Managing Risk in Your Organization with the SCOR® Methodology

1. Managing Risk in Your Organization with the SCOR® Methodology Dave Morrow, Taylor Wilkerson & Melinda Davey On Behalf of Supply Chain Risk Management Team, Supply Chain Council, Inc. February 20, 2009

2. SCC members have reported that less than half of enterprises have established metrics and procedures for assessing and managing supply risks and organizations lack sufficient market intelligence, process, and information systems to effectively predict and mitigate supply chain risks.  From this need arose the Risk Management Project Team approved by the SCC to enhance the SCOR model. The objective is to help organizations avoid/minimize costs, mitigate supply chain disruptions by managing risk proactively and thus, offering a competitive edge.  The session presents the outcome of a global multi-industry team that has worked passionately to integrate risk management into the SCOR model. Abstract

3. Global Risk Project Team Team Composition : Risk Management through SCOR Model Name Organization Represented Team Role • IBM • DRK Research • LMI • Satellite Logistics Group • Supply-Chain Council • Infosys Technologies, Ltd. • TechTeam Government Solutions, Inc. • TechTeam Government Solutions, Inc. • Transitions Group LLC • University of Bergamo • AROI • E.I. DuPont de Nemours & Co., Inc • Groenewout • Lockheed Martin Aeronautics • Booz Allen • eKNOWtion • AMR Research, Inc. • Cognizant • Grupo de ProducaoIntegradaCoppe/UFRJ • Bosch • Grupo de ProduçãoIntegrada • Supply-Chain Council (South East Asia) • Capgemini • Accenture • Dave Morrow • Dr. Kevin McCormack • Taylor Wilkerson • Deanna Yee • Melinda Spring • Mitul Shah • Melinda Davey • Ray VanderBok • John A. Deasy • Roberto Pinto • Avi Roseznberg • John M. Barineau • Maurice Uiterweerd • George Borowsky • Gregory Grehawick • Hitesh Attri • Mark Hillman • Nishanth Vallabhu • Andre Rego Macieira • Arne Ziegenbein • Daniel Vital Chiarini • Koh Juay Meng • Marc Finkelstein • Jade Rodysill Chair Team Lead Team Lead Coordinator Project Manager Key Member Key Member Key Member Member Member Member Member Member Member Member Member Member Member Member Member Member Member Member Member

4. Supply-Chain Council 4 • The SCC is an independent, not-for-profit, global corporation with membership open to all companies and organizations interested in applying and advancing state-of-the-art supply chain management systems and practices. • Founded in 1996 • Over 800Company Members • Cross-industry representation • Chapters in Australia/New Zealand, Brazil, Europe, Japan, North America, South East Asia, South Africa and China with petitions for additional chapters pending. • The Supply-Chain Council (SCC) has developed and endorsed the Supply Chain Operations Reference model (SCOR) as the cross-industry standard for supply chain management.

5. Supply-Chain Supplier processes Product Management Customer processes Product Design DCOR™ Sales & SupportCCOR™ Supply Chain SCOR ® 5

6. The SCOR Framework Plan Return Plan Plan Plan Plan Source Make Deliver Source Make Deliver Source Deliver Make Source Deliver Suppliers’Supplier Customer’sCustomer YOUR COMPANY Supplier Customer Internal or External Internal or External Supply Chain Operations Reference Model SCOR defines supply chain as the integrated processes of Plan, Source, Make, Deliver and Return, spanning your suppliers’ supplier to your customers’ customer, aligned with Operational Strategy, Material, Work & Information Flows.

7. SCOR Hierarchy EDI Supply-Chain Source S1Source Stocked Product S1.2Receive Product XML Standard SCOR definitions Company/Industry definitions

8. Maps to Organizations EDI Supply-Chain Source S1Source Stocked Product S1.2Receive Product XML Standard SCOR program Company/Industry implementation

9. What is Supply Chain Risk Management? The SCOR Model and Risk

10. What is Risk Management? Business Continuity Management (BCM), defined by the Business Continuity Institute as “a holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities” (BCI, 2005). Business Vulnerability, defined as an exposure to serious disturbances, arising from risks within the supply chain as well as risks external to the supply chain (Christopher, 2003). Vulnerability is a result of any weakness within a complex system that can seriously jeopardize its activities (Ayyub, 2003). Enterprise Risk Management (ERM) as a set of coordinated actions about protecting and enhancing share value to satisfy the primary business objective of shareholder wealth maximization (Chapman, 2006). Resilient enterprise meaning the ability of the company to recover quickly from a disruption (Sheffi, 2005).

11. The International Organization for Standardization (ISO, 2002) defines two of the essential components of risk: 1. losses (along with related amounts) and 2. uncertainty of their occurrence. In the financial industry, operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events (New Basel Capital Accord, 2006). Risk Defined

12. Risk & Supply Chain Supply Chain Disruptions • Any event that negatively impacts the intended functioning of the supply chain. Discrete Events (yes/no) • Can be a rare event or frequent event that happens at a specific instance in time • Internal (machine break down, fire, strike, product failure) • External (weather related, earthquake, etc.) Continuous Events (a matter of degree) • Internal (performance metrics variability, warranty trends) • External (supply / demand shifts, economic factors) • Sometimes group into buckets Risk in general can be defined as a collection of pairs of likelihood (L) and outcomes / impact (O) of events. The combination of all the (likelihood; outcome) pairs is called a risk profile. Definitions of risk must also have a time dimension or a specific time horizon (day, month, year, etc.) and a specific perspective or view that defines the scope (boundaries, what’s not included, etc.).

13. Supply Chain Risk Perspectives Global Environment Organization’s Environment Suppliers’ Environment Customers’ Environment Organization Supplier Facing Customer Facing Suppliers (And outsource Manufacturing) Customers Internal Facing Relationship Risk Supplier Performance Risk Human Resource Risk Supply chain disruption risk Supplier Environment Risk Market Dynamics Risk Disaster Risk Political / Country Risk Supplier Financial Risk Regulatory Risk Financial Risk Distribution Risk Relationship Risk Market Risk Brand / Reputation Risk Product Liability Risk Environmental Risk Political/ Country Risk Operational Risk Technical Risk Financial Risk Legal / Regulatory Risk Environmental Risk HR / Health and Safety Risk Political/ Country Risk

14. Supply chain risk management is the systematic identification, assessment, and quantification of potential supply chain disruptions with the objective to control exposure to risk or reduce its negative impact on supply chain performance. Potential disruptions can either occur within the supply chain (e.g. insufficient quality, unreliable suppliers, machine break-down, uncertain demand etc.) or outside the supply chain (e.g. flooding, terrorism, labor strikes, natural disasters, large variability in demand etc.).  Management of risk includes the development of continuous strategies designed to control, mitigate, reduce, or eliminate risk. Supply Chain Risk Management Defined 14

15. Why is Supply Chain Risk Management Important? The SCOR Model and Risk

16. Supply Chain disruptions are a reality GM Halts Work at More Plants Due to Strike at Parts Supplier Chrysler Shuts Down Four Plants Baxter Pulls Remaining Heparin from the Market • Mattel had massive recall due to lead content in paint. • United States experienced significant disruptions from Long Beach longshoreman strike. • United States experienced significant disruptions when borders and air transportation shut down after 9/11. • Fuel distribution in the United Stated was disrupted after hurricane Katrina damaged pipelines. • Nokia production shut down due to supplier plant fire. • Kobe earthquake resulted in computer memory shortage, impacting multiple companies • UPS strike severely impacted ability to ship small packages in the U.S. • Others…

17. Large Reputation Impacts Source: The View of the Supply Chain From Wall Street – J. Stuart Francis - Lehman Brothers, February 2003

18. Mattel Toys to Be Pulled Amid Lead Fears 18.5% Decline On a $10 Bil Market Cap Or 1.9 Bil loss Verbal Report To CPSC "We heard in early July that we had a possible issue," said Mr. Walter, who added the company stopped production in the Chinese factory around July 7. After further investigation, Mattel approached the Consumer Product Safety Commission with a verbal report July 20. A written report was filed July 26. The product is being recalled under the "fast-track" recall program whereby Mattel has admitted to the contamination and the CPSC hasn't done additional testing.

19. Supply Disruption Profiles Detection and response Recovery - minimized Sustaining Impact = 0 Initial Impact Full Impact – Avoided! Sustaining Impact >0 Initial Impact Detection and Response Preparation Preparation Full Impact Performance Recovery Disruption Event Time

20. Strategies that focus on customer service (e.g., reliable delivery) or where the cost of late or lost deliveries are high will have low tolerance for risk. Strategies that focus on cost reduction or where the cost of late deliveries is low will have a higher tolerance for risk. Ultimately, the tolerance for risk will determine how much the enterprise will invest in mitigation measures vs. reactive efforts. Strategies & Risk Tolerance What is the business impact of a broken supply chain? How much are you willing to risk?

21. How does Supply Chain Risk Management fit in the SCOR Model? The SCOR Model and Risk

22. Supply chain risk management (SCRM) is a means for ensuring uninterrupted customer service. The SCOR Model is a framework for modeling and managing supply chain processes, practices and performance. SCOR 9.0 will include Risk Management processes, practices, and performance indicators. Using SCOR as a Risk Management foundation will provide a better SCRM program. Faster implementation More comprehensive identification of potential risks Better application of SCRM best practices Better SCRM coordination with customers, suppliers, and stakeholders. SCOR model as the foundation of SCRM

23. Where does SCRM fit within SCOR?

24. SCOR Enable Processes Source Deliver Return Plan Make Manage Business Rules EP.1 ES.1 EM.1 ED.1 ER.1 Manage Performance of Process EP.2 ES.2 EM.2 ED.2 ER.2 Manage Process Data Collection EP.3 ES.3 EM.3 ED.3 ER.3 Manage Process SC Inventory EP.4 ES.4 EM.4 ED.4 ER.4 Manage SC Capital Assets EP.5 ES.5 EM.5 ED.5 ER.5 Manage Integrated SC Transportation EP.6 ES.6 EM.6 ED.6 ER.6 Manage Process Configuration EP.7 ES.7 EM.7 ED.7 ER.7 Manage Process Regulatory Compliance EP.8 ES.8 EM.8 ED.8 ER.8 Manage Supply Chain Risk EP.9 ES.9 EM.9 ED.9 ER.9 Manage Financial Plan Alignment EP.10 Manage Supplier Agreements ES.10

25. Risk Management utilizing the SCOR model Process Area Set up “rules” and strategies Assign “perspectives”, roles and responsibilities Assess, analyze, organize, communicate and mitigate (S,M,D,R Enablers) Coordinate, align Monitor and act PLAN X X X (PLAN only) X X (PLAN only) SOURCE X X MAKE X X DELIVER X X RETURN X X

26. Typical Enabler High Level Flow Internal Information External Information InternalInformation Monitoring Monitoring External Monitoring Risk Management Program for Process Area Internal Adjustments External Adjustments InternalAdjustments Risk Management Program for Process Area -External Risk Management Program for Process Area - Internal EP.1- Manage Business Rules ES1- Manage Sourcing Business Rules EP.2- Manage SC Performance ES.2- Assess Supplier Performance ES.3- Manage Source Data EP.3- Manage Plan Data Collection ES.4- Manage Product Inventory EP.4- Manage Integrated SC Inventory EP.5- Manage Integrated SC Capital Assets ES.5- Manage Source Capital Assets EP.6- Manage Integrated SC Transportation ES.6- Manage Incoming Product ES.7- Manage Supplier Network EP.7- Manage Planning Configuration ES.8- Manage Import/Export Requirements EP.8- Manage Plan Reg. Compliance ES.10- Manage Supplier Agreements EP.10- Align SC Unit Plan with Financial Plan Overall Supply Chain Risk Plan/Results Overall Business Risk Management Program (Rules, strategies, tools, etc. (Bus Strategy) EP.9 Manage Supply Chain Plan Risk EP Suppliers Internal Rules Resources Plan / Results ES.9 Manage Supply Chain Source Risk Customer & Product ES Customer & Supplier

27. SCRM Best Practices Coordinated Risk Management Visibility and Quantification of Risk Supply Chain Designed for Risk Formal Risk Management Best Practices Supply Chain Risk Management 10 Best Practices under the following categories: • RM Programs’ Coordination with Partners • Sourcing Risk Mitigation Strategies • Crisis Communication Planning • Supply Chain Risk Identification • Supply Chain Risk Monitoring • Supply Chain Risk Assessment • Configure to Reduce Risk : • Supply Chain Business Rules • Supply Chain Information • Supply Chain Network • Supply Chain Risk Management

28. Best Practices - Formal Risk Management Supply Chain Risk Management (SCRM) Systematic identifying, assessing, and resolving of potential disruptions in supply chain networks with the objective to reduce their negative impact on the network’s performance

29. Best Practices - Visibility & Quantification of Risk Supply Chain Risk Identification Supply Chain Risk Monitoring Creating of a list potential events that could disrupt or harm any aspect of the supply chain’s performance (more details included in exercises) Creating of a list potential events that could disrupt or harm any aspect of the supply chain’s performance (more details included in exercises) Supply Chain Risk Assessment • Quantifying risk to understanding of where the greatest risks may exist in order to prioritize resources for risk mitigation and management • Measures include Likelihood and Impact (more details included in exercises)

30. Best Practices - Coordinated Risk Management Risk Management Program’s Coordination with Partners • Coordinating risk management with your supply chain partners by emphasizing cooperation among departments within a single company and among different companies of a supply chain to effectively manage the full range of risks as a whole • Establishing a Risk Management Coordination Committee Sourcing Risk Mitigation Strategies Includes strategies to address source risks, for example multiple sources of supply, strategic agreements with suppliers, and supplier partnerships (more details included in exercises) Crisis Communication Planning Creating a plan for managing a crisis when it occurs (more details included in exercises)

31. Best Practices - Supply Chain Designed for Risk Supply Chain Business Rules Establishing business rules (e.g., customer priority, supplier priority, production routing, transportation routing, etc.) based on minimizing the risk to the supply chain Supply Chain Information Managing supply chain information networks to minimize the risk to the supply chain. This includes information sharing with partners as well as internal locations. This helps all parties to be quickly informed of a real or potential disruption and respond quickly and appropriately to minimize the disruption impact. Supply Chain Network Designing node locations, transportation routes, capacity size and location, number of suppliers, number of production locations, etc. in a fashion that mitigates potential disruptions to the ability to deliver product and service to the end customer Several things can be configured to reduce risk:

32. Risk Management Implementation using the SCOR Model five phase approach.

33. Value-At-Risk Metric Value-at-risk (VaR) is a category of risk metrics that describe probabilistically the market risk of a trading portfolio. Value-at-risk is widely used by banks, securities firms, commodity merchants, energy merchants, and other trading organizations. Such firms could track their portfolios' market risk by using historical volatility as a risk metric. They might do so by calculating the historical volatility of their portfolio's market value over a rolling 100 trading days. 3 1 2 4 The historical volatility would illustrate how risky the portfolio had been over the previous 100 days. Source:www.riskglossary.com

34. Risk Measures Hierarchy Total Supply Chain Costs ($) Level 1 Supply Chain Value at Risk (Gross VaR) Supply Chain Residual Risk ($, %) Supply Chain Mitigated Risk ($, %) By PSMDR Supply Chain Value at Risk (VaR $) Supply Chain Mitigation Costs ($) Supply Chain Event Risk (EVAR $) Level 2 Supply Chain Value at Risk (VAR $) By PSMDR Supply Chain Event Risk (EVAR $) By PSMDR Supply Chain Mitigation Cost($) By PSMDR Mitigated Risk by Category ($) By PSMDR & individual performance metric & event category Value at Risk (VAR $) By PSMDR & individual performance metric Risk by Event (EVAR $) By PSMDR & individual event category Mitigation Cost($) By PSMDR and event Level 3 Internal Enabler Process and Data Quality measures

35. Value-at-Risk (VaR) Quantifies the value of potential disruptions in terms of both Probability (likelihood) and impact on the supply chain. Target P – Probability (i.e. 10 out of 100 total occurrences) I1 P1 Impact 1 I2 Impact 2 P2 Event 1 Event 2 T Value at Risk (VAR) = (P1 x I1) + (P2 x I2) P = percentage of total negative events I = impact of event

36. Which supplier (AA or NW) has the highest risk (likelihood of being late)? Ave % Late by Airline Risk Event – Late Arrival NW AA

37. VaR - Illustration Historical Data Historical Data Late Events Late Events VaR Table Assume 1 Min Late = 1 USD Min Late Min Value at Risk for AA Note: there is a broader range of values than for NW Value at Risk for NW

38. AA and NW Comparison Supplier Ave % Late VaR NW 30.87% 14.24 31.00% AA 19.60 Which supplier (AA or NW) has the most impact to the business? Which supplier (AA or NW) has the most risk?

39. Case Study – Bio World Meter and Core Kit Plastic Injection Molding Mfg. Assembly, Test Pack Instrument Contractor Channel Electronic Circuit Mfg. Care Kit Strips in Bottle Customers Plastic Roll Suppliers (circuit) Bottle and Lid Supplier (w/ desiccant) Test Meter Bio World 12 pack of Strips in Bottles Channel Care Kit Plastic Roll Suppliers (plain) Adhesive Suppliers Chemical Suppliers A,B,C Strips

40. Case Study Risk Identification

41. Risk Assessment Note: All costs are in ‘000 $

42. Risk Mitigation Note: All costs are in ‘000 $

43. Risk Mitigation – Action Plan

44. Supply chain risk management (SCRM) is IMPORTANT The SCOR Model is a framework for modeling and managing supply chain processes, practices and performance. Using SCOR as a Risk Management foundation will provide a better SCRM program. SCRM provides ROI, competitive advantage and improvement opportunities. SCOR model as the foundation of SCRM

45. When & where can I start to: “Manage Supply Chain Risk in Our Organization with the SCOR® Methodology”? The SCOR Model and Risk

46. Access to the SCOR model version 9.0 SCC members can access the full model online which contains the recent additions for supply chain risk management processes, best practices, & metrics Risk Project – Phase 2 Volunteer for the next phase of the Risk Project involving: Risk in DCOR Research Additional enhancements to SCOR & DCOR SCRM using SCOR training Next class offered on March 19, 2009 in Houston, Texas, USA) SCRM with the SCOR® Methodology - Resources

47. One Day SCOR SCRM Workshop • Supply Chain Risk Management (SCRM) Fundamentals • Introduction to each SCRM component and how each can support the firm's supply chain management • Discussion of SCRM process and all components • Presentation of several example projects and discussion of component use for each specific project • The SCOR Model and Risk management • Background, components, strategies and implementation • Participants who complete this works will be able to • Understand the purpose and goals of SCRM within the context of their firm and supply network • Develop a basic SCRM strategy and plan for their organization • Understand and articulate the business value of a SCRM program • Prerequisite - Attendees must be conversant in the basic SCOR model in order to attend this workshop. The SCOR Framework training includes the required basics

48. Q & A