasing computing power in recent years, has facilitated data collection and analysis (Giannakis and Louis, 2011). However, the companies we interviewed also noted that the abundance of data can cause an information overload in the absence of analytical capabilities. In other instances, data can be scarce, for example, in rare events, such as the future trajectory of the pandemic. Another commonly cited problem relates to the veracity of data, particularly social media data that can be manipulated, and data provided by third parties who often do not reveal their sources and aggregation methods. Supplier-provided data may also include bias if suppliers have ulterior motives. Participants in our study acknowledged concerns about internal data, rendering the process for data cleaning and verification essential. In this vein, artificial intelligence (AI) and machine learning algorithms able to detect patterns and trends, and to flag potential risks, seem promising.
Interestingly, however, few companies in our sample appeared to be taking advantage of these technologies, and many were skeptical about their effectiveness. Although most companies were not currently using AI and machine learning for risk measurement, we believe that this has to do with the evolution of the technology (Wheeler, 2018). AI and machine learning have particular promise for unstructured data, which has become so ubiquitous today (Lee and Shin, 2020) — an International Data Group study suggests that 90 percent of data is unstructured (Deloitte, 2016). Deriving sentiments from this type of data will become invaluable to measure and manage risks proactively in our post-pandemic world.
4.2.4. Automating analytics
Ultimately, the goal of risk measurement systems is to drive change, inform decision-making, and enable risk-aware and resilient choices. To that end, workflow automation makes it easy for decision-makers to take action when certain thresholds are met. Robust relational databases help companies connect large datasets, such as suppliers to parts sourced, parts sourced to supplier intelligence, and the firm's overall global footprint. Computations can be done on key performance and risk measurement indicators at supplier, site, part, and/or product levels. Dashboarding systems allow users to analyze data, applying risk measures to different levels of granularity (e.g., supplier → site → part) and rolling them up to higher levels (part → supplier → product → product line).
Centralized systems, on the cloud or on-premises, also make it easy to provide targeted information to globally dispersed teams, breaking down silos, creating reliable data streams, and minimizing the effort for regularly updating risk metrics. Advanced technologies leveraging natural language processing ensure that risk measures can be created in real-time using unstructured or semi-structured data. The systems can further tailor insights for specific stakeholders, highlighting the most relevant information for their role and position. In addition, those companies in our sample that adopted cloud-based systems for measuring supplier risk were able to scale the program across their suppliers, which can be thousands of suppliers, including their multiple sites and tens of thousands of parts. These systems allow companies to measure all suppliers, rather than just the 20% of suppliers typically accounting for 80% of the total spend. Any part or supplier can disrupt the shipment, even a non-strategic supplier that does not possess a large spend. Automation enables to capture these.
4.3. How to take action
4.3.1. Translating measurement into action
It is critical that risk measurement does not become a self-serving activity that is done merely for the sake of doing it, but that it is translated into appropriate actions. Too often, risk metrics are devised and values are collected, only for them to be reported but not being used. PSM professionals thus need to “walk the talk” and let measurement inform their decisions. This, however, is easier said than done, since there is often no commonly accepted threshold that could provide a clear guidance on when to trigger risk response action plans, reemphasizing the notion from the prior section that risk measurement and management is both an art and a science. Establishing a risk measurement culture and associated mindset is a first step in enabling this.
Taking risks is part and parcel to doing business; however, PSM professionals expect rewards in return for the risks they take—the greater the risk, the greater the expected reward. Risk measurement is, therefore, particularly important from this perspective, since significant and long-lasting repercussions may ensue depending on how much risk a PSM professional considers in their decisions. Risk assessment is especially challenging for business decisions that involve strategy, business models (Brillinger et al., 2020), and other long-term aspects that can determine a firm's future and sustainability. Additional difficulties may arise when facing a completely new challenge like the COVID-19 pandemic. In the end, companies need to assess whether the benefits of the proposed move outweigh the risks associated with it.
The risk-reward logic also applies to mitigation strategies, as PSM professionals continuously evaluate the trade-off between the potential losses from a risk and the cost of its mitigation. In some instances, it may be too costly for the company to mitigate the risks, and it may decide to just suffer the consequences. This approach may especially be applicable for risks with a low likelihood of occurrence and a low severity of impact. In addition, both companies and individuals have different risk tolerance levels, which essentially shapes the risk response.
As such, in our interviews, PSM professionals described different responses to risk, which ranged from avoiding risks altogether to consciously assuming risks. Proactive approaches aimed at avoiding risks entail companies taking actions before the risk manifests to reduce its impact. We ascertained five proactive approaches to risk mitigation: (1) building redundancy by having multiple and geographically dispersed supply sources and ports of entry; (2) buffering in the form of inventory, time, or capacity; (3) reducing product variability through quality management approaches; (4) reducing process variability by emphasizing delivery and service considerations in supplier selection decisions and service level agreements (SLAs); and (5) using analytics to identify patterns in data that might give an early indication of potential risks.
Interviewees, however, also recognized that certain risks cannot be prevented, rendering companies having to assume the risk. In these instances, it is prudent to have contingency plans with reactive risk management approaches in place. For example, there is very little a company can do to prevent a natural disaster. The best companies can do is to respond quickly based on their contingency plans. While they may not be perfect, they provide an invaluable starting point in times of crisis, in the form of for instance a sequence of actions to consider, sources of data to consult, alternatives to deploy, and emergency contacts to approach. For instance, if a company learns that one of its suppliers is about to go bankrupt, it might reach out to the supplier to offer support (so that the bankruptcy can be avoided) and/or to protect any assets and intellectual property, in addition to locating alternative suppliers. It is also possible that a single risk could have multiple contingency plans encompassing several simultaneous activities when triggered. Companies may further consider risk transfer via insurance, such as contingent business interruption (CBI) insurance. This policy protects firms from physical risks manifesting at critical supplier sites.
Most interviewees highlighted the importance of supplier relationship management (SRM) for both proactive and reactive risk mitigation, consistent with the notions presented in Cheng and Chen (2016). Risk measurement and assessment spans across the entire relationship lifecycle. It starts with taking appropriate measurements when selecting new suppliers, continues with scrutinizing suppliers during the onboarding process, providing regular assessments and ongoing performance improvement initiatives, and ends with supplier relationship termination (Table 8 ). This last step is often overlooked, yet critical, since readiness to manage the end of a relationship could cause significant operational and financial risks.
Table 8.
Managing risk through supplier relationship management.
| Supplier Selection | Supplier Onboarding | Supplier Assessment | Supplier Performance Improvement | Supplier Relationship Termination |
|---|---|---|---|---|
|
|
|
|
|
4.3.2. Learning from the past
We investigated how companies learn from past measurement approaches, both when risks had successfully been measured and thus mitigated, and when they were not. This process is important since it helps identify and evaluate new risks and adjust to known ones, leading to more robust risk management approaches. A critical element here is again measurement, to assess how effective an approach was and whether the chosen metrics can be improved. Some companies have a structured process through which certain risks are regularly communicated internally. However, informing everybody of all potential risk events is inefficient and counterproductive, as this could distort people's perceptions of scale and priority of different risks. Protocols thus need to be put in place that help determine who needs to be informed given the risk events. Lessons learned from mistakes and near-misses are thus valuable in developing such best practices. It is also important to have a “post-mortem” examination of the response after an event (Choi et al., 2020), highlighting lessons learned and sharing them with the company.
4.3.3. Scaling the approach
In most companies we worked with, procurement is centralized or center-led, which is beneficial for developing uniform supplier management processes, particularly as it relates to measuring and managing risks. In such cases, the risk register can be managed centrally, and alignment can be ensured, generating a common understanding of how to prioritize actions and budget allocations. Advanced companies also have playbooks that define mitigation actions based on pre-set criteria. What is particularly beneficial in scaling the approach, especially for globally-dispersed and complex organizations, is automation enabled by machine learning and artificial intelligence, allowing decisionmakers to spend their time more effectively.
4.4. Creating a culture of continuous measuring
4.4.1. Communication and learning are essential
The foundation of successful risk management is the effective communication of risks, both internally across functions and externally with suppliers and even customers. Risk-related information addresses the type, severity, and urgency of the risk. A crucial stakeholder in the risk management process is a company's board of directors (Fraser and Simkins, 2016), and communication with them needs to be carefully managed. Particularly, during a risk event, it is important to keep them informed, but at the same time, overloading them with details should be avoided. What we found to be successful in these communications is to illustrate the risk impact in terms of monetary losses or impact on customers.
Open communication is crucial when a risk event happens, as companies need to respond quickly. For this purpose, many of our study participants have a clear communication protocol or playbook. Specifically, of more than 100 companies we studied that had adopted risk management technology, 75% had automated supplier communication during events. Their monitoring system alerts team members about disruptions and automatically reaches out to their suppliers, asking if they are or will likely be impacted. About 30% had set expectations that suppliers needed to respond within 48 h in case of no impact, and within 72 h if there was an impact, together with the type and (expected) duration of impact. These companies had adopted mobile collaboration and messaging tools to enable PSM professionals to connect directly with their suppliers. Some companies follow a more ad-hoc and less formalized approach, deciding how and with whom to communicate depending on the severity of the event.
In addition to internal technology that helps identify unusual patterns and potential risks before they occur, natural language processing technologies carry great promise in identifying news relevant to supply chain operations, as news items may be leading indicators of problems in the days ahead. News can come from established media agencies but also from social media such as Facebook or Twitter—there are also technologies to verify the accuracy of various news postings. While some companies had been slow in adopting these new technologies, COVID-19 has accelerated the adoption curve as many companies found themselves reacting too slowly.
4.4.2. Fostering a risk-conscious culture through risk measurement
Measuring and managing risks and learning from shared experiences will affect how companies behave and instill a risk-conscious culture. The result of this process is not a culture that is averse to risk but a culture that embraces risks as something that needs to be measured and managed. Such a new perspective is facilitated through an understanding of the risks to which the company is exposed and maintaining confidence in the way the company can manage those risks. In companies that have instilled this culture, early product design milestones have a risk review meeting, in which the team analyzes risks associated with suppliers, parts, and site selections. The objective is to identify all possible risks that may manifest and encapsulate them in contracts and strategies to the extent possible.
The way in which companies measure risk has a strong influence on the development of such culture, particularly when those measures are linked to rewards. For example, suppose leadership rewards individuals playing the “hero” and “saving the day” during major disruptions by highlighting their accomplishments. In that case, employees might not see the value in a risk-conscious proactive mitigation approach. When interviewing PSM professionals, training was mentioned as a critical element in fostering a risk-conscious culture that values proactive mitigation, not only in terms of risk tools and techniques, but also in terms of success stories and celebrations that follow. The use of measures to drive culture not only influences internal operations but can permeate to suppliers. Best-in-class companies reward suppliers’ transparency by elevating them to “preferred” status or recognizing their resilience measures via supplier awards. This sends a strong message and extends the culture of resilience into the broader supply chain.
Inherent to all of these attempts aimed at instilling a risk measurement and management culture is that these initiatives should not be isolated but be part of an overall corporate approach and mindset (cf. Christopher and Peck, 2004; Christopher et al., 2011). Individuals need to be convinced about risk measurement and management, engrain these practices in everything that they do, and view it as an integral part of doing business. This is certainly not achieved overnight and requires dedication, perseverance, and leadership. While the journey toward this state may be long and windy, establishing a culture of risk measurement and management is essential for companies to be equipped for the next risk event. It is not a question if risks will manifest, but when, so it pays to be prepared.
5. Concluding thoughts
The measurement of relevant risks has become vitally important for purchasing and supply management professionals. The COVID-19 pandemic has taught us that we need to rethink how supply chains are managed, but at the same time, guidance for risk measurement is wanting. It was thus our objective to provide insight into this domain by making the case for establishing a culture of measuring. We believe that such culture is a central element to enhancing and augmenting existing approaches—so much hinges on the proper understanding of risk dynamics. There are no perfect metrics, data is elusive, and there are no ironclad action plans that can be adopted. No matter how well prepared companies may be, the chances are that once risks manifest, they will be in a different form or flavor. This unstructured, uncertain, and fluid context of unknown unknowns motivated us to interview PSM professionals and learn about leading-edge practices culminating in advocating a culture of measuring.
We offered perspectives on how to rethink risk measurement, how to continuously measure risk, how to translate measurement into action, and how to establish a culture of measuring. In doing so, our goal was to help PSM professionals to push risk measurement to the next level. The approach does not contradict established risk management methods, but is rather meant to complement existing approaches. We believe that by overlaying established methods with this culture of measuring, their impact can be magnified, since it enables a more holistic view of risk.
While the derived best practices are particularly relevant in the post-pandemic world, our approach goes well beyond measuring risk for a black swan event like the pandemic. Global supply chains remain in a state of disruption, and disturbances come from many different sources. As such, the observations and implications shared in this paper will help PSM professionals measure and take action to protect their supply chain from unforeseen risks, whether it is a black swan event like a pandemic, an annual occurrence like a hurricane, or an isolated incident like a plant fire.
Moving forward, the risk taxonomy derived through our research should be expanded and/or modified based on changing environments and contexts. For the same reason, mechanics for identifying and allocating relevant risks and ways to compute risk exposure should also be revisited, and approaches for more holistically thinking about risks should be developed. We believe that the proposed culture of measuring encourages this. An intriguing research opportunity is in the identification of ways in which the art and science of risk measurement can be best combined. Great potential is also provided through the leveraging of information technology—it is our belief that we have just scratched the surface in this vein. We, however, issue caution that risk measurement should not just be conducted for the sake of measuring. Action based on the insight created needs to follow. How to make this happen (i.e., when and how to take action based on measurement) is an area that is in need of future work. In addition, how best to initiate change management, needed to move towards a culture of risk measurement, seems to be an exciting area worthy of investigation. Finally, how all of these dynamics can be positioned theoretically is an intriguing future research opportunity. Addressing this dearth in the application of theoretical perspectives to risk management would address the call by Fan and Stevenson (2018).
Overall, we provided a broad framework that can be adapted, encouraging PSM professionals to rethink their approach to risk measurement and instill a culture of risk measurement. We believe that this process will help create more robust and resilient supply chains in a post-pandemic world.
Author statement
Tobias Schoenherr: Conceptualization; Formal analysis; Writing - original draft; Writing - review & editing.
Carlos Mena: Conceptualization; Formal analysis; Writing – original draft; Writing - review & editing.
Bindiya Vakil: Writing - review & editing.
Tom Choi: Conceptualization; Writing - original draft; Writing – review & editing.
Declaration of competing interest
There is no known conflict of interest.
Funding information
Funding for this project was provided by CAPS Research, Tempe, Arizona, USA, under the project title “Measuring and Managing Risks in Supply Chains”, November 2017–April 2019.
Appendix 1. Interview Protocol
-
1.
What risks should be measured by CPOs, given that they can come from all levels, from supplier quality at a single supplier to a large political shift on the global stage?
-
2.
How can risk measurement help in identifying a set of relevant risks for different sets of buys, including both materials and services?
-
3.
How can these risks be measured, and how can suppliers be effectively evaluated based on their ensuing risk profile?
-
4.
How should different types of suppliers be assessed based on their risk?
-
5.With the emergence of increased computing power, access to global data, and real-time data analytics, how could a CPO start to measure various sources of risk that could impact procurement?
-
5.1.What are some of these data sources and tools?
-
5.1.
-
6.How can some of the leading risk information (technology) services be used best for risk measurement?
-
6.1.How effective are they for measuring and evaluating risks?
-
6.1.
-
7.How can the insight gathered best be utilized to mitigate and/or manage these risks to ensure supply continuity?
-
7.1.How effective are these approaches?
-
7.1.
-
8.
What is done to learn from the past measurement approaches, both when risks had successfully been measured and when companies were not able to effectively measure and respond to risks?
-
9.
How can CPOs best communicate risk metrics and their concern for risk management to their board of directors and other stakeholders?
Data availability
The data that has been used is confidential.
References
- Albinson L., Blau A., Chu Y. Deloitte Development LLC; New Rules: 2016. The Future of Risk: New Game. [Google Scholar]
- Alcantara P., Riglietti G. Business Continuity Institute; Caversham, UK: 2015. Supply Chain Resilience Report. [Google Scholar]
- Aqlan F., Lam S.S. A fuzzy-based integrated framework for supply chain risk assessment. Int. J. Prod. Econ. 2015;161:54–63. [Google Scholar]
- Arogyaswamy B. Social entrepreneurship performance measurement: a time-based organizing framework. Bus. Horiz. 2017;60(5):603–611. [Google Scholar]
- ASQ . American Society for Quality; 2022. Failure Mode and Effects Analysis (FMEA)https://asq.org/quality-resources/fmea [Google Scholar]
- Biden J.R. 2021. Executive order on America’s supply chains. The White House, Briefing Room, Presidential Actions.https://www.whitehouse.gov/briefing-room/presidential-actions/2021/02/24/executive-order-on-americas-supply-chains/ February 24. [Google Scholar]
- Blome C., Schoenherr T. Supply chain risk management in financial crises—a multiple case-study approach. Int. J. Prod. Econ. 2011;134(1):43–57. [Google Scholar]
- Brillinger A.S., Els C., Schäfer B., Bender B. Business model risk and uncertainty factors: toward building and maintaining profitable and sustainable business models. Bus. Horiz. 2020;63(1):121–130. [Google Scholar]
- Bruce J.R. Risky business: how social psychology can help improve corporate risk management. Bus. Horiz. 2014;57(4):551–557. [Google Scholar]
- Bruno G., Esposito E., Genovese A., Passaro R. AHP-based approaches for supplier evaluation: problems and perspectives. J. Purch. Supply Manag. 2012;18(3):159–172. [Google Scholar]
- Caniëls M.C., Vos F.G., Schiele H., Pulles N.J. The effects of balanced and asymmetric dependence on supplier satisfaction: identifying positive effects of dependency. J. Purch. Supply Manag. 2018;24(4):343–351. [Google Scholar]
- Cavinato J., Dennis M., Lallatin C.S., Pohlig H.M., Sturzl S.R., Tracey T., Tucker V., Kapelka J.L. sixth ed. Institute for Supply Management; Tempe, AZ: 2015. ISM Glossary of Key Supply Management Terms. [Google Scholar]
- Chand P., Tarei P.K. Do the barriers of multi-tier sustainable supply chain interact? A multi-sector examination using resource-based theory and resource-dependence theory. J. Purch. Supply Manag. 2021;27(5) [Google Scholar]
- Chang W., Ellinger A.E., Blackhurst J. A contextual approach to supply chain risk mitigation. Int. J. Logist. Manag. 2015;26(3):642–656. [Google Scholar]
- Cheng J.H., Chen M.C. Influence of institutional and moral orientations on relational risk management in supply chains. J. Purch. Supply Manag. 2016;22(2):110–119. [Google Scholar]
- Choi T., Rogers D., Vakil B. Coronavirus is a wake-up call for supply chain management. Harvard Bus. Rev. 2020:2020. https://hbr.org/2020/03/coronavirus-is-a-wake-up-call-for-supply-chain-management Online, March 27. [Google Scholar]
- Chopra S., Sodhi M.S. Managing risk to avoid supply-chain breakdown. MIT Sloan Manag. Rev. 2004;46(1):53–61. [Google Scholar]
- Choudhary N.A., Singh S., Schoenherr T., Ramkumar M. Risk assessment in supply chains: a state-of-the-art review of methodologies and their applications. Ann. Oper. Res. 2022 doi: 10.1007/s10479-022-04700-9. (in press) [DOI] [PMC free article] [PubMed] [Google Scholar]
- Christopher M., Mena C., Khan O., Yurt O. Approaches to managing global sourcing risk. Supply Chain Manag.: Int. J. 2011;16(2):67–81. [Google Scholar]
- Christopher M., Peck H. Building the resilient supply chain. Int. J. Logist. Manag. 2004;15(2):1–14. [Google Scholar]
- Cole R., Aitken J. The role of intermediaries in establishing a sustainable supply chain. J. Purch. Supply Manag. 2020;26(2) [Google Scholar]
- Congressional Research Service . CRS Report for Congress. 2011. The motor vehicle supply chain: effects of the Japanese earthquake and tsunami. 23 May 2011. [Google Scholar]
- Costantino N., Pellegrino R. Choosing between single and multiple sourcing based on supplier default risk: a real options approach. J. Purch. Supply Manag. 2010;16:27–40. [Google Scholar]
- Deloitte . Deloitte; London, UK: 2016. Why Artificial Intelligence Is a Game Changer for Risk Management. [Google Scholar]
- Di Mauro C., Ancarani A., Schupp F., Crocco G. Risk aversion in the supply chain: evidence from replenishment decisions. J. Purch. Supply Manag. 2020;26(4) [Google Scholar]
- Fan Y., Stevenson M. A review of supply chain risk management: definition, theory, and research agenda. Int. J. Phys. Distrib. Logist. Manag. 2018;48(3):205–230. [Google Scholar]
- Farrer M., Safi M. The Guardian; 2021. Giant Ship Blocking Suez Canal Partially Refloated.https://www.theguardian.com/world/2021/mar/24/huge-container-ship-blocks-suez-canal-evergreen p. 24 March 2021. [Google Scholar]
- Finch P. Supply chain risk management. Supply Chain Manag.: Int. J. 2004;9(2):183–196. [Google Scholar]
- Foerstl K., Reuter C., Hartmann E., Blome C. Managing supplier sustainability risks in a dynamically changing environment—sustainable supplier management in the chemical industry. J. Purch. Supply Manag. 2010;16(2):118–130. [Google Scholar]
- Foerstl K., Reuter C., Hartmann E., Blome C. Managing supplier sustainability risks in a dynamically changing environment: sustainable supplier management in the chemical industry. J. Purch. Supply Manag. 2010;16(2):118–130. [Google Scholar]
- Fraser J.R., Simkins B.J. The challenges of and solutions for implementing enterprise risk management. Bus. Horiz. 2016;59(6):689–698. [Google Scholar]
- Ghadge A., Dani S., Kalawsky R. Supply chain risk management: present and future scope. Int. J. Logist. Manag. 2012;23(3):313–339. [Google Scholar]
- Giannakis M., Louis M. A multi-agent based framework for supply chain risk management. J. Purch. Supply Manag. 2011;17(1):23–31. [Google Scholar]
- Glas A.H., Meyer M.M., Eßig M. Covid-19 attacks the body of purchasing and supply management: a medical check of the immune system. J. Purch. Supply Manag. 2021;27(4) [Google Scholar]
- Hallikas J., Karvonen I., Pulkkinen U., Virolainen V.M., Tuominen M. Risk management processes in supplier networks. Int. J. Prod. Econ. 2004;90(1):47–58. [Google Scholar]
- Harland C., Brenchley R., Walker H. Risk in supply networks. J. Purch. Supply Manag. 2003;9(2):51–62. [Google Scholar]
- Heckmann I., Comes T., Nickel S. A critical review on supply chain risk: definition, measure and modeling. Omega. 2015;52:119–132. [Google Scholar]
- Hendricks K.B., Singhal V.R. An empirical analysis of the effect of supply chain disruptions on long-run stock price performance and equity risk of the firm. Prod. Oper. Manag. 2005;14(1):35–52. [Google Scholar]
- Ho W., Zheng T., Yildiz H., Talluri S. Supply chain risk management: a literature review. Int. J. Prod. Res. 2015;53(16):5031–5069. [Google Scholar]
- Hoffmann P., Schiele H., Krabbendam K. Uncertainty, supply risk management and their impact on performance. J. Purch. Supply Manag. 2013;19(3):199–211. [Google Scholar]
- Jüttner U. Supply chain risk management: understanding the business requirements from a practitioner perspective. Int. J. Logist. Manag. 2005;16(1):120–141. [Google Scholar]
- Jüttner U., Peck H., Christopher M. Supply chain risk management: outlining an agenda for future research. Int. J. Logist. Res. Appl. 2003;6(4):197–210. [Google Scholar]
- Kara M.E., Oktay Fırat S.Ü., Ghadge A. A data mining-based framework for supply chain risk management. Comput. Ind. Eng. 2020;139 [Google Scholar]
- Kaufmann L., Kreft S., Ehrgott M., Reimann F. Rationality in supplier selection decisions: the effect of the buyer's national task environment. J. Purch. Supply Manag. 2012;18(2):76–91. [Google Scholar]
- Kırılmaz O., Erol S. A proactive approach to supply chain risk management: shifting orders among suppliers to mitigate the supply side risks. J. Purch. Supply Manag. 2017;23(1):54–65. [Google Scholar]
- Knight L., Meehan J., Tapinos E., Menzies L., Pfeiffer A. Researching the future of purchasing and supply management: the purpose and potential of scenarios. J. Purch. Supply Manag. 2020;26(3) [Google Scholar]
- Lawrence J.M., Ibne Hossain N.U., Jaradat R., Hamilton M. Leveraging a Bayesian network approach to model and analyze supplier vulnerability to severe weather risk: a case study of the U.S. pharmaceutical supply chain following Hurricane Maria. Int. J. Disaster Risk Reduc. 2020;49 doi: 10.1016/j.ijdrr.2020.101607. [DOI] [PMC free article] [PubMed] [Google Scholar]
- Lee I., Shin Y.J. Machine learning for enterprises: applications, algorithm selection, and challenges. Bus. Horiz. 2020;63(2):157–170. [Google Scholar]
- Lee S.H. A fuzzy multi-objective programming approach for determination of resilient supply portfolio under supply failure risks. J. Purch. Supply Manag. 2017;23(3):211–220. [Google Scholar]
- Lenderink B., Halman J.I., Boes J., Voordijk H., Dorée A.G. Procurement and innovation risk management: how a public client managed to realize a radical green innovation in a civil engineering project. J. Purch. Supply Manag. 2022;28(1) [Google Scholar]
- Liu H.C., Liu L., Liu N. Risk evaluation approaches in failure mode and effects analysis: a literature review. Expert Syst. Appl. 2013;40(2):828–838. [Google Scholar]
- Loader K. SME suppliers and the challenge of public procurement: evidence revealed by a UK government online feedback facility. J. Purch. Supply Manag. 2015;21(2):103–112. [Google Scholar]
- López C., Ruiz-Benítez R. Multilayer analysis of supply chain strategies' impact on sustainability. J. Purch. Supply Manag. 2020;26(2) [Google Scholar]
- Ma H.L., Wong W.H.C. A fuzzy-based House of Risk assessment method for manufacturers in global supply chains. Ind. Manag. Data Syst. 2018;118(7):1463–1476. [Google Scholar]
- Ma S., Hofer A.R., Aloysius J. Supplier dependence asymmetry and investment in innovation: the role of psychological uncertainty. J. Purch. Supply Manag. 2021;27(2) [Google Scholar]
- Malacina I., Karttunen E., Jääskeläinen A., Lintukangas K., Heikkilä J., Kähkönen A.K. Capturing the value creation in public procurement: a practice-based view. J. Purch. Supply Manag. 2022 [Google Scholar]
- Manuj I., Mentzer J.T. Global supply chain risk management strategies. Int. J. Phys. Distrib. Logist. Manag. 2008;38(3):192–223. [Google Scholar]
- Manuj I., Mentzer J.T. Global supply chain risk management. J. Bus. Logist. 2008;29(1):133–155. [Google Scholar]
- Meyer M.M., Glas A.H., Eßig M. A Delphi study on the supply risk-mitigating effect of additive manufacturing during SARS-COV-2. J. Purch. Supply Manag. 2022;28(4) [Google Scholar]
- Micheli G.J., Cagno E., Di Giulio A. Reducing the total cost of supply through risk-efficiency-based supplier selection in the EPC industry. J. Purch. Supply Manag. 2009;15(3):166–177. [Google Scholar]
- Miller K.D. A framework for integrated risk management in international business. J. Int. Bus. Stud. 1992;23(2):311–331. [Google Scholar]
- Montgomery R.T., Ogden J.A., Boehmke B.C. A quantified Kraljic Portfolio Matrix: using decision analysis for strategic purchasing. J. Purch. Supply Manag. 2018;24(3):192–203. [Google Scholar]
- Nagle T., Redman T., Sammon D. Assessing data quality: a managerial call to action. Bus. Horiz. 2020;63(3):325–337. [Google Scholar]
- Padhi S.S., Mohapatra P.K. Detection of collusion in government procurement auctions. J. Purch. Supply Manag. 2011;17(4):207–221. [Google Scholar]
- Pellegrino R., Costantino N., Tauro D. Supply Chain Finance: a supply chainoriented perspective to mitigate commodity risk and pricing volatility. J. Purch. Supply Manag. 2019;25(2):118–133. [Google Scholar]
- Pfohl H.C., Gallus P., Thomas D. Interpretive structural modeling of supply chain risks. Int. J. Phys. Distrib. Logist. Manag. 2011;41(9):839–859. [Google Scholar]
- Pournader M., Kach A., Talluri S. A review of the existing and emerging topics in the supply chain risk management literature. Decis. Sci. J. 2020;51(4):867–870. doi: 10.1111/deci.12470. [DOI] [PMC free article] [PubMed] [Google Scholar]
- Pournader M., Rotaru K., Kach A.P., Razavi Hajiagha S.H. An analytical model for systemwide and tier-specific assessment of resilience to supply chain risks. Supply Chain Manag. 2016;21(5):589–609. [Google Scholar]
- Qazi A., Dickson A., Quigley J., Gaudenzi B. Supply chain risk network management: a Bayesian belief network and expected utility based approach for managing supply chain risks. Int. J. Prod. Econ. 2018;196:24–42. [Google Scholar]
- Rajesh R., Ravi V. Modeling enablers of supply chain risk mitigation in electronic supply chains: a Grey-DEMATEL approach. Comput. Ind. Eng. 2015;87:126–139. [Google Scholar]
- Ramkumar M., Schoenherr T., Jenamani M. Risk assessment of outsourcing e-procurement services: integrating SWOT analysis with a modified ANP-based fuzzy inference system. Prod. Plann. Control. 2016;27(14):1171–1190. [Google Scholar]
- Rangel D.A., de Oliveira T.K., Leite M.S.A. Supply chain risk classification: discussion and proposal. Int. J. Prod. Res. 2015;53(22):6868–6887. [Google Scholar]
- Rao C., Xiao X., Goh M., Zheng J., Wen J. Compound mechanism design of supplier selection based on multi-attribute auction and risk management of supply chain. Comput. Ind. Eng. 2017;105:63–75. [Google Scholar]
- Rao S., Goldsby T.J. Supply chain risks: a review and typology. Int. J. Logist. Manag. 2009;20(1):97–123. [Google Scholar]
- Reuters . Reuters; 2011. Factbox: Thailand’s Flood Crisis and the Economy.https://www.reuters.com/article/uk-thailand-foods-factbox/factboxthailands-flood-crisis-and-the-economy-idUKTRE7A11AL20111102 2 November 2011. [Google Scholar]
- Reuters Germany passes law on tougher oversight of supply chains. Reuters News. 2021 https://www.reuters.com/article/us-germany-companies-supplychains/germany-passes-law-on-tougher-oversight-of-supply-chainsidUSKCN2DN1AV June 11, 2021. [Google Scholar]
- Ritchie B., Brindley C. Supply chain risk management and performance: a guiding framework for future development. Int. J. Oper. Prod. Manag. 2007;27(3):303–322. [Google Scholar]
- Roehrich J.K., Grosvold J., Hoejmose S.U. Reputational risks and sustainable supply chain management: decision making under bounded rationality. Int. J. Oper. Prod. Manag. 2014;34(5):695–719. [Google Scholar]
- Russel M. Global sourcing risk rises in European retail sector. Just-Style. 2018 https://www.just-style.com/news/globalsourcing-risk-rises-in-european-retail-sector/ 12 June 2018. [Google Scholar]
- Schniederjans D., Khalajhedayati M. Product recall strategy in the supply chain: utility and culture. Int. J. Qual. Reliab. Manag. 2021;38(1):196–212. [Google Scholar]
- Schoenherr T., Mena C., Choi T.Y. CAPS Research Report; 2019. Measuring and Managing Risks in Supply Chains. April 2019. [Google Scholar]
- Schoenherr T., Swink M. Revisiting the arcs of integration: cross-validations and extensions. J. Oper. Manag. 2012;30(1–2):99–115. [Google Scholar]
- Schoenherr T., Tummala V.R., Harrison T.P. Assessing supply chain risks with the analytic hierarchy process: providing decision support for the offshoring decision by a US manufacturing company. J. Purch. Supply Manag. 2008;14(2):100–111. [Google Scholar]
- Sheffi Y., Rice J.B., Jr. A supply chain view of the resilient enterprise. MIT Sloan Manag. Rev. 2005;47(1):41. [Google Scholar]
- Simchi-Levi D., Schmidt W., Wei Y. From superstorms to factory fires: managing unpredictable supply-chain disruptions. Harv. Bus. Rev. 2014 https://hbr.org/2014/01/from-superstorms-to-factory-fires-managing-unpredictable-supply-chain-disruptions [Google Scholar]
- Solomon D., Forbes P. 2020. Inside the story of how H-E-B planned for the pandemic Texas Monthly.https://www.texasmonthly.com/food/heb-preparedcoronavirus-pandemic/ March 26. [Google Scholar]
- Taleb N.N. Random House; New York: 2007. The Black Swan: the Impact of the Highly Improbable. [Google Scholar]
- Tang C.S. Perspectives in supply chain risk management. Int. J. Prod. Econ. 2006;103(2):451–488. [Google Scholar]
- Taylor K. Business Insider; 2018. People Are Still Terrified to Eat at Chipotle — and It's the Chain's Biggest Problem.www.businessinsider.com/chipotle-hasnt-overcome-e-coli-fears-2018-3 27 March 2018. Available at: [Google Scholar]
- The White House . 100-Day Reviews under Executive Order 14017. The White House; Washington: 2021. Building Resilient Supply Chains, Revitalizing American Manufacturing, and Fostering Broad-Based Growth.https://www.whitehouse.gov/wp-content/uploads/2021/06/100-day-supply-chain-review-report.pdf [Google Scholar]
- Thun J.H., Hoenig D. An empirical analysis of supply chain risk management in the German automotive industry. Int. J. Prod. Econ. 2011;131(1):242–249. [Google Scholar]
- Transparency International . 2021. Corruption Perceptions Index.https://www.transparency.org/en/cpi/2021 [Google Scholar]
- Tucker E.L., Daskin M.S. Pharmaceutical supply chain reliability and effects on drug shortages. Comput. Ind. Eng. 2022 [Google Scholar]
- Tummala R., Schoenherr T. Assessing and managing risks using the supply chain risk management process (SCRMP) Supply Chain Manag.: Int. J. 2011;16(6):474–483. [Google Scholar]
- Tummala V.R., Cscp T.S., Harrison T. Integrating FMEA with the supply chain risk management process to facilitate supply chain design decisions. Prod. Inventory Manag. J. 2014;49(1):27–73. [Google Scholar]
- Uberti D., Nash K.S. SolarWinds hack forces reckoning with supply-chain security. Wall St. J. 2021 https://www.wsj.com/articles/solarwinds-hack-forcesreckoning-with-supply-chain-security-11610620200 14 January 2021. [Google Scholar]
- Uenk N., Taponen S. Risk allocation in service triads–The case of Dutch and Finnish home care procurement. J. Purch. Supply Manag. 2020;26(4) [Google Scholar]
- Umbenhauer B., Younger L. 2017. Growth: the Cost and Digital Imperative. The Deloitte Global CPO Survey 2017. [Google Scholar]
- Umbenhauer B. Deloitte Development LLC; 2013. Charting the Course: Why Procurement must Transform Itself by 2020. [Google Scholar]
- van Hoek R. Larger, counter-intuitive and lasting–The PSM role in responding to the COVID-19 pandemic, exploring opportunities for theoretical and actionable advances. J. Purch. Supply Manag. 2021 [Google Scholar]
- Van Poucke E., Matthyssens P., Weeren A. Enhancing cost savings through early involvement of purchasing professionals in sourcing projects: Bayesian estimation of a structural equation model. J. Purch. Supply Manag. 2016;22(4):299–310. [Google Scholar]
- Venkatesh V.G., Rathi S., Patwa S. Analysis on supply chain risks in Indian apparel retail chains and proposal of risk prioritization model using interpretive structural modeling. J. Retailing Consum. Serv. 2015;26:153–167. [Google Scholar]
- Viswanadham N., Samvedi A. Supplier selection based on supply chain ecosystem, performance and risk criteria. Int. J. Prod. Res. 2013;51(21):6484–6498. [Google Scholar]
- Wagner S.M., Bode C. An empirical investigation into supply chain vulnerability. J. Purch. Supply Manag. 2006;12(6):301–312. [Google Scholar]
- Wetzstein A., Feisel E., Hartmann E., Benton W.C., Jr. Uncovering the supplier selection knowledge structure: a systematic citation network analysis from 1991 to 2017. J. Purch. Supply Manag. 2019;25(4) [Google Scholar]
- Wheeler J.A. 2018. Hype Cycle for Risk Management. Gartner Research Report. July 13. [Google Scholar]
- WHO . World Health Organization; 2018. WHO and World Bank Group Join Forces to Strengthen Global Health Security.https://www.who.int/news/item/24-05-2018-who-and-world-bank-group-join-forces-to-strengthen-globalhealth-security 24 May 2018. [Google Scholar]
- Wieland A., Durach C.F. Two perspectives on supply chain resilience. J. Bus. Logist. 2021;42(3):315–322. [Google Scholar]
- Wu C., Barnes D. A literature review of decision-making models and approaches for partner selection in agile supply chains. J. Purch. Supply Manag. 2011;17(4):256–274. [Google Scholar]
- Yan T., Dooley K. CAPS Research; Tempe, AZ: 2017. Measuring and Managing Supplier Innovation. [Google Scholar]
- Zheng X., Zhang L. Risk assessment of supply-chain systems: a probabilistic inference method. Enterprise Inf. Syst. 2020;14(6):858–877. [Google Scholar]
- Zsidisin G.A., Ellram L.M., Carter J.R., Cavinato J.L. An analysis of supply risk assessment techniques. Int. J. Phys. Distrib. Logist. Manag. 2004;34(5):397–413. [Google Scholar]
Associated Data
This section collects any data citations, data availability statements, or supplementary materials included in this article.
Data Availability Statement
The data that has been used is confidential.