Modeling Supply Chain Risk for Operational Supply Chain Planning

Transcription

1 for Operational Supply Chain Planning Research-in-Progress Iris Heckmann Department of Logistics & Supply Chain Optimization, Research Center for Information Technology, Karlsruhe, Germany Tina Comes Centre for Integrated Emergency Management, University of Agder, Grimstad, Norway ABSTRACT As today s supply chain (SC) networks are globalized complex systems planning and optimizing SC processes is harder than ever. Unexpected deviations and disruptions can lead to devastating and far-reaching consequences. Hence, the management of SC risk (SCR) is of fundamental importance. The literature on SCR is, however, mostly of anecdotic nature; only few authors present empirical research. So far no unanimous framework has been developed to explicitly quantify SCR and the underlying SC vulnerability drivers. To ensure that SCR management can be realized as a continuous process, SC managers, seek solutions that integrate SCR analysis in their routines and planning processes. Therefore, the challenge is to model SCR in a way that is both transferable to models of proprietary operational SC planning engines and suitable for quantitative SCR analysis. In our work, we combine simulation and operational SC planning to identify factors that enhance the vulnerability of complex SC systems. Keywords Supply chain risk modeling, quantitative supply chain risk analysis, scenario-based simulation, operational supply chain planning, system-based vulnerability analysis INTRODUCTION Making decisions implies managing risk. Unfortunately, the importance of considering risk in supply chains (SCs) has not been acknowledged for a long time, whereas risk-considerations have a long history in other fields, such as finance, insurance or health care. Recently, events like power outages, labor strikes, supplier glitches, epidemics or terrorist attacks have become more frequent. Despite their growing frequency of occurrence, the magnitude and characteristics of any of the aforementioned events is still such that they are hardly expected, and the SC disruptions caused by these events led to numerous corporate losses (Hendricks and Singhal, 2003, 2005, 2005b; Norrman and Jansson, 2004; Simchi-Levi, Kaminsky and Simchi-Levi, 2008; Sheffi, 2007; Waters, 2007). Additionally, the increasing competition between SCs has increased pressure on SC officers to manage these new kinds of problems both in their own companies and across the SC (Eskew, 2004). Beyond an increasing trend in the frequency of worldwide disasters (Coleman, 2006) and their total economic impacts (Elkins, Handfield, Blackhurst and Craighead, 2005; Munich Re Group, 2003, 2007), the main SC-inherent reason for the increased number of disrupted SCs is the implementation of efficiency-increasing processes. These practices and innovations have increased SC vulnerability (SCV): most supply networks evolved into global and complex systems, characterized by a large number of participating companies, fragile (just-in-time and lean) relations between them and increasingly volatile markets. Therefore, SCs are extremely sensitive to the consequences evoked by both environmental disasters and intracorporate disruptions. According to a survey of American AMR, however, disruptions caused by external processes are less controlled and therefore riskier than intra-corporate processes (Hillman and Keltz, 2007). While in the past, disruptive events were mostly isolated and could be contained in a specific region or economic sector, recently it has become more and more difficult to limit the impact of disruptions. A health crisis in Asia became a problem Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

2 for a technology manufacturer in the Middle East (Eskew, 2004); the West Coast Port Lockout in the US became an export problem in South Korea (Sheffi, 2007) to name just few examples. Due to increased complexity and globalized processes, SCV becomes harder to asses when seemingly unexpected events take place. The primarily raison d'être of a SC is the fulfillment of customers wishes, i.e. the delivery of goods as ordered. To avoid that resources or time are wasted, SC management (SCM) aims at executing this purely physical function as efficiently as possible. In order to succeed on highly competitive and dynamic markets, companies need to implement highly sufficient and efficient processes in their business strategies and logistic network. Efficient processes are designed to improve key performance indicators, reduce overall costs, and enable a firm or SC to concentrate on its core competences (Waters, 2007). The efficient achievement of customer satisfaction and value creation is threatened by disruptions and failure or increasing volatility of important SC factors directly related to logistic costs. Delayed inbound supply may, for instance lead to a machine disruption, which in turn delays the production, such that the company may not be able to satisfy their customers needs in time. In order to overcome this situation, a company may switch transportation mode once production is resumed; to make up for the delay, goods may be shipped by helicopter or airplane, which is much more expensive than shipment by truck or train. Socio-political turmoils, like the Arabic Spring, increase the volatility of the oil price and cost of other commodities and consequently transportation costs rise. In summary, in the recent past the need for considering risk in SCs has increased significantly. A survey of IBM Global Services identified risk management as one of the five fundamental challenges of SC management (IBM Global Services, 2009). Unfortunately, companies or their environments are not (yet) ready for techniques and attitudes that ensure an effective SC risk management (SCRM) (Economist Intelligence Unit, 2009). To initiate and facilitate cultural and organizational changes tools are needed that can help to identify, assess and compare risks. In fact, it has been stressed that the integration of risk analyses into the SC planning is one of the success factors of top SCs (IBM Global Services, 2009). In this paper, we outline an approach for appropriately modeling SCR for proprietary SC planning engines to enable quantitative SCR analysis. This approach combines scenario-based simulations with operational SC planning and contributes to the understanding of prevailing vulnerabilities within a SC. The remainder of this paper is organized as follows. The next section provides a brief literature review on the field of quantitative approaches to define and identify SCR. Subsequently, we briefly define SCR as it is understood in our approach. Next, we present our SCR modeling approach and a conceptual procedure applicable for SCR analysis within operational SC planning systems. Finally, we provide conclusions and future research topics. RELATED WORK A Taxonomy of Supply Chain Risk Generally, the notion supply chain risk is used to refer to an uncertain event that compromise a SC's functionalities with respect to production and transportation processes; customer s requirements and satisfaction; or costs. With the increasing importance of SCs (as opposed to the traditional view of individual businesses or bilateral relations) most authors focus on establishing SCR as a new category of risk with specific characteristics as opposed to other business risks (Wagner and Bode, 2008b). In this context, the majority of approaches uses risk to refer to the point of origin of the deviation or disruption (e.g., flood in Indonesia), others relate risk to the first affected point of impact (e.g., failure of 2 nd tier supplier in south eastern Asia). Accordingly, one distinguishes cause- and effect-oriented definitions of SCR (Jüttner, Peck and Christopher, 2003; Kajüter, 2007). Beyond these very generic considerations, each approach to describe SCR so far is very specific and tailored to the respective authors' research objective and the underlying understanding of a SC (Christopher and Peck, 2004; Frosdick, 1997). For a more detailed overview, we refer to Tang (2006a) and Waters (2007), who provide overviews on potential SCR categories. The dominant perception of risk, including SCR, is event-related, e.g., ISO defines risk R of a triggering event e by its probability P(e) and related harm S(e): R(e) = S(e) P(e). This perception is adopted to most SCR approaches, and consequently SCRs are typically categorized according to event types; in SCR analyses concepts dominate such as natural hazard, terroristic, socio-political or epidemic risk (point of origin related definition of SCR); or production shortage, supplier shortfall, transportation delay risk (point of impact). A triggering event is the root cause of SC specific impacts, where the degree of harm which can be derived from the SC s susceptibility or vulnerability depends on the SC's exposure to this event. The eruption of the Icelandic volcano in 2010, for instance, affected the level of inventory of nearly all automotive companies in Europe, but the impacts varied considerably. Some companies ran out of stock, while others were less exposed or their SC was less vulnerable against prolonged procurement lead times. For further information on exposure and vulnerability, we refer to the work of Asbjornslett (2009) or Wagner and Bode (2008). Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

3 Supply Chain Risk Identification A survey conducted by FM Global Europe and the market research firm Harris Interactive among financial and risk managers at 1000 companies in North America and revealed that almost three quarters of them consider hazards and SC disruptions as major threats to top revenues (Green, 2004). However, managing risks is not in itself a process that creates value. Rather, it requires investing resources, time and effort into an endeavor that shall enable the SC to avoid uncertain future losses. Highly competitive markets and pressure from shareholders require therefore that the investments made are well justified, i.e. information is needed about the monetary assessment of performance reduction caused by the aforementioned disruptions. Unfortunately, the literature on SCR assessment including quantitative identification and valuation is limited. While Hendricks and Singhal (2003, 2005, 2005b) determine the impact of disturbances on stock price, Wagner and Bode (2008b) empirically investigate the relationship between SCR and SC performance. Despite the lack of a clear understanding of SCR, various authors propose methodologies for its management. Although the details may vary, typically, it is recommended to establish a cyclic approach continuously following major phases (Waters, 2007): definition of strategy and goals; risk identification, assessment, and mitigation; monitoring and control. As this paper focuses on SCR identification, we introduce the related work in this area: The most common techniques for risk identification are statistical process control, critical path, or bottleneck analysis. Moreover forecasting, early warning intelligence systems, performance measurement systems, and deviation analysis have been proposed. All these approaches limit the search for risks to presumably risk-prone areas there is no systematic way to include unprecedented or emerging risks in the analyses. The application of creative and discursive approaches by the support of expert-based knowledge such as failure mode effect analyses (FMEA) or brainstorming need to be employed for compiling a comprehensive list of risks. Still, in today s complex societies and economies it is impossible to identify all possible risks (Rasmussen, 1997). DEFINING SUPPLY CHAIN RISK Current quantitative definitions on SCR refer to the knowledge of probability and harm. This section provides a description of our concept. We already discussed some of the problems related to the identification of risk events. Moreover, analytical approaches model SC uncertainties with probability distributions usually predicted from historical data. However, when adequate statistical data is not available, identification and assessment analyses will not provide reliable information (Peidro, Mula, Poler and Lario, 2009). This does not mean that SC managers must invest in the mitigation of low-probability-highimpact events. Rather, risk management should be well informed in the sense that potential implications of these events are taken into account in strategic and operational decisions. Instead of starting from an event, we therefore concentrate on the potential impact on the SC performance. This performance depends on SC factors, like production capacity, transportation lead time, customer demand, inventory level. A deviation from the expected nominal values of these values is a disturbance of the SC. Some of these disturbances may have an influence on target-values of relevant SC s performance indicators while others may not. In the first case, the SC is vulnerable; the latter case refers to a SC that is resilient. Therefore, we define SCR as the potential influence of SC factors on SC performance, i.e. the greater the impact of changing SC parameters on SC performance the higher the risk. In the following, we introduce our approach to SCR that relies on simulations and models of the underlying systems. In literature, there are some studies that also refer to simulations to model and analyze SCR. For instance, Wu and Olson (2008) model a three-level SC and determine expected values of SC performance with the help of random simulated data with representative distributions; Melnyk, Rodrigues and Ragatz (2008) design a computer-based discrete event simulation. However, these approaches do not link strategic SCR analysis to operational planning. Conclusions made in the SCR analysis have to be re-interpreted for the SC planning system and thus transferred to the operational data model. As risk largely depends on what we value or which impacts are considered as harmful, SCR depends on the specific SC strategy and goals. Therefore, the importance of performance indicators in the SCR assessment may differ from SC to SC. Consider an example from daily operational SC planning. The operator uses a system for short-to-mid-term planning to manage changes and deviations. For him/her, SCV relates to order fulfillment or capacity utilization. For a risk officer, who typically focuses on a mid-to-long-term horizon, SCV relates to performance indicators like costs of goods sold. Our approach integrates both perspectives, roles and time scales by employing the very same model for operational planning and strategic risk analyses. CONCEPTUAL ARCHITECTURE Decision models for production, transportation, and supply network planning are available on the market, but these solutions do not consider risk and are predominantly deterministic. Money, time and effort were invested for the development, Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

4 implementation and configuration of planning models, risk consideration, thus, should lean on or advance existing solution models. Our approach therefore models the uncertainty by the means of a scenario-based simulation framework that comprises an operational supply chain planning system. Following the event-based approaches described above, often SC managers try to identify the most important potential disruptive events and concentrate on defining adequate risk scenarios to understand their very nature. This procedure consumes considerable time and effort, and the results may not even be helpful, as managers typically already know the deterioration level of relevant performance indicators they are willing to accept. If they knew which SC processes have an influence on these indicators and if they knew how much these SC processes need to change such that the SC becomes vulnerable, they would be able to concentrate solely on those processes and to use resources for risk management more efficiently. Therefore, the primary goal of a risk analysis framework is to support both the identification of relevant, i.e. SCR-enhancing, SC processes and the assessment of SCR. Such a framework is intended to conduct stress tests of SC designs that are derived by strategic planning approaches. Stress tests with regard to SCR imply changes within relevant SC processes in order to evaluate the operational behavior of the SC design under those new conditions. SC processes are described by SC factors: a transportation process between two production plants, for instance, can be defined through SC factors like transportation time, transportation capacity, and transportation costs. Due to disruptive events these factors may change and result in modified values of performance indicator. When the transportation costs between two production plants increase due to rising oil prices overall logistics costs will increase, too. SC officers will accept increasing costs while the related tolerance range is still met. Instead of modeling triggering events by defining deviations for SC factors, our approach therefore starts with the definition of accepted SCV levels. Subsequently, our approach seeks to identify scenarios that violate these levels by deteriorating the SC s performance. In this context, we define a scenario as a description of a prospective situation (in terms of SC factors and their values). The approach seeks for the identification of those SC factors that have a meaningful influence on important indicators and it further yields to quantify value levels that lead to a vulnerable SC. Lost performance can be quantified by simulating a scenario in the SC planning engine so that the potential deterioration can be assessed. If the scenario performance is better than or equal to the accepted level, the deviations of SC factors applied within the scenario do not impose a SCR. As both, the operational planning system and the strategic risk analyzing system, use the same data model, SCV can be expressed in terms of their corresponding SC performance figures. The process described is based on three entities, which are shown in Figure 1: A SC manager, the simulation framework and the planning engine. The simulation framework is further divided into two sections. The front-end has an interface for communication with the SC officer and the backend works as an interpreter between front-end and planning engine. The process starts with the submission of SC manager s accepted level of performance deterioration (SCV). The front-end passes the definitions to the back-end, which in turn translates SC manager's expectations to valid information streams for the scenario generation step. Based on this information the scenario-generator creates scenario samples. As each scenario is represented by a set of data tables, these samples correspond to a series of manipulations of the baseline scenario tables (changed and/or unchanged rows in data base tables). Each sample, i.e. collection of changed data tables, is passed to one planning instance of the underlying planning engine. Planning results are analyzed and prepared for comprehensive reports in the risk analyzing component. In order to get meaningful and credible analytical results in the risk analyses-process, the planning system has to provide detailed planning information about both material and order flow through the SC with respect to process priorities and the availability of backup processes. The approach described induces some key challenges, which also motivate our methodological approach: (1) First of all it is crucial to model credible scenarios that reflect reasonable and traceable SC factor modifications especially with respect to circumstances that precede or come along with triggering events. (2) As we want to identify not only those SC factors that have meaningful influence on performance indicators and thus influence the extent of SCR, but also quantify the factor level that results in a deterioration of target values of performance indicators, many scenarios have to be planned. Due to computing time needed for planning and analyzing a single scenario efficient algorithms are needed that determine a set of scenarios representing the total scenario scope. Approaches from experimental design, especially those from response surface approximation, seem to be applicable as well as expandable for SCR issues. (3) After having identified SCR enhancing processes and assessed the extent of SCR, SCRM seeks for reducing or mitigating the detected SCR degree. The focus of this paper is to discuss relevant aspects with regard to SCR that have to be considered when scenarios are generated. Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

5 Figure 1: Process Flow Scenarios for operational Supply Chain Planning As outlined above, SC planning systems use SC factor levels as an input for modeling available resources within the SC and allocating incoming orders to free resources. To evaluate the consequences related to changes of SC factors on the underlying procurement plan and to quantify the resulting performance, SC planning input needs to be manipulated to resemble the characteristics of triggering events. Figure 2 presents the development of production capacity over time for different situations: nominal capacity levels represent values of production for the initial situation; scenario capacity represents disruptive situations. Without loss of generality we assume, that the nominal production capacity will remain constant over the planning horizon (T). In the presence of a disruption SC factor levels generally become worse, e.g., transportation time increases, production capacity decreases (see Figure 2 a), cost rise, and so forth. However, scenario generation has to respect the fact that a decrease of production capacity due to a triggering event will not remain constant over the whole horizon. Although disruptions with the development path illustrated in a) exist, they should be considered to be timely restricted within an operational planning horizon (see Figure 2 b)). In order to identify the threshold level of a SC factor that marks a SC as vulnerable, different levels of the production capacity at different time points within the planning horizon need to be evaluated (see Figure 2 c)). Error! Reference source not found. d) represents the characteristic profile of a triggering event (Sheffi, 2007, Simchi-Levi, 2008). The development path of SC factor levels for different scenarios has to adopt or at least to lean on this disruptive profile (see Figure 2 e)). Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

6 Figure 2: Defining SC factor levels A further dimension of SCR assessment is the point in time SC managers get informed about the disruption. The time before a disruption occurs is crucial for applying disruption or contingency management actions that can reduce or even mitigate negative consequences, compare Figure 2 f). SC officers being informed at an early stage (I 1 ) can re-allocate customer orders to non-affected production sites. The preparation time is limited, when information about an upcoming disruption (I 2 ) and the occurrence of the disruption are effective at the same time. To fully assess the effect of different preparation times on the deterioration of SC s performance the input data for the SC planning system has to be manipulated. The SC planning systems should provide the possibility to freeze planning results up to a certain point in time. The scenario generation can use this possibility to avoid the re-allocation of orders and the re-scheduling of production and transportation capacities prior to the information date. CONCLUSION Global companies operate in an uncertain world and face different kind of risks. The open question for them is: How much SCV are we willing to take? How much deterioration of relevant performance indicators would we bear, if we knew how exposed our SC is to uncertain events? From the logistical viewpoint we can approach this general problem by dividing the timeline into a short-term and a long-term horizon. For the short term horizon there are already solution available, which could identify shortages. However, if we want to analyze structural changes, like capacity expansions or alternative transportation, we will need a more strategic oriented tool. The identification and the assessment of SC risks in this strategic oriented environment is a fundamental challenge in the field of SCRM. In this paper we introduced the concept of a new risk analysis framework that follows a scenario-based simulation on top of an operational SC planning system. The architecture allows for the establishment of a continuous improvement process: Lessons learnt from the operational system can be adopted for the strategic system and vice versa. This is only possible, because both systems access to the same database. This data consistency is a kind of strength of the approach compared to other existing risk tools. While we define SCR as the potential influence of SC factors on SC performance our approach seeks to identify these factors and to quantify their threshold levels that mark a SC as vulnerable. SC experts may have the possibility and the overview to identify critical SC processes. However, they can neither specify the influence of each process nor the threshold that manifests SCV. Today, SCs are complex and highly interrelated networks and are characterized by a huge amount of SC factors, whose influence on target values of performance indicators has to be quantified. The complexity and interrelatedness of SCs results in interacting SC factors. A production capacity decrease at production node within the SC may not affect SC s performance. When this decrease comes along with an increase in transportation lead time of the subsequent transportation process performance indicators like service levels can deteriorate significantly. The interaction effect of subsequent processes Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

7 is quite obvious, the potential interaction of separated processes motivates the need for an automated SCR analysis framework that identifies and assesses those critical (interacting) factors. Once critical SC factors and their threshold levels are identified monitoring processes can be improved, because their focus can be limited to deviations of those critical factors. Scenario generation is crucial for valid SCR identification and SCV quantification. Scenarios have to reflect typical disruptive factor developments. In this paper we therefore provided insights into important aspects like the development path of SC factors and the point in time of information about the occurrence of triggering events. Running scenarios on every SC factor the amount of scenarios and consequently the computing time for SCR identification increases rapidly. Future research should focus on a systematic scenario-generation process in order to decrease the number of scenarios to be run by the planning engine, while still providing the chance to identify the threshold level of relevant SC factors. Scenario definitions and their corresponding scenario samples should be archived efficiently in order to provide fast access for further analyses. In the same way that SC factor deviations are evaluated the approach also allows for analyzing and assessing (reactive or proactive) mitigation options, e.g. the implementation of flexible fall-back positions, the increase of buffers or other alternatives. ACKNOWLEDGMENTS This material is based upon work supported by the German Federal Ministry of Research and Technology under Grant No. 01IS08026 and Grant No. 01MA Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not reflect the views of the Federal Ministry. Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,

8 REFERENCES 1. Asbjornslett, B. (2009) Assessing the Vulnerability of Supply Chains, in Zsidisin, G. A. and Ritchie, B. (Eds.) Supply Chain Risk, Christopher, M. and Peck, H. (2004) Building the Resilient Supply Chain, International Journal of Logistics Management, 15, Coleman, L. (2006) Frequency of man-made disasters in the 20th century, Journal of Contingencies and Crisis Management, 15, Economist Intelligence Unit (2009) Managing supply-chain risk for reward, acergroup.com 5. Elkins, D., Handfield, R. B., Blackhurst, J. and Craighead, C. W. (2005) 18 ways to guard against disruption, Supply Chain Management Review, 9, Eskew, M. (2004) Mitigating the supply chain risk, Coporate Strategy - Risk Management 7. Frosdick, M. (1997) The Techniques of Risk Management are insufficient in themselves, Disaster prevention and Management, 6,3, Green, M. (2004) Survey: Executives Rank Fire, Disruptions Top Threats, Best's Review, September 9. Hendricks, K. and Singhal, V. (2003) The effect of supply chain glitches on shareholder wealth, Journal of Operations Management, 21, 5, Hendricks, K. and Singhal, V. (2005) Association between supply chain glitches and operating performance, Management Science, 51, 5, Hendricks, K. and Singhal, V. (2005b) An Empirical Analysis of the Effects of Supply Chain Disruptions on Long-Run Stock Price Performance and Equity Risk of the Firm, Production and Operations Management, 14, 1, Hillman, M. and Keltz, H. (2007) Managing Supply Chain Risk in the Supply Chain - a Quantitative Study, AMR Research 13. IBM Global Services (2009) Smarter Supply Chains: The Chief Supply Chain Officer Study 14. Jüttner, U., Peck, H. and Christopher, M. (2003) Supply chain risk management: outlining an agenda for future research, International Journal of Logistics Research and Applications, 6, Melnyk, S.A., Rodrigues, A. and Ragatz, G.L. (2008) Using simulation to investigate supply chain disruptions, in in Zsidisin, G. A. and Ritchie, B. (Eds.) Supply Chain Risk -- A Handbook of Assessment, Management, and Performance, Norrman, A. and Jansson, J. (2004) Ericsson's proactive supply chain risk management approach after a serious subsupplier accident, International Journal of Physical Distribution & Logistics Management, 35, 5, Rasmussen, J. (1997) Risk management in a dynamic society: a modelling problem, Safety Science, 27, Sheffi, Y. (2007) The Resilient Enterprise, The MIT Press 19. Simchi-Levi, D., Kaminsky, P. and Simchi-Levi, E. (2008) Designing and Managing the Supply Chain, McGraw- Hill/Irwin 20. Tang, S. (2006) Perspectives in supply chain risk management, International Journal of Production Economics, 103, Wagner, S. and Bode, C. (2008) An empirical examination of supply chain performance along several dimensions of risk, Journal of Business Logistics, 29, Wagner, S. and Bode, C. (2009) Dominant risks and risk management practices in supply chains, in Zsidisin, G. A. and Ritchie, B. (Eds.) Supply Chain Risk -- A Handbook of Assessment, Management, and Performance, Waters, D. (2007) Supply Chain Risk Management, Kogan Page Limited 24. Wu, D. and Olson, D.L. (2008) Supply chain risk, simulation, and vendor selection, International Journal of Production Economics, 114, 2, Proceedings of the Nineteenth Americas Conference on Information Systems, Chicago, Illinois, August 15-17,