Enhancing Supply Chain Security

Enhancing Supply Chain Security Dr. Omar Keith Helferich Dr. Judith M. Whipple Supply Chain Faculty Associate Professor Central Michigan University Michigan State University July 31, 2007 – Foundation For Strategic Sourcing

Objectives • Define Supply Chain Security • Identify status of supply chain security initiatives • Identify competencies and capabilities that firms are using to enhance supply chain security • Discuss benchmarking tool for improving supply chain security This research was supported by the U.S. Department of Homeland Security (Grant number N-00014-04-1-0659), through a grant awarded to the National Center for Food Protection and Defense at the University of Minnesota. Any opinions, findings, conclusions, or recommendations expressed in this publication are those of the author (s) and do not represent the policy or position of the Department of Homeland Security.

Definition of Supply Chain Protection and Security • The application of policies, procedures, and technology to protect supply chain assets (product, facilities, equipment, information, and personnel) from theft, damage, or terrorism and to prevent the introduction of unauthorized contraband, people, or weapons of mass destruction. Closs and McGarrell (2004), “Enhancing Security Throughout the Supply Chain,” IBM Center for the Business of Government – www.businessofgovernment.org

Secure Supply Chain Requirements • Preventing any biological, chemical or unauthorized agent to be incorporated into the product • Preventing any illegal commodity to be intermingled with the shipment • Preventing transportation assets or a shipment’s contents to be used as a weapon • Preventing unauthorized access to the product and/or supply chain network • Preventing disruptions of the supply chain network/infrastructure

From Corporate security Theft prevention Inside the company Vertically integrated supply chain with 1st tier suppliers Country or geographic Contingency planning Reactive To Cross functional team To include anti-terrorism End-to-end supply chain Business model that includes 2nd and 3rd tier suppliers Global To include crisis management Proactive Supply Chain Security Impact: A State of Transition

Security Expectations: A Changing Future • Secure supply chains – containing advanced security processes and procedures • Resilient supply chains – able to react to unexpected disruptions quickly in order to restore normal operations Rice and Caniato (2003), “Building a Secure and Resilient Supply Network,” Supply Chain Management Review, September/October.

Industries Under Investigation • Food – National Center for Food Protection and Defense (A Department of Homeland Security Center of Excellence) • Electronics and Pharmaceuticals (IBM Research Grant) • Hazardous Material (Dow Chemical Grant)

Range of Security Strategies High High Unintentional Intentional Potential Supply Chain Risk Potential # of Incidents Intentional Unintentional Low Low Safety Security Management Integrated Supply Chain Security Range of Security Strategies

Competency 1 Capability 1 Capability 2 Capability 3 Key Considerations: Capabilities and Competencies • Capability – the infrastructure, processes, systems, assets, and resources to develop a specific competency • Competency –the broad set of skills, knowledge, and aptitude that create and sustain a secure supply chain

Outcomes of the Food Supply ChainBenchmarking Research • Provide industry with in-depth understanding of the capabilities that form competencies in supply chain security • Define competencies and understand their impact on security performance • Compare capabilities, competencies and performance across firms in the food supply chain • Create benchmarking process and tool to assist in extended and future comparison and evaluation

Team Members Jean Kinsey, Ph.D. Robert Kauffman, Ph.D. Theodore Labruzza, Ph.D. Jon Seltzer, Ph.D. David Closs, Ph.D. Cheri Speier, Ph.D. O. Keith Helferich, Ph.D. Dan Lynch, Ph.D. Ed McGarrell, Ph.D. Robyn Mace, Ph.D. Judy Whipple, Ph.D. Doug Voss, RA Alan Erera, Ph.D. Chip White, Ph.D. Steven Morris, RA

Competency Assessment Supply Chain Security Practice Competencies • Firm Demographics • Size • Channel location • Organizational responsibility Supply Chain Security Performance What practices are used? Which practices are more effective? How do they differ?

Competency Performance Drives Security Performance Service Provider Management (SPM) Process Strategy (PS) Public Interface Management (PIM) Infrastructure Management (IM) Metrics/Measurement (MM) Food Supply Chain Security Process Management (PM) Relationship Management (RM) Communications Management (CM) Process Technology (PT) Management Technology (MT)

Definitions of Competencies • Process Strategy(PS) – executive commitment to security and the institution of a culture of security • Process Management (PM) – the degree to which specific security provisions have been integrated into processes managing the flow of products, services and information • Infrastructure Management (IM) – security provisions that have been implemented to secure the physical infrastructure • Communications Management (CM) – internal information exchange between employees, managers, and contractors to increase security

Competencies (Continued) • Management Technology (MT) – the effectiveness of existing information systems for identifying and responding to a potential security breach • Process Technology (PT) – specific technologies implemented to limit access and trace the movement of goods • Metrics/Measurement (MM) – the availability and use of measurement to better identify and manage security threats

Competencies (Continued) • Relationship Management (RM) – information sharing and collaboration between supply partners • Public Interface Management (PIM) – the security related relationships and exchanges of information with the government and the public • Service Provider Management (SPM) – information sharing and collaboration between the firm and its logistical service providers

Ability to detect security incidents Reduction in the number of security incidents Increased resilience in recovery Changed risk profile Changed firm and supply chain cost, shrink, injuries, and turnover Improved security relative to competitors Improved ability to meet security requirements Performance Measures

What Capabilities (Practices) Create a Competency? One Example Communications Management

Research Process • In-depth company interviews • 15 manufacturers • 13 retailers • 7 transportation providers • Questionnaire Development • Overall Survey Response (total respondents = 239) • Food Products Association (134 – 58%) • Michigan Department of Agriculture (83 – 9%) • ASIS International (22 – 10%) • Respondents’ Scope of Responsibility • Quality Management (101 – 42%) • Supply Chain Management (36 – 15%) • Security Management (25 – 10%) • Other (57 – 24%) • Not Defined (20 – 8%)

Who Responded to the Survey – Size of Firm?

Initial Research Questions • Where are firms focusing their efforts? • Is there a difference between large and small manufacturers in competency focus? • Where are firms seeing results? • Is there a difference between large and small manufacturers in security performance?

Where are Manufacturers/Wholesalers Focusing Their Efforts? Score of 5 Indicates Strong Activity

Is There a Difference Between Large and Small Manufacturers/Wholesalers? * Indicates statistically significant difference in mean

Where are Manufacturers/Wholesalers Seeing Results? (SC) Score of 5 Indicates Significant Change

Is There a Difference Between Large and Small Manufacturers/Wholesalers? NOTE: Scale anchors: Significantly Increased – No Change – Significantly Decreased * Indicates statistically significant difference in mean

Is There a Difference Between Large and Small Manufacturers/Wholesalers? NOTE: Scale anchors: Significantly Increased – No Change – Significantly Decreased

Perceived Performance Results for Manufacturers/Wholesalers • The positive results are • Increased detection within firm and across supply chain • Increased firm and supply chain resilience • Decreased personal injury • However, there has been an increase in firm and supply chain operating cost

Further Research Questions • Do some firms consider security as a high strategic priority? • What do these firms do differently than low priority firms? • Do high priority firms have better performance results than low priority firms?

Strategic Security Construct • Our firm's senior management views supply chain security as necessary for protecting our brand or reputation. • Our firm has a corporate level strategy to address security concerns. • Our firm’s senior management views supply chain security as a competitive advantage. • Our firm’s senior management views supply chain security initiatives as a necessary cost of doing business. • Our firm’s senior management supports food supply chain security initiatives. 127 firms classified as high priority; 72 as low priority.

Is There a Difference Between High and Low Strategic Priority Firms? NOTE: Scale anchors: Strongly Disagree – Strongly Agree * Indicates statistically significant difference in mean

Do High Strategic Priority Firms Perform Better than Low Strategic Priority Firms? NOTE: Scale anchors: Significantly Increased – No Change – Significantly Decreased * Indicates statistically significant difference in mean

What Measures Impact Detection/Recovery for High Strategic Priority Firms? • Internal • Timely information to respond • Prevention information in employee training • Recovery information in employee training • External • Processes in place to recover from an incident in our supply chain • Our supply chain partners’ information systems are secure

The Creation of an Assessment and Benchmarking Tool • Survey for internal company use • Summary of results from company use • Benchmark of company results by item, competency, and total score

* Large gaps indicate problem areas * World Class is the sample mean plus 1 standard deviation

Food supply chain firms are increasingly interested in protecting their supply chains to protect their customers and brand names. Firms must develop a broad range of competencies to achieve supply chain protection. Firms have seen performance improvements in detection and resiliency. In general, firms embarking on supply chain security initiatives will, at least initially, increase firm and supply chain operating cost. Better performance is linked to extended supply chain security efforts throughout the supply chain. Conclusions

Enhancing Supply Chain Security