White Paper

Risk, Resiliency, and Supply Chain Modeling:

How to plan for and recover faster after disruption.

https://www.coupa.com/

Executive Summary:

Build risk and resiliency into supply chain models to reduce the impact of disruption Supply chains continue to face increasing constraints and complexities. As companies seek to enter new markets, adapt to changes in existing markets, and face the reality that disruption and change are here to stay, they must reckon with the fact that traditional supply chain risk management practices will need to adapt and evolve. The traditional tradeoffs will no longer serve supply chain organizations. Supply chains and networks used to prioritize cost, service, and cash tradeoffs above all else, but now they must also factor in risk and resilience.

Supply chains must be stress tested, examined for potential points of failure and points of resilience, and suppliers must be assessed for risk at the point of decision, not after the fact. These tasks are impossible without the assistance of a digital model of the physical supply chain. A digital model, or digital supply chain twin, allows organizations to perform these stress tests virtually so they can feel confident about how changes and disruptions and risks will impact their physical supply chains in advance.

And it is not enough to run these analyses once or twice a year. Instead, organizations must conduct supply chain modeling on a continuous basis.

In this publication, we will dive deeper into these issues and establish a framework and recommendations on how to best tackle the changing role of risk and resilience in supply chains.

Readers will walk away with a clearer understanding of supply chain risks, what supply chain resiliency means in today’s ever-changing environment, how to analyze risk, choose appropriate responses, and recover faster after a disruption.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 2

https://www.coupa.com/

Table of Contents

Supply chain organizations are weighing risk on par with cost. 4

Resilient supply chains and risk management 5

2.1 Definitions 5

2.2 Determining Risk and Appropriate Responses 6

2.3 Implications of Risk on the Supply Chain 9

Resiliency, Risk Analysis, and Response Using Supply Chain Modeling 10

3.1 The difference a supply chain models makes in resiliency analysis 11

3.2 Use scenario modeling for more accurate risk analysis 12

3.3 Navigate complex response selections 13

3.4 Post-Disruption Recovery 14

Conclusion 15

coupa.com Risk, Resiliency, and Supply Chain Modeling | 3

https://www.coupa.com/

Supply chain organizations are weighing risk on par with cost.

In an increasingly complex and fast-changing world, supply chain leaders are rethinking supply chain priorities. In the past, when the landscape governing supply chains was stable, supply chain leaders’ top concerns were centered around cost, cash, and service tradeoffs.

Even before the pandemic sparked a metaphorical earthquake through the supply chains, warning signs were in place: an over-concentration of supply of certain critical items, the limits of just-in- time inventory management and lean manufacturing, among others. While cost-effective, the limits of these practices were also exposed in the face of immense risk. Now, years after that global crisis, supply chain leaders face increasing profit pressures, volatile consumer purchasing behavior, regulatory changes, and — just as importantly — the need to ensure reliable, optimized supply even when disruption almost inevitably strikes.

It's more important than ever that supply chain leaders incorporate risk as a factor when planning and designing their supply chains. Complexity — whether that's due to geopolitical crises, uneven access to raw materials, or regulatory environments — will only continue to grow. Assessing risk cannot be left to the end of the supply chain planning process. It must be a core consideration, along with cost-effectiveness, service, sustainability, and other business objectives.

Framed in a more positive light, building in risk assessments and contingencies to create more resilient supply chains gives companies a competitive advantage. Companies that do this are less impacted by disruption and bounce back much faster after disruptive events, which means they are able to continue to meet customer demand and maintain customer satisfaction while meeting larger business objectives, which can also result in market share gains and improved margins.

And the good news is that just as supply chain priorities have evolved, so have the technology and practices to design and optimize them. By taking advantage of these opportunities, companies can gain a competitive edge as they reduce risk, plan for resiliency, and continue to make their supply chains more efficient.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 4

https://www.coupa.com/

Resilient supply chains and risk management According to a recent Gartner survey, 89% of companies experienced a supplier risk event in the past five years, but company awareness and plans to mitigate it lacked maturity.1 To reach a more comprehensive understanding of risk and resiliency, we must first define the types of risks leaders need to take into account and determine levels of risk and appropriate responses, then explore the implications of such risks.

89% of companies experienced a supplier risk event in the past five years

2.1 Definitions

Supply chain risk management (SCRM), as a subsection of supply chain management (SCM), focuses on identifying risks and planning steps to handle such risks. Supply chain resiliency defines to what extent a supply chain can withstand disruptions.

The most common definition of a resilient supply chain is its ability to quickly recover from disruptive events, ideally emerging stronger than before2.

However, with disruptions piling up and impacting supply chains more frequently the definition of the resilient supply chain will have to change. It likely will be impossible to recover to a pre-disruption state. Rather, resilient supply chains of the future should have the capacity to continuously morph into new states that enable them to operate under the new conditions prevailing post-disruption, however temporary, and do so repeatedly. In this sense, supply chain design must become more dynamic and flexible.

The definition of resiliency as one in which the supply chain is continuously morphing may sound

like plain vanilla SCM, where fluctuations in demand, supply, costs, and quality are the order of the day. But there is a difference. The new definition assumes that events that might be foreign to SCM under “normal” do occur. Frequently. This includes, but is not limited to:

• Extreme and very short-term imbalances, fluctuations, and unpredictability in demand, supply, costs, and quality

• Complete (if temporary) shutdowns of entire nodes or even clusters of nodes

• Breakdown of infrastructural elements (such as the capability to transport)

What SCM and SCRM do share is the need to balance diametrically opposed forces in the supply chain:

• Efficiency (hence profitability) v. Flexibility and responsiveness (prerequisites of resiliency)

• Further digitization for more, faster, and more accurate information v. a need for tighter cybersecurity

These forces are further elaborated in Section 2.3. Implications of Risk on the Supply Chain.

1 Supply Chain Risk Management. Gartner, https://www.gartner.com/en/supply-chain/insights/supply-chain-risk-management.

2 S.T. Ponis and E. Koronis, “Supply Chain Resilience: Definition of Concept and Its Formative Elements,” Journal of Applied Business Research

coupa.com Risk, Resiliency, and Supply Chain Modeling | 5

https://www.coupa.com/

2.2 Determining Risk and Appropriate Responses

Most conceptual frameworks, including the ISO 31000:2018 standard, define risk management as the repeated conduct of the steps below. With regard to SCRM, these steps should cover all material elements of the supply chain and connect the analysis both upstream to suppliers and downstream to customers.

Risk Management Process

Identify Evaluate Determine Response Plan Report Review

Identifying Risks

All the identified risks to the supply chain operation are captured in a risk register. The most common approach to distinguishing risks is to cluster them by impact and probability.

However, quantifying the probability of high-impact low-probability (HILP) events is very difficult. To compensate for this ambiguity, and at least refine the correlation of the risk to its supply chain impact, Coupa suggests adding two more dimensions to the clustering schema: predictability and source. Together, this creates the following schema:

• Probability: likely (e.g., sea-level increase) vs. unlikely (e.g., a heavy earthquake in central Europe)

• Impact: high (e.g., sea-level increase) vs. low (e.g., a small local flood)

• Source: external/event-driven (e.g., natural disasters, strikes, geopolitical risks) vs. internal (e.g. capacity constraints, sourcing dependencies, currency vulnerability, demand concentration)

• Predictability of:

• Timing: high (e.g., the sea level increase) vs. low (e.g., droughts)

• Scope of impact: broad (e.g., pandemics) vs. narrow (e.g., forest fires)

• Period of impact: long (e.g., pandemics) vs. short (e.g., storms)

• Frequency of recurrence: high (e.g., labor strikes) vs. low (e.g., earthquakes)

coupa.com Risk, Resiliency, and Supply Chain Modeling | 6

https://www.coupa.com/

Evaluating identified risks

Determining and Defining Responses

The identified risks are evaluated, ranked, and prioritized using methodologies such as the SMAUG model (or vulnerability maps:

After the risks are identified and evaluated, the appropriate responses are determined through the four T’s:

Seriousness

the relative impact of the risk

Manageability

the relative ability to mitigate or reduce the risk

Acceptability

the degree to which the risk is acceptable in a variety of terms (political, environmental, social, economic)

Urgency

the probability of the risk and, hence, the urgency to act

Growth

the potential for the risk to expand in impact or increase in probability

Terminate

the preferred option, whenever possible, is to terminate the root cause of the risk

Treat

measures are taken to reduce the likelihood of the risk and/or alleviate its impact in the case of occurrence

Transfer

another option is to transfer (elements of) the risk to another party (e.g., transfer the financial risk to an insurance company)

Tolerate

the level of the risk and its potential implications are deemed such that no further action is required

SMAUG

coupa.com Risk, Resiliency, and Supply Chain Modeling | 7

https://www.coupa.com/

Planning

Reporting

Review

The concrete steps to be undertaken for each response, once the trigger sets off, are planned and communicated to all concerned parties (“business continuity plans”)

Relevant risk information is regularly reported to all concerned parties.

All process steps are regularly repeated, and results are updated.

Section 3, Resiliency, Risk Analysis and Response Using Supply Chain Modeling elaborates on the necessity of using advanced analytics, specifically supply chain modeling, for Reporting and Review steps.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 8

https://www.coupa.com/

2.3 Implications of Risk on the Supply Chain

The requirements and feasibility of SCM responses to the risks identified will potentially differ by the risk cluster, industry, geography, and each company. However, the general direction of most responses is to make a supply chain more agile in responding to a disruption.

Two antecedents to agility should be distinguished.

It should be noted that increasing speed and accuracy at every supply chain node, for both flexibility and responsiveness, contains an inherent contradiction. It implies a broadly and deeply digitized supply chain, which can increase the vulnerability to both cybercrime and infrastructural disruptions.

The fundamentals of responsiveness are directionally the same as the ones for “normal time” SCM. Flexibility, on the other hand, is in most aspects diametrically opposed to efficiency and therefore comes at a cost. Hence the measures to increase flexibility should be chosen carefully, as they will vary both in their effectiveness of alleviating risks and in their costs. For example, to address risks with lower predictability, broader preemptive measures (such as the ones on standardization or product design) may be more suitable, while for risks with higher predictability, targeted responses (like buffering inventory) may be preferred.

1. The flexibility to have multiple options, through measures like:

• Standardizing processes

• Product design and manufacturing process-related measures (e.g., generic/interchangeable parts, modularity, late differentiation)

• Redundant capacity

• Buffer inventory

• Strategic management of critical suppliers and onboarding of substitutes for non-critical suppliers

• Availability of information for every critical process at every node of the supply chain (including suppliers and customers)

2. Responsiveness (or velocity). For example:

• Setting up processes and a team, or center of excellence, (which can be broadened with additional subject matter experts as needed) for risk analysis and responses at a strategic and tactical level.

• Setting up processes and a team (which may have overlaps with the above-mentioned team) for the coordination of post-impact measures at an operational level through a “war room”

• Endorsing a culture of distributed power, especially to empower local agents of the company to make very short-term decisions outside normal hierarchies in the case of an incident. This is sometimes called “democratized design.”

• Ensuring continuous and broad communication

• Reducing lead times (e.g., through near-sourcing or different transport modes)

• Increasing the speed and accuracy of information at every node of the supply chain (including suppliers and customers)

coupa.com Risk, Resiliency, and Supply Chain Modeling | 9

https://www.coupa.com/

Resiliency, Risk Analysis, and Response Using Supply Chain Modeling Supply chain modeling is essential to planning appropriate risk responses and producing substantiated resiliency analyses.

A supply chain model is the digital representation of the structure, product flows, and policies of a physical supply chain. It is created by transforming data into predetermined structures to determine improved future state structures, product flows, and policies. Importantly, these data templates and structures can be used in conjunction with mathematical algorithms to achieve optimal results.

Under the hood, modeling techniques can broadly be differentiated into optimization-based and simulation- based algorithms.

Optimization-based

Selects the most favorable solutions from a narrow subset of realistic, feasible solutions.

Simulation-based

Takes pre-determined policies and runs models to showcase a potential range of outcomes.

As the name suggests, optimization algorithms select “optimal” solutions (as defined through one or more optimization objectives) from a narrowed subset of feasible solutions (for example, due to capacity constraints) – and do so at once (as opposed to through an iterative process), by fulfilling all the criteria in the end-to-end supply chain.

Such results are superior to heuristics-based approaches, such as those employed with Microsoft Excel. While Excel is still the most-used method for analysis,5 heuristics-based approaches typically either arrive at significantly suboptimal solutions (due to the large universe of possible solutions) or are unable to define a feasible solution altogether (due to the complexity of the problem). The one limitation of optimization algorithms is that input parameters are treated deterministically. Therefore uncertainty is addressed by creating various scenarios and comparing their results.

5 Yossi Sheffi and James B. Rice Jr., MIT Sloan Management Review.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 10

https://www.coupa.com/

Simulation algorithms do not select from multiple choices. Rather, they replicate how the modeled supply chain network works, based on predefined policies (e.g., replenishment policies for inventory). While simulating each process, these algorithms can include uncertainty through probability distributions, so that the result of a process in the simulation differs with each reiteration.

Therefore, supply chain modeling for risk and resiliency should combine both optimization- based and simulations-based techniques.

3.1 The difference a supply chain models makes in resiliency analysis

Typical resiliency analysis focuses on obvious indicators, such as suppliers with the highest spend, sites with the highest volume, and customers or products with the highest profit contribution.6 However, potential vulnerabilities of a supply chain are not always in those places. A supply chain model can uncover hidden breaking points in unexpected places. In commodity suppliers, for example, these points can occur at small nodes, in the network, or in ostensibly minor components. Among other insights, a supply chain model can point at assets and processes that are being utilized at capacity, spot inbound single-sourced materials and outbound products, show volume or value concentration at particular nodes, identify bottlenecks in lead times, or quantify the impact of foreign exchange fluctuations on revenue and cost.

Such analyses may lead organizations to discover measures to increase supply chain resiliency that are independent of risks and their identified implications. Hence, these measures may be implemented even if no disruptions to the supply chain are assumed.

7 Yossi Sheffi and James B. Rice Jr., MIT Sloan Management Review.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 11

https://www.coupa.com/

3.2 Use scenario modeling for more accurate risk analysis

One benefit of scenario planning with modeling is the flexibility to have multiple options, through measures like:

• Understanding the implications of a disruption on the network

• Quantifying such implications, also considering the “disruption profile,”7 in terms of revenue and cost

• Prioritizing the results

• Scaling this process (for a comprehensive understanding of risks, typically many scenarios need to be analyzed and continuously iterated)

To understand the implications of a disruption, supply chain modelers work with business analysts and leaders to define scenarios that describe what will happen (e.g., which suppliers, plants, warehouses, and customers are affected and how, in what magnitude, for how long, and to what extent do they recover). These serve as the input parameters for the next steps in the analysis.

However, quantifying the effects of these scenarios on the entire supply chain is complex. First, the effects typically cascade through a variety of nodes and processes. Therefore, simplistic approaches, such as using Microsoft Excel, fall short of showing the full picture. They fail to capture and quantify the effects

on the end-to-end supply chain in its entirety. For example, especially in a constrained environment, the breakdown of a production asset at a particular manufacturing site may increase warehousing costs, create capacity shortages, and ultimately cause lost sales in entirely different parts of the network.

Second, these effects decrease revenue and increase operating costs over the recovery time period. These additional costs typically outweigh replacement costs of inflicted assets in the supply chain,8 often determined with methods calculating a probability- weighted replacement cost, like value at risk (VaR).9

Third, as mentioned earlier, the nature of HILP events makes forecasting probabilities for these scenarios almost impossible. Therefore, the total cost of each scenario on the supply chain lends itself to being a realistic and neutral measure for ranking and prioritizing them.10 Due to the above, in order to gain a more comprehensive and complete analysis of the implications of risks on the supply chain, organizations must engage in supply chain modeling.

8 Mizgier, Kocsis, and Wagner: “Data Analytics to Leverage the BI Insurance Proposition,” INFORMS Articles in Advance

9 https://en.wikipedia.org/wiki/Value_at_risk

10 D. Simchi-Levy, W. Schmidt and Y. Wei, Harvard Business Review.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 12

https://www.coupa.com/

3.3 Navigate complex response selections

Once the supply chain risks have been determined and their effects quantified, the most adequate responses for each scenario need to be selected from a list of options.

As with the scenarios, the biggest challenge is again one of ranking and prioritizing. First, many qualitative criteria need to be incorporated into the selection (e.g., public perception of the response), which typically are translated into scores that can be quantified and ranked. Then, the totality of the cost of the disruption, plus all costs of operating with the best-suited response during the recovery period, plus the (positive) effect of the response need to be quantified. For example, if a plant goes offline for a specific period, this will mean assets need to be replaced, items need to be shipped from another plant, and additional inventory needs to be held due to increased lead time. But the positive effect of the response is the partial alleviation of the loss in sales. All of these factors need to be accounted for and quantified. The complexity of the effects of each scenario on the supply chain and the (typically expansive) universe of feasible responses from which to select are extremely difficult to assess without a supply chain model.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 13

https://www.coupa.com/

coupa.com Document Title | 14

3.4 Post-Disruption Recovery

The benefit of incorporating supply chain modeling as part of SCRM is the flexibility to have multiple options:

A company that has implemented sound SCRM standards will likely be able to react quickly to disruption, with those measures that most effectively support the recovery process.

However, in most cases, recovery will take time, and with time comes additional variability and uncertainty. Hence, the recovery process needs to be monitored and adjusted, if the parameters assumed in the planning of the response deviate significantly. If, for example, an alternate recovery site is not able to keep up with the assumed supply or yield, such deviation needs to be captured, assumptions need to be adjusted, and recovery plans may need to be further tuned.

In Figure A (below), we show a sample of different recovery times and trajectories, creating a visual representation based on a mix of qualitative and quantitative data.

While recovery is rarely linear in either case, organizations that do not have the proper risk and resilience parameters in place tend to see greater losses in profits, recovery time, and other important markers. Meanwhile, organizations that regularly model for and account for risk and resilience in their supply chain design and practices are able to pivot quickly and reduce the impact of disruption.

Figure A: Disruption With v. Without Risk and Resilience Preparedness

coupa.com Risk, Resiliency, and Supply Chain Modeling | 14

https://www.coupa.com/

Conclusion It is clear that supply chains must become more resilient in the face of growing complexity. Traditional approaches to risk and resiliency have focused mainly on internal factors, lacked proactive visibility, and relied on inadequate data.

To build supply chains that truly account for and plan for resilience, companies must embrace keeping the models fresh and make the scenario planning ongoing, in what is referred to as “continuous supply chain design” to ensure they are quantifying risk on an ongoing basis.

They must also engage in a proactive form of supplier risk management to identify risks within the extended supply chain, and strategic sourcing to ensure that optionality is engineered structurally within the supplier network.

Modern supply chain networks are complex, and their components are highly interdependent. Resiliency and risk analyses – and the selection of effective responses to identified risk scenarios – must be supported with advanced analytics.

In sum, supply chain modeling with advanced analytics, modeling, and integrated processes can help companies achieve the following:

• Discover potential breaking points

• Test the performance of a hypothetical redesigned supply chain setup before making any changes to the real thing

• Identify and quantify the effects of specific risks on the end-to-end supply chain network

• Analyze and compare results from numerous scenarios

• Make better decisions when selecting risk responses

• Understand the most appropriate readjustments to responses during the recovery period

• Simplify the frequent repetition of the analysis

• Reduce the cost of recovery

In particular, modeling helps reduce the cost of recovery by minimizing lost sales, reducing additional capital expenditure for the replacement of lost assets, and reducing operational expenses during the recovery period. It can also lower the cost of insurance for supply chain operations by allowing companies to select more purposeful coverage.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 15

https://get.coupa.com/21-Continuous-Design-SpCh-ThankYou.html?utm_source=Coupa&utm_medium=Web-Content&utm_campaign=WC-2022Q4&utm_trm=All-Supply-Chain&utm_content=21-Risk-Resiliency-SC-Modeling&utm_last_engagement=PG23775A1 https://www.coupa.com/products/strategic-sourcing/?utm_source=Coupa&utm_medium=Web-Content&utm_campaign=WC-2022Q4&utm_trm=All-Supply-Chain&utm_content=21-Risk-Resiliency-SC-Modeling&utm_last_engagement=PG23778A1 https://www.coupa.com/

How Coupa Can Help In order to build resilience and mitigate risk, supply chain leaders need improved visibility into risk and compliance data to quickly assess where they need to take action so that they can respond in a timely manner. Coupa delivers the adaptive supply chain you need to minimize and mitigate risk.

Coupa Supply Chain Solutions, including Coupa Supply Chain Design & Planning (SCDP), powered by LLamasoft), deliver a powerful margin multiplier for companies. Many of the world’s most innovative companies, including 18 of the Gartner Supply Chain Top 25, use Coupa for Supply Chain Design and Planning. This success is driven by combining a powerful digital supply chain twin, integrated scenario planning, and a platform where tailored apps translate executive strategy into tactical supply chain decisions

The Coupa Total Spend Management platform also includes robust capabilities, one of which is Supplier Risk and Performance. This capability provides enhanced supplier risk tracking across a variety of factors, such as judicial, financial, and ecological considerations. Companies can incorporate these elevated risk scores into their supply chain design, evaluate alternate sources, and ultimately de-risk their supply chains.

Adapt to and predict disruptions before they occur, optimizing margins and operations across your entire supply chain with Coupa's Adaptive Supply Chain.

coupa.com Risk, Resiliency, and Supply Chain Modeling | 16

https://www.coupa.com/

Coupa makes margins multiply through its community-generated AI and industry leading total spend management platform for businesses large and small. Coupa AI is informed by trillions of dollars of direct and indirect spend data across a global network of 10M+ buyers and suppliers. We empower you with the ability to predict, prescribe, and automate smarter, more profitable business decisions to improve operating margins. Coupa is the margin multiplier company™. Learn more at coupa.com and follow us on LinkedIn and X (Twitter).

Learn more at coupa.com

https://www.coupa.com/ https://www.coupa.com/

Supply chain organizations are weighing risk on par with cost. Resilient supply chains and risk management 2.1 Definitions 2.2 Determining Risk and Appropriate Responses 2.3 Implications of Risk on the Supply Chain

Resiliency, Risk Analysis, and Response Using Supply Chain Modeling 3.1 The difference a supply chain models makes in resiliency analysis 3.2 Use scenario modeling for more accurate risk analysis 3.3 Navigate complex response selections 3.4 Post-Disruption Recovery

Conclusion