OECD Supply Chain Resilience Review

5. Risk management at the firm-level

Abstract

Supply chains are created and managed by firms, which are well positioned to provide insights on effective approaches to build resilience to shocks and disruptions. This chapter analyses the types of risks faced by firms and identifies successful practices. It highlights the role of “triple-A” supply chains – agile, adaptable and aligned – as a reliable source of resilience.

Policy actions in the wake of COVID-19 often focused on how to limit the risks of international sourcing, including diversifying supply or producing more closely to the domestic market. Such approaches are, to some extent, disconnected from the reality of international supply chains for three reasons. First, there are constraints on the location of production. Rubber trees or pineapples can only grow in certain places. This is not limited to primary commodities, as specific skills and knowledge also tend to be required from people or firms that are not necessarily available in the country of production. Consumers are also geographically dispersed and firms seeking to serve different markets may choose to establish in many different locations. There are also constraints in the geographical structure of supply chains and the choice of suppliers that do not allow for solutions such as repatriating all production.

Second, risks are everywhere, including in the domestic economy, and can affect multiple suppliers at the same time (as witnessed during the COVID-19 pandemic). Firms and governments seek responses to all types of risks and not just to risks identified for a specific type of input coming from a specific country. The next crisis may be very different from the scenario they have planned for.

Third, while there are risks when sourcing or producing internationally, there are also gains; a cost-benefit analysis generally suggests that some risks are acceptable. One can never eliminate all risks, so firms engage in what is called “real options”, deploying their activities across countries to balance the benefits and risks (Klibi, Trepte and Rice Jr., 2024[1]).

Supply chain operations are exposed to many types of risks (Box 5.1). As explained by Sheffi (2015[2]), there are “known knowns”, “known unknowns” and “unknown unknowns”. The “known knowns” are routine risks that firms face every day, such as small variations in demand and prices. They also include long-term trends that firms can anticipate, such as urbanisation or population ageing. The “known unknowns” are events that are random but for which probability can be estimated from historical evidence. They include natural disasters such as floods or tornadoes. Because the probability can be calculated, firms can insure against such risks. The “unknown unknowns” are events for which the likelihood cannot be calculated, or that have not been imagined. The COVID-19 pandemic belongs to this category because global pandemics are too infrequent for firms to specifically prepare for. This is where firms turn to the development of general resilience, i.e. abilities and processes that allow them to face any type of risk.

Box 5.1. Resilience, vulnerability, and risk management in supply chains

Resilience can be defined as the ability to adapt and transform in response to adverse events. A supply chain is regarded as resilient if it can quickly return to stable operations following a disruption. Resilience is measured through the speed and effectiveness of recovery and not through the absence of disruption. For example, the resilience of an automotive supply chain is evaluated based on the time it takes to rebuild or stabilise inventory.

Vulnerability, on the other hand, is the susceptibility to the negative consequences of a disruption, influenced by the likelihood of disruption and the preparedness for it. Firms categorise and identify potential risks using a matrix where risks are ranked based on their likelihood (i.e. their probability of occurring) and their severity (i.e. their potential economic impact). For example, port congestion is a high-likelihood risk but with little impact on supply chains except for some extra delivery time. A pandemic, on the other hand, is a low-likelihood risk (often described as a rare “black swan” event), but with an extremely severe economic impact.

The supply chain management literature identifies five distinct categories of risk (Wagner and Bode, 2009[3]):

• Demand-side risk can arise from volatile customer demand and self-inflicted variability through forecast inaccuracy or hoarding. There is a “bullwhip effect” in supply chains as changes in orders placed downstream by customers are amplified upstream due to the time lag in information and material flows.

• Supply-side risk includes supplier default, capacity constraints, quality or technological issues that limit the production capacity of firms and their ability to meet demand.

• Regulatory, legal and bureaucratic risk relate to measures taken by governments such as tariffs, trade sanctions or tax regimes, which can affect the organisation of supply chains and their costs.

• Infrastructure risk can create bottlenecks in logistics such as, for example, a port closure.

• Catastrophic risks, like a natural disaster, a war, or a global pandemic.

The first four types of risk result from relatively predictable1 uncertainty and require routine risk management practices. The fifth type, catastrophic risk, emerges from unpredictable uncertainties and requires disaster management strategies to achieve resilience.

1. The literature refers to the concept of “ergodic” risks. An ergodic process is one whose properties can be deduced from a single (sufficiently long) random sample of the process. Non-ergodic processes change erratically at an inconsistent speed.

5.1. Firms use various strategies to build resilient supply chains

Firms adopt various strategies to manage risks. They generally consist of three basic building blocks – introducing redundancy, building flexibility, and changing the corporate culture (Sheffi, 2020[4]; Sheffi and Rice Jr., 2005[5]).

• Redundancy involves maintaining safety stocks, back-up suppliers and excess capacity in order to absorb any increase in demand and continue to serve customers during the disruption. There is a cost associated with such a strategy as firms need to invest in redundant assets that are not used when there is no disruption.

• Flexibility relates to developing the dynamic capabilities, such as organisational learning and responsiveness, that allow firms to quickly adapt and change the organisation of their supply chains when a disruption occurs. Flexibility needs to be established in procurement, production, distribution and customer-facing processes, as well as in control systems.

• The culture of responsiveness plays a more important role than control systems or processes, since it shapes the sensitivity to early warning signals and effective execution of crisis response plans. It involves the adequate training of staff and managers, as well as decentralised decision making.

Efficient risk management strategies are built on a combination of these three blocks. For example, inserting redundancy without establishing a culture of responsiveness may not achieve resilience. Flexibility is generally considered superior to redundancy because it supports continuous improvement, problem-solving at all organisational levels and general competitiveness. The high costs of redundancy strategies create a trade-off between resilience and efficiency, while investments in flexibility can support both resilience and economic performance. This is why agile, adaptable and aligned supply chains, discussed below (Section 5.3) are the best way to achieve sustainable competitive advantage.

Resilience strategies are also tailored to the types of risks. For routine risks involving small fluctuations in supply or demand, the cost of redundancy strategies is acceptable, and firms can rely on their inventories to adjust supply to demand. Flexibility is the preferred strategy for more severe risks where inventories and backup capacity are not enough to absorb disruptions. The literature highlights that applying routine risk management tools to extreme “black swan” events (the “unknown unknowns”, as discussed above) can lead to waste, environmental burden and underperformance (Sodhi and Tang, 2021[6]).

5.2. Firms adopt a systemic approach to risks

While there is a push for policy measures aimed at compulsory stockpiling, geographic diversification, re-shoring or near-shoring, it is important to understand the complex nature of firms’ decisions when they have to reassess their sourcing and location strategies (Thakur-Weigold and Miroudot, 2024[7]).

First, the literature on risk management highlights that there are risks everywhere – in the domestic economy as much as in foreign economies from which key inputs are sourced (Christopher and Peck, 2004[8]). The nature of risks can be different, but there is no safe place to produce, and global disasters such as climate change or pandemics affect all economies (Sodhi and Tang, 2021[6]). Resilience strategies are needed for all types of risks and cannot focus only on risks related to foreign supply. The experience of the pharmaceutical industry highlights that many shortages of medicines are related to quality issues, such as contaminations in factories that lead to removing from the market large quantities of drugs that are no longer available for patients. The risk of contamination is the same in foreign countries and in the domestic economy in this regulated industry, where all suppliers (domestic or foreign) are subject to the same quality standards (Cuddy, Lu and Ridley, 2023[9]). Box 2.1 in Chapter 2 offers a deep dive into what’s guiding some of the sourcing decisions in the pharmaceutical industry.

In addition, strategies such as dual sourcing, diversification of supply, or re-shoring can increase the complexity of supply chains and may not always improve resilience (Mizgier, Wagner and Jüttner, 2015[10]). For example, geographic de-risking, such as re-shoring, friend-shoring or near-shoring, aims to reduce dependency on high-risk regions but often falls short of expectations. The reason is that only one segment of the supply chain (such as the final assembly) is generally re-shored or moved to another location, just pushing the risk associated with foreign supply upstream (Choudhary et al., 2022[11]). It is generally not possible to re-shore the whole supply chain (because there are many companies and industries involved, located in different countries, each with its own challenges when it comes to reshoring). Moreover, concentrating all production stages in the same location would create even higher levels of risks.

There are similar considerations regarding dual sourcing or diversification of supply at the firm level. On the one hand, it is useful to have several suppliers to ensure the security of supply for essential inputs. On the other hand, dual sourcing is not always feasible and for high-tech processes where very specialised inputs are needed, working with two suppliers is often more a source of risk than a solution (because the two suppliers will not deliver the exact same inputs and small differences can have a high impact on quality). In this case, firms prefer to build long-term relationships with suppliers they trust and who can solve problems when they arise (Jain, Girotra and Netessine, 2022[12]). Moreover, dual sourcing and diversification of supply also come with higher fixed costs and firms may prefer alternative less costly risk management strategies.

Second, firms try to balance the costs of holding inventory against the need for responsiveness. Firms that are best at managing risks and disruptions maintain balanced “Goldilocks”1 quantities of inventory (Sheffi, 2020[4]), which are neither too much nor too little to respond to daily volatility at a reasonable cost (Tang, 2006[13]). Despite debates on “just-in-time” versus “just-in-case” inventory management (Pisch, 2020[14]) lean management is still regarded as the most effective strategy to mitigate disruptions (Netland, 2021[15]; Choi et al., 2023[16]). The essence of lean management is not to eliminate inventories, but to rely on decentralised problem-solving to continuously optimise the production system. Toyota, the company that invented lean management, was the last car manufacturer to be affected by shortages of semiconductors in 2021-2022 (Shih, 2022[17]).

Third, the fact that participating in global supply chains entails several risks is not seen by firms as a reason to no longer source from abroad or to stop serving foreign markets. There remain gains from trade and many benefits from international production (Section 2.1) that firms are not ready to relinquish and that outweigh the costs associated with risks (Contractor, 2021[18]). Moreover, uncertainty is not just a vulnerability but also an opportunity. It is precisely the competitive advantage of global firms to benefit from market arbitrage, shifting production and exploiting opportunities in local markets. During COVID-19, GVC firms were more resilient due to this capacity to shift production (Giglioli et al., 2021[19]; Bonadio et al., 2021[20]). Global firms with the best risk management strategies generally benefit from crises because they respond faster than their competition to disruptions (Sheffi, 2015[2]; Sheffi, 2020[4]).

5.3. Triple-A supply chains can deal with uncertainty and change, while preserving the benefits of open trade

Top-performing firms tend to have supply chains that possess three different qualities. Described as “triple-A” supply chains (Lee, 2004[21]), they are (1) agile, meaning that they can react quickly to any change in demand or supply; (2) they are adaptable, as they can adjust over time to structural changes and evolving strategies; and (3) they align the interests of all suppliers in the production network, facilitating co-ordinated and co-operative responses. For these firms, therefore, flexibility is seen as the key to resilience.

In the “new (ab)normal” (Sheffi, 2020[4]) that characterises the environment in which supply chains have evolved since the pandemic, several authors have proposed revisiting this framework. For example, Cohen and Kouvelis (2021[22]) suggest a new “triple-R” model that would emphasise robustness, resilience and realignment. Robustness is the capacity to continue to produce during a crisis (Brandon‐Jones et al., 2014[23]; Miroudot, 2020[24]). The realignment envisaged by Cohen and Kouvelis (2021[22]) involves taking into account new contractual forms and business models along supply chains to create better co-ordination.

In 2021, Lee (2021[25]) proposed an updated version of his triple-A framework, highlighting that agility, adaptability and alignment are needed even more than before. With new digital technologies, such as the Internet of Things (IoT), big data and artificial intelligence (AI), supply chains can adjust more than before to any change in demand or supply and achieve “super-agility”. Moreover, adaptability in the supply chain is needed more than before with the rise of economic security concerns. Adaptability strategies should also cover the whole supply chain, now that supply chains have become more complex and international. Finally, the alignment of interests may have to go beyond all suppliers in a given value chain and be extended to a broader ecosystem involving a variety of stakeholders, such as governments and NGOs. More than just cost and resilience, alignment is increasingly about environmental and social issues (Section 4.2).

The next chapter outlines the characteristics of policy environments that enable the capacity of firms to operate within agile, adaptable and aligned supply chains.

References

[24] Baldwin, R. and S. Evenett (eds.) (2020), Resilience versus robustness in global value chains: Some policy implications, CEPR Press.

[20] Bonadio, B. et al. (2021), “Global supply chains in the pandemic”, Journal of International Economics, Vol. 133, p. 103534, https://doi.org/10.1016/j.jinteco.2021.103534.

[23] Brandon‐Jones, E. et al. (2014), “A contingent resource‐based perspective of supply chain resilience and robustness”, Journal of Supply Chain Management, Vol. 50/3, pp. 55-73, https://doi.org/10.1111/jscm.12050.

[16] Choi, T. et al. (2023), “Just‐in‐time for supply chains in turbulent times”, Production and Operations Management, Vol. 32/7, pp. 2331-2340, https://doi.org/10.1111/poms.13979.

[11] Choudhary, N. et al. (2022), “Does reshoring affect the resilience and sustainability of supply chain networks? The cases of Apple and Jaguar Land Rover”, British Journal of Management, Vol. 34/3, pp. 1138-1156, https://doi.org/10.1111/1467-8551.12614.

[8] Christopher, M. and H. Peck (2004), “Building the resilient supply chain”, The International Journal of Logistics Management, Vol. 15/2, pp. 1-14, https://doi.org/10.1108/09574090410700275.

[22] Cohen, M. and P. Kouvelis (2021), “Revisit of AAA excellence of global value chains: robustness, resilience, and realignment”, Production and Operations Management, Vol. 30/3, pp. 633-643, https://doi.org/10.1111/poms.13305.

[18] Contractor, F. (2021), “The world economy will need even more globalization in the post-pandemic 2021 decade”, Journal of International Business Studies, Vol. 53/1, pp. 156-171, https://doi.org/10.1057/s41267-020-00394-y.

[9] Cuddy, E., Y. Lu and D. Ridley (2023), “FDA Global Drug Inspections: Surveillance Of Manufacturing Establishments Remains Well Below Pre-COVID-19 Levels”, Health Affairs, Vol. 42/12, pp. 1758-1766, https://doi.org/10.1377/hlthaff.2023.00686.

[19] Giglioli, S. et al. (2021), The resilience of global value chains during the Covid-19 pandemic: the case of Italy, https://ideas.repec.org/p/frz/wpaper/wp2021_07.rdf.html.

[12] Jain, N., K. Girotra and S. Netessine (2022), “Recovering Global Supply Chains from Sourcing Interruptions: The Role of Sourcing Strategy”, Manufacturing & Service Operations Management, Vol. 24/2, pp. 846-863, https://doi.org/10.1287/msom.2021.0967.

[1] Klibi, W., K. Trepte and J. Rice Jr. (2024), Make smarter investments in resilient supply chains, https://sloanreview.mit.edu/article/make-smarter-investments-in-resilient-supply-chains/.

[25] Lee, H. (2021), “The New AAA Supply Chain”, Management and Business Review, Vol. 1/1, pp. 173-176, https://doi.org/10.1177/2694105820210101026.

[21] Lee, H. (2004), “The triple-A supply chain”, Harvard Business Review, Vol. October.

[10] Mizgier, K., S. Wagner and M. Jüttner (2015), “Disentangling diversification in supply chain networks”, International Journal of Production Economics, Vol. 162, pp. 115-124, https://doi.org/10.1016/j.ijpe.2015.01.007.

[15] Netland, T. (2021), “Just-in-time and the Covid pandemic”, Planet Lean, https://www.planet-lean.com/articles/just-in-time-pandemic.

[14] Pisch, F. (2020), “Managing global production: theory and evidence from just-in-time supply chains”, CEP discussion paper, Vol. CEPDP1689, https://cep.lse.ac.uk/pubs/download/dp1689.pdf.

[4] Sheffi, Y. (2020), The New (Ab)normal: Reshaping business and supply chain strategy beyond COVID-19, MIT CTL Media, Cambridge, MA.

[2] Sheffi, Y. (2015), The Power of Resilience. How the best companies manage the unexpected, The MIT Press.

[5] Sheffi, Y. and J. Rice Jr. (2005), A supply chain view of the resilient enterprise, https://sloanreview.mit.edu/article/a-supply-chain-view-of-the-resilient-enterprise/.

[17] Shih, W. (2022), “What really makes Toyota’s production system resilient”, Harvard Business Review, https://hbr.org/2022/11/what-really-makes-toyotas-production-system-resilient.

[6] Sodhi, M. and C. Tang (2021), “Supply chain management for extreme conditions: Research opportunities”, Journal of Supply Chain Management, Vol. 57/1, pp. 7-16, https://doi.org/10.1111/jscm.12255.

[13] Tang, C. (2006), “Perspectives in supply chain risk management”, International Journal of Production Economics, Vol. 103/2, pp. 451-488, https://doi.org/10.1016/j.ijpe.2005.12.006.

[7] Thakur-Weigold, B. and S. Miroudot (2024), “Promoting resilience and preparedness in supply chains”, OECD Trade Policy Papers, No. 286, OECD Publishing, Paris, https://doi.org/10.1787/be692d01-en.

[3] Wagner, S. and C. Bode (2009), “Dominant risks and risk management practices in supply chains”, in International Series in Operations Research & Management Science, Supply Chain Risk, Springer US, Boston, MA, https://doi.org/10.1007/978-0-387-79934-6_17.

Note

← 1.  In the classic children’s story, Goldilocks enters the home of three bears and samples their porridge to select the one which is neither too hot or too cold but just right, and then consumes her preferred choice.