Assess Risk. Manage Risk. Do It Now...Then Repeat
While Enterprise Risk Management (ERM) continues to gain acceptance in the financial services industry as a means to address credit, market and operational risks, and improve performance of business operations, other industrial sectors have lagged behind in adopting a true enterprise-wide view of risks. Companies are now realizing that global sourcing and just-in-time lean manufacturing, while yielding significant cost savings, may have also increased their risk exposure to global risks. Now, with minimal inventory levels and efficient utilization of production capacity, the traditional buffers against disruptions are no longer available. To respond to this new competitive environment, businesses are beginning to enhance their current capabilities in managing global risks and mitigating impacts of disruptions. Here are some thoughts on how organizations can get started in rapidly identifying and assessing manufacturing and supply chain risks to enhance their operational awareness and responsiveness to said risk events.
1) Nominate a Cross-functional Team of Risk Experts
An extended team of experts from across an organization should be selected to help with rapid and thorough identification of risks. Team members can be chosen from among risk managers, statistical analysts, operations research analysts, manufacturing engineers, purchasing staff buyers, commodity experts, supply chain and logistics managers, operations IT systems experts, etc. Each team member is expected to represent their business unit and assist with identifying and gathering quantitative and qualitative risk data. Traditionally in most large organizations, risk management as an expertise has a corporate home in insurance and risk financing or audit services. However, the real risk owners for manufacturing and supply chain risks are in operations. Thus, we advocate that the team must include subject matter experts from business operations who have handled many of these supply chain and manufacturing disruptions in the past. These operations specialists can contribute significantly in identifying risks and explaining event severity from an operations perspective.
Among the team, there has to be a core team of "risk evangelists," who must take up the challenge to promote risk awareness across the entire enterprise, share risk management and mitigation successes, document and convey lessons learned, and leverage knowledge and experience to embed risk management in operations business processes. Early on in the process, the team should also obtain top management support and a management champion to help overcome organizational roadblocks, and drive improvements in operational awareness and responsiveness to risk events.
2) Convene the Cross-functional Team for Brainstorming to Identify and Map a Portfolio of Enterprise Risks
The portfolio should include financial, strategic, hazard, and operational risks. These four categories are chosen, as they are typically how risk management responsibilities have been divided and assigned to different business units in many large corporations. A simple high level risk categorization used in the map allows executives and mid-level managers to readily engage in the process of editing the map as well as identifying or taking ownership of some of the risks from the portfolio. This portfolio is an excellent starting place for manufacturing engineers and supply chain analysts to begin identifying risks that would affect their work, or they could impact through their operations responsibilities. The portfolio must include all possible enterprise risks that the team can identify. Capturing this full portfolio is important, for it demonstrates to top leadership that the team has been as thorough as possible in identifying risks. The portfolio will be a key tool for risk awareness discussions, for it encourages groups to talk openly about risks they can control, manage, or mitigate, and those risks that are outside their spheres of influence.
3) Step 3: Filter, Assess and Prioritize Risks
Once the risk portfolio is defined and agreed upon, the next step is to have the team filter down the broad portfolio to those risks that are relevant to manufacturing and supply chain operations. They could be boiled down manufacturing and supply chain risks. This exercise can generate valuable discussion on ownership of some of the risks, recognition that some risks do not have clear owners, and help the team to build a common understanding of the breadth of the company's portfolio of risks.
Once the subset portfolio of manufacturing and supply chain risks is identified, the next task is to construct a subjective risk map or "heat map" for the manufacturing and supply chain risks, and classify risks based on probability of occurrence and loss severity. Without collecting much statistical data, the team can subjectively place risks in the quadrants, and openly discuss which risks could most impact manufacturing and supply chain operations. Lastly, the loss severity assessment should also intuitively include how difficult and costly each risk is to mitigate.
Further division of the probability of occurrence into 4 categories (such as very unlikely, improbable, probable, very probable), and the loss severity into 4 categories (such as insignificant, minor, serious, catastrophic) can help clarify and distinguish among the different manufacturing and supply chain risks in terms of their overall impact. This refined classification will help the team to recognize the relative difference across all risks in terms of occurrence and severity, and help them arrive at a prioritized list in view of organizational metrics.
This subjective risk map can guide allocation of scarce resources (people, time, money) to subsequent risk modeling and analysis efforts. Once the prioritized risk map has been developed, the team can naturally create a Top-10 priority list of risks (We can formulate one later this week). The exercise of constructing a Top-10 list is important. As your team starts to form the Top-10 priority list, the team may have to revisit and adjust their probability and severity assessments on the risk map as well.
4) Work on All "Actionable Risks" and Integrate what has been "Learned" into Business Processes
Leaders can use this proposed approach to prioritize manufacturing and supply chain risks that can be strategically influenced or managed over time. We note that some risks are "out there" but nothing can be done about them. Managers should acknowledge these risks, and move on to other risks that are actionable. Secondly, enhancing risk management in manufacturing and supply chain operations amounts to changing organizational culture and priorities. This type of change has the promise of making operations more resilient and responsive to the dynamic environment, but cannot be achieved overnight. The risk maps and models can help multiple stakeholders visualize and comprehend cost-benefit tradeoffs of various mitigation efforts and impact on the overall enterprise. Risk management for manufacturing and supply chains is adopted in an evolutionary (rather than revolutionary) manner, because manufacturing and supply chains typically evolve over time, and sudden interruptions for the sake of better risk management can affect morale of the organization significantly. Management should consistently revisit the prioritized heat map of risks along with the top-10 risks to update actionable and urgent risks, and monitor how the firm is doing in enhancing operational responsiveness to manufacturing and supply chain risks.
What do you think the always take-aways will be from this exercise? Lets think about it and give some suggestions tomorrow. Please provide your comments, insights as well...