19 November 2009
The growth of outsourcing and the impact of the recession have increased risk in the supply chain. Richard Stuart and Michael Tickle outline the areas buyers must focus on
CPOs are custodians of a range of procurement and supply risks which are increasing in scale and complexity. As organisations have outsourced big areas of their operations worldwide, the level of spend and proportion of critical business processes managed by procurement has risen.
In a time of global economic uncertainty it is imperative purchasing takes the lead in managing heightened risks effectively across the supply chain, looking beyond commodity and currency volatility. To protect companies and prevent supply risks spiralling out of control, procurement must urgently and continually improve the awareness and management of a broad portfolio of threats.
Leaders should recognise that a diversion of resources into contingency and recovery plans will not tackle these issues at their root, nor provide sufficient protection from a complex and changing environment.
Firms should be taking stock of risk exposure and reviewing their policies and strategies to manage them across the procurement and supply cycle. Here are the four major risk areas CPOs must focus on.
1: OPERATIONAL RISK
Operational supplier failure can delay or interrupt the inbound flow of goods and materials, potentially leading to loss of revenue and, at worst, jeopardising the survival of the business. The economic downturn has significantly heightened this risk. In a recent example, General Motors sued one of its bankrupt parts suppliers for the return of tools said to be vital to one of its vehicle launches.
Increased global sourcing has also introduced multiple points of transport vulnerability into the supply chain, including the possibilities of disruption due to weather, natural disasters, local industrial action or piracy. The classic case study of supply disruption was a lightning strike at a Philips Semiconductor plant in Albuquerque, which caused only a small fire but disrupted chip supply to its customer Ericsson.
The extent to which operational risk mitigation is dominating procurement activity is illustrated by the comments of this senior purchasing officer at a manufacturer: "I am spending more time on managing immediate crises with suppliers than working on any purchasing topic. I get 15 to 20 enquiries from suppliers for financial support each week."
2: QUALITY RISK
The growth of low-cost country sourcing is exposing businesses to new suppliers whose perception of quality and adherence to standards may not match those of its customer or tier one suppliers.
As labour rates in low-cost economies rise, and especially as margins come under pressure, suppliers are seeking to cut their own costs through re-specifying or outsourcing their inbound goods and services. As acceptance and quality control procedures break down due to complex and extended supply chains, substandard workmanship, and incorrect, impure or contaminated materials will expose the CPO's organisation to additional cost, reputational damage, potential litigation and financial liability. For example, Mattel recalled about 1.5 million pre-school toys, supplied by a Chinese manufacturer, which had been produced with a paint containing lead.
To minimise damage caused by substandard quality, CPOs are intensifying supplier approval procedures and instituting wider random testing on goods received from suppliers previously considered "safe". One retailer of electronic equipment has implemented random chemical analysis of products after detecting the use of lead solder by a trustworthy supplier. The cause was work carried out by a non-approved sub-contract repair organisation in the source country.
3: COMPLIANCE RISK
With increasingly complicated regulations and heightened awareness of social, ethical and sustainability requirements, procurement activity can expose a business to significant risk of legal intervention, damage to reputation, consequential loss or even suspension of business.
In one case, Monsanto filed a claim in excess of $100 million against supplier Sandoz, when changes to the latter's quality assurance programme affected its manufacturing capabilities.
Definitions of "responsible" or "ethical" behaviour and "sustainability" can vary widely between geographies, sectors and stakeholder groups. Despite Wal-Mart's implementation of corporate responsibility standards for its Chinese supply chain enforced through factory audits, a pressure group reported a catalogue of suspected violations by one supplier.
To comply with regulatory and ethical requirements, CPOs are more cautious about the countries and sectors they source from and the level of scrutiny to which potential suppliers are exposed.
One aerospace manufacturer considering global sourcing of components is not just relying on quality certification and compliance with government standards. It is also conducting political, economic, social and technological analysis on potential source countries and requiring evidence of an established aerospace customer base for new suppliers.
4: STRATEGIC RISK
The trend towards outsourcing production and "back office" functions position CPOs and their teams at the heart of an organisation's strategy. The strategic risks arise from commercial exposure to loss or theft of intellectual property (IP), threatening market share and position.
Entrepreneurial suppliers in emerging economies are disregarding previously accepted business behaviour, and may accept work at negligible margins in order to benefit from technology transfer. The most attractive sourcing deals carry the greatest risk - the strategic technology will be deployed by the supplier in their home market in direct competition and is likely to be offered back to competitors in the CPO's own markets.
One UK domestic products maker which outsourced the manufacture of an innovative new range, including elements of its design and development, to China found lower priced, unbranded copies of it on the shelves of UK retailers before its own launch.
To maintain control of IP, CPOs of technology companies have been registering and patenting on a global basis and limiting offshore production to countries where IP rights are enforceable. One electronic company has established criteria for selecting and contracting with offshore manufacturing partners that preclude operations in certain geographies and entry into specific customer markets.
Others are dividing up sensitive IP between suppliers and building in signature elements to the outsourced designs with the sole purpose of detecting and proving IP leaks.
BUILDING A RISK FRAMEWORK
CPOs are building close relationships with their respective CFOs and making use of forward contracting and hedging procedures. In some sectors CPOs are building 'strategic' stocks of bottleneck components. Some buyers have generated 'dummy' orders for equipment from vulnerable strategic suppliers, hoping to match to customer orders later. But few procurement functions have a clearly defined and implemented risk management framework. Without one, risk management will always be reactive to the most visible current risks, leaving organisations vulnerable to volatile situations. Risk management becomes a firefighting activity, with effective mitigation of future risk hindered by the deployment of resources to contingency planning for and recovery from inevitable failures. First, the organisation's risk portfolio should be evaluated:
IDENTIFY Each risk should be mapped on to the supply chain identifying specific exposures by category, supplier, geography, currency and transport method. This will require a full understanding of the inbound supply chain and should involve both commercial and technical experts.
EVALUATE The probability of each risk occuring should be coupled with the likely business impact. In reality causal events may be linked and the impacts will certainly span more than one area. Scenario modelling is invaluable in evaluating the overall risk to the business. Building a risk framework
ASSESS FOR MITIGATION Possible mitigation for each risk should be identified and costed. This will require input from commercial and technical experts, but will also benefit from strategic thinking to come up with more radical mitigation options.
PRIORITISE FOR ACTION Based upon the evaluation of the individual risks, event scenarios and the likely cost of mitigation, a business plan should be developed setting out which risks are to be mitigated and which cannot be. Factored into this should be the timescales required for effective mitigations to be put in place.
Next, develop contingency plans for the inevitable. For risks where effective mitigation is not possible or will take time to put into effect, contingency plans will be necessary to:
PROVIDE EARLY WARNING Key individuals across all levels and functions in the company should be briefed on events or signals to watch for, and how to communicate such information.
DEFINE GOVERNANCE In the event of an unmitigated risk becoming reality, there is a cross-functional mechanism for swift decision-making and action.
IDENTIFY RESOURCES Financial, technical, logistics, sales or PR will be necessary to contain and recover from the risk event, not forgetting the need to manage external stakeholders.
Lastly, set up a risk management operating model, including:
A CROSS-FUNCTION RISK MANAGEMENT FORUM To regularly review and act upon new and changing supply risks as they arise. This forum should include senior representation from finance, procurement, legal and technical functions and report via the CPO or supply chain director to the board. Organisations might also appoint supply chain risk officers to maintain focus and governance on a continuous basis.
A RISK MANAGEMENT PROCESS To monitor and measure exposure, potential mitigation costs and effectiveness, so once established effective risk management is sustained throughout the supplier relationship, not just at contract or renewal.
A RISK MANAGEMENT TOOLSET Enabling existing risks to be monitored, new ones to be evaluated, and the overall risk level to be efficiently tracked and proactively managed, through the use of appropriate IT.
Richard Stuart and Michael Tickle are both managing consultants at PA Consulting
