Managing Risk, Maintaining Continuity

Imagine that you were an executive in the Dutch East India Company. Risk management would be an obsession. Whether it be weather, disease, product theft and devaluation, mutinous employees, war, and (need we say) time to market, these would all be obsessive concerns in running the business. So, to make statements like business is at an all time high as far as risk goes would not be totally accurate. But what is true is that today we have better ways to evaluate risk, predict threats, and prevent disruption and loss than ever before.

Business continuity seems to be the new buzz word. I am not sure I like it; but it does have sound-hidden wit finality, as in dis or non continuity, as the alternative possibly meaning ‘the end’.

What does a day’s or a month’s loss cost? We certainly know now what the impact of high supply costs (like fuel) costs our business. You could have seen that coming, right? And of course, your corporate Risk Manager had a plan for that. Or rerouting your distribution flow after Katrina. And here is the point: generally, with modest efforts, many of the impacts of various risk factors could have been either avoided or lessened by using better methods.

Elements of Risk

One thing about Planning for Uncertainty is that it is not perceived as an urgent initiative by many firms. The only good news coming out of disasters is an increase of these planning efforts (in the last two years due to hackers and tsunamis.)

Clearly, this is a 3Pe issue for your ecosystem, not just the enterprise. If you have custodial responsibilities (3PL, Port, Rail or Trucker, Consignment retailer, channel partner), relying on custodial partnerships, relying on top quality suppliers, etc., you need to think beyond the enterprise.

One thing that became clear from our Pandemic Research was how few companies thought about whether their supplier’s or carrier’s employees would show up for work. So promises of ‘I will be there for you’ are hollow without doing the real analyses and planning.

What we learned from the last few years of hurricane activity across the south is that front line workers might actually abandon the scene earlier, focusing on taking care of their own families. What policies and enticements have been thought through to deal with these eminent events?

This article is not about the Pandemic, but rather is a whole range of Risk issues that assault the enterprise. The implications from IT to Supply Chain to currency devaluations need to be thought through.

Policy: To address the putting in place of assessments, as well as what to do once an event has occurred

Process: Make planning for risk part of the regular business process (create or extend the role of the Chief Risk Officer)

Performance: How to qualify Risk. Many people are loath to get involved in substantive risk assessment or continuity planning efforts. Unfortunately, people think of either all or nothing efforts. Firstly, quantify risk. Just this effort will allow you to begin to determine areas of vulnerability. Focus on those first, and learn from the Process.

Let’s take a look at your process in this example. (Figure 1) Simply modeling out the process can often lead to exposure and the ability to quantify risk. From there, more can be done. What would be the impact of your customer switching to another provider due to brand violations (Spinach, Onions, Tylenol, etc.) as well as the significant costs of recovery?

Pandemic Demand Index™ (PDI)™

                                                                                                            Figure 1

PDI by stage of pandemic:

• • Impact of pandemic on end-customer demand
    • Temporary (e.g. early stages of pandemic) vs. sustained change
  • “Ripple” effects of disruptions across network
    • Larger networks, longer distances a greater exposure
  • Competitor readiness and demand switching

---

Enablers: Not only is outside expertise more objective, but experience counts. Having effective methods to evaluate and quantify risk can cut through costly sand sifting, and get to real issues. Technology for both predictive methods, as well as control systems, is critical. Access of control systems in yards, better IT security, etc. can make a huge difference, and save not only real financial loss, but your corporation’s reputation.

Here are some elements (table 1) and some strategies that are being employed in response to these issues.

Risk Elements

Categories	Issues	Potential strategies
Global Air and Ocean Shipping	US Customs Inspects less than 2% of all shipping containers that enter the US. And the number of containers in operation is growing by millions. Figures around $50 Billion in claims due to lost, late, damaged or stolen goods from imports. Poor information visibility results in poor understanding of SC variability; and shipment status results in inventory increases.	Trace and Track software from an internet based provider Container secure RFID tags Yard Management/Access Control Employee screening in ports
Outsourcing	New operations usually mean a decrease in product quality (this has been clearly documented), increase in counterfeiting and increase in cycle times.	Intellectual Property Legislation in Host country Audit of plant and community for Fair Trade and Labor practices Production Monitoring software Employee screening
Geo Political		Intellectual Property Process Laws Effective and Fair Trade Agreements
Pandemics	Even the threat of contagion keeps people away. SARS had a 1% impact to the Canadian economy; kept workers from returning from holidays to their plants jobs in China.	Pandemic Preparedness Plan
Intruders and Hackers and Information Leakage	Firstly, most information technology leakage is usually an inside job, with sloppy or disgruntled employees exploiting their access to lead information. Take the AOL customer list or the Fidelity loss of the HP employee data; all these were due to poor policy and employee management. However, the policies and technology around security need to be significantly improved to prevent intrusions. Steganographic stuff… this is hiding confidential information in otherwise benign documents so that they can travel easily thru corporate email systems, etc.	Automated Vulnerability Assessments Policy with stick consequences Access Control Systems Digital/ Document Control Digital forensic tools, anti spy ware and other types of scanning software to detect hidden content
Supply Chain	Both time loss, product quality, as well as shortages plague most supply chains.	Event Management software Modern Planning software (link to Demand Management report) Improved supplier relationship management
Counterfeiting and Piracy	Cheap imitations can not only ruin you brand, but represent significant loss in revenue for many firms.	RFID Trace and track software Legislation and better Trade practices

This is merely a short list of examples of Risk categories. Much has been written on the well prepared or not there case studies, enterprises that gained due to better plan, or lost out. Yes, I’ve yet to hear a case study where some one gets up and says “we are lousy planners” and also top performers. It is obviously the other way round.

Determine your vulnerabilities and begin the process. It will be different for most firms. The range of vulnerabilities can be narrowed, if not eliminated.

---