Exposure refers to unforeseen events that exploit a vulnerability and disrupt a supply chain. There
are four main sources of exposure: force-majeure shocks (natural disasters), macropolitical (economic shocks), malicious actors (cyberattacks); and counterparties (fragile suppliers). As shown in the current COVID-19 crisis, these shocks can affect supply and demand in varying and even contradictory ways, with demand in freefall for many classes of goods, even as suppliers strain to deliver medical products and similar necessities.

Understand your supply chain’s structure
Now is the time for business leaders to know their supply-chain structure and understand its vulnerabilities and exposure—and that of their suppliers, and of their suppliers’ suppliers. Many organizations can only speak in general terms beyond the Tier 1 level, even though this is often where the most critical suppliers sit within a network. Creating a comprehensive view of the supply chain through detailed subtier mapping is a critical step to identifying hidden relationships and nodes of interconnectivity that invite vulnerability.

Build transparency through analytics

In many industries, gaining transparency from an outside-in approach is difficult. However, combining the mosaic of publicly available data and network- analytics algorithms can illuminate the probable supply chain for many companies.

Once visible, network analytics can be used to quantitatively diagnose the relative fragility of the supply chain, and draw meaningful comparisons with peers and industry benchmarks. Supply chains that have higher concentration, interconnectivity, depth (in terms of subtier layers), and codependence—or that show low substitutability and transparency—are the most vulnerable (Exhibit 2). Large organizations often have several different archetypes of supply-chain networks within their overall system, each implying a different degree of resiliency.

Collaboration to build transparency

Companies can work more closely with their Tier 1 suppliers to build more transparency—especially given that Tier 1 suppliers are likely to have similar concerns as their customers about supply issues in the lower tiers. However, collaboration is often viewed as a fraught territory, with supplier networks viewed as proprietary, and to create a more cooperative working environment can involve a deep change of mind-set.

A few guidelines to build transparency across the supplier network can help ease concern. Companies do not need to disclose every detail to their suppliers, but to effectively perform network planning, transparency of inventory levels, capacity, and flexibility can give a lens into potential bottleneck issues. We suggest organizations begin to tackle issues in a structured way, cataloging and addressing known risks while improving the organization's resilience for the inevitable unknown risks that can become a problem in the future. 

Tailoring the organization to maintain transparency over time

More advanced companies have permanent supply-chain risk-management teams and processes in place. The leading automotive OEMs, chemicals, and electronics companies with very complex global supply chains generally belong to this group. The information cascade between the supply-chain risk-management team and other functions, such as marketing, IT, and legal is well-established, with clearly defined interfaces. They work to increase transparency throughout multitier supply chains, with elders in supply-chain risk management setting up databases of suppliers across tiers that includes each supplier's location, performance, and audit results.

Challenge established investment and design decisions
Supply-chain risk ultimately lies at the cross-section of vulnerability and exposure. A robust mitigation framework considers these factors and prioritize risk across three dimensions to ensure effective mitigation and continuity planning: the likelihood of the risk manifesting, the financial impact, and the organization’s ability to mitigate.

Typically, companies struggle to quantify risks, and fall back on methodologies that generate a discrete point estimate versus a range of outcomes. This approach often results in systematic over-optimism that minimizes the expected value of catastrophic risks because of a perceived low probability. Given risk management is inherently a probabilistic field, companies need to get comfortable with uncertainty in forecasts and continue to take an insurance-like mindset centered on buying down risk, especially for large risks with lower probability.