10. Risk, Resilience, Sustainability and Ethics

Introduction and Context

Logistics and supply chain management has traditionally focused on the efficient movement and storage of goods. Contemporary supply chains, however, must achieve more than low cost and reliable delivery. They must withstand disruption, comply with increasingly demanding regulations, reduce environmental harm, protect people and information, and maintain legitimacy in the eyes of customers, employees, investors, governments and communities.

A supply chain may be disrupted by natural hazards, geopolitical conflict, supplier failure, labour unrest, cyberattack, regulatory change, quality problems or sudden demand shifts. Efficiency-oriented systems often reduce inventory, supplier redundancy and spare capacity. These practices can lower operating cost, but they may also increase vulnerability. Resilience therefore requires managers to examine not only how a supply chain performs under normal conditions, but also how it absorbs shocks, adapts during disruption and recovers afterward.

Sustainability and ethics extend this analysis. A supply chain that delivers on time while exploiting labour, concealing emissions or transferring pollution to vulnerable communities cannot be regarded as strategically sound. Environmental, social and governance considerations have become connected with continuity, reputation, access to finance, market access and long-term competitiveness.

This chapter presents an integrated approach to risk, resilience, sustainability and ethical decision-making. It is particularly relevant to logistics projects in which students must diagnose exposure, compare alternatives, measure performance and justify recommendations.

Learning Objectives

By the end of this chapter, students should be able to:

1. Distinguish supply chain risk, vulnerability, resilience, continuity and sustainability.

2. Map operational, strategic, environmental, social, compliance and cyber risks.

3. Evaluate risk using likelihood, impact, exposure and control effectiveness.

4. Design continuity and resilience options, including redundancy, flexibility and collaboration.

5. Apply ESG, circular economy and carbon-accounting concepts to logistics decisions.

6. Identify human-rights, anti-corruption, data-protection and governance concerns.

7. Use ethical reasoning when commercial objectives conflict with social or environmental responsibilities.

8. Develop balanced recommendations supported by evidence, metrics and implementation priorities.

The Strategic Meaning of Supply Chain Risk

Supply chain risk is the possibility that an uncertain event or condition will negatively affect the flow of materials, information, money or services, or prevent the supply chain from achieving its objectives. Risk is not limited to dramatic events. Forecast bias, inaccurate master data, poor packaging, weak supplier qualification and unclear responsibilities can create persistent operational exposure.

Three related concepts should be separated. Vulnerability refers to the degree to which a supply chain is susceptible to disruption. Exposure describes the assets, activities or flows that may be affected. Resilience is the capability to prepare for disruption, absorb its consequences, adapt and recover while continuing to provide an acceptable level of service. Business continuity is the planned capability to maintain critical operations during and after an interruption. Continuity is therefore one component of resilience, while resilience also includes learning and adaptation.

Risk can be classified by source and by location in the supply network. Internal risks arise from processes, facilities, systems, people or decisions controlled by the organisation. External risks arise from suppliers, carriers, markets, governments, infrastructure, ecosystems or society. Risks may also be upstream, focal-firm, downstream or cross-network. A single event can produce several forms of risk: a flood may damage a supplier, close roads, interrupt electricity, delay production and create contractual disputes.

A useful distinction is between probability and impact. A low-probability event with catastrophic consequences may deserve greater attention than a frequent event with minor effects. Managers should also consider velocity, meaning how quickly the effect develops; persistence, meaning how long it lasts; detectability, meaning how easily warning signals can be observed; and interconnectedness, meaning how many other processes depend on the affected activity.

Mapping the Risk Landscape

Risk identification should begin with a clear description of the supply chain. The project team should map products, suppliers, facilities, transport routes, information systems, financial flows, regulatory dependencies and critical customers. A tier-one supplier map is often insufficient because disruption may originate at tier two or tier three, where the focal organisation has limited visibility.

A practical risk map combines several techniques. Process mapping shows where activities occur and where controls are located. Supply network mapping reveals concentration, geographic dependency and common suppliers. Failure mode and effects analysis examines how a process can fail, the consequences of failure, the likelihood of occurrence and the ability to detect the problem. Scenario analysis explores events such as port closure, ransomware, sudden sanctions or loss of a strategic supplier. Interviews and workshops add operational knowledge that may not appear in formal data.

A risk register converts analysis into an actionable management document. Typical fields include risk description, causes, affected objectives, owner, existing controls, likelihood, impact, early-warning indicators, response plan and review date. Scoring systems should be used carefully. A numerical score is a prioritisation aid, not an objective measurement of reality. A risk rated “medium” may be unacceptable if it concerns human safety, legal compliance or fundamental rights.

The following expression can structure a basic assessment:

Expected loss = probability of occurrence × consequence of occurrence

Where data are weak, qualitative scales may be appropriate, but the assumptions should be documented. More advanced projects may use scenario modelling, Monte Carlo simulation, network optimisation or sensitivity analysis. The objective is not to create false precision. It is to improve the quality and transparency of managerial judgement.

From Efficiency to Resilience

Resilience is not equivalent to holding large inventories or duplicating every supplier. Those measures may be useful, but resilience is a portfolio of capabilities. The central question is: what level of disruption must the supply chain withstand, for how long, and at what acceptable cost?

Important resilience capabilities include:

• Redundancy: alternative suppliers, routes, facilities, carriers or information systems.
• Flexibility: the ability to change volumes, products, modes, schedules or sources.
• Visibility: timely and reliable information about orders, inventory, capacity, events and dependencies.
• Agility: rapid decision-making and execution when conditions change.
• Collaboration: coordinated planning, information sharing and joint response with partners.
• Buffering: inventory, capacity, time or financial reserves that absorb variation.
• Adaptability: the ability to redesign the network after learning from disruption.

These capabilities involve trade-offs. Redundancy may increase cost and complexity. Local sourcing may reduce transport distance but increase unit cost or reduce access to specialised technology. Inventory improves service protection but can create obsolescence and environmental burdens. A resilient design should therefore be based on criticality rather than uniform duplication.

Business continuity planning normally identifies critical processes, minimum service levels, maximum tolerable disruption, recovery time objectives and recovery point objectives. It then specifies response roles, communication protocols, alternate facilities, manual procedures, data recovery, supplier contacts and escalation thresholds. Plans should be tested through simulations and exercises. A plan that exists only as a document is unlikely to perform well under pressure.

A mature organisation also conducts a post-event review. The purpose is not to assign blame but to identify root causes, control failures, delayed decisions and improvements required in the network. Resilience is strengthened when lessons are incorporated into contracts, facility design, inventory policy, technology architecture and governance routines.

Sustainability, ESG and Circularity

Sustainability in logistics concerns the long-term balance between economic viability, environmental protection and social well-being. ESG is a related reporting and governance lens. Environmental issues include greenhouse-gas emissions, energy use, air pollution, water consumption, waste, biodiversity and hazardous materials. Social issues include labour conditions, health and safety, human rights, inclusion, community effects and responsible sourcing. Governance includes accountability, anti-corruption, controls, transparency, board oversight and compliance.

ESG should not be treated as a separate reporting exercise. It influences network design, mode selection, packaging, supplier qualification, warehouse technology, procurement and customer service. For example, a transport decision based only on freight cost may overlook emissions, congestion, accident exposure and labour conditions. A total-value assessment considers financial, environmental and social consequences together.

The circular economy challenges the traditional linear model of take, make, use and dispose. Circular logistics supports product life extension, repair, refurbishment, remanufacturing, reuse, sharing and high-quality recycling. It requires reverse logistics, product traceability, suitable packaging, return incentives, inspection processes and markets for recovered materials. Circularity is not automatically sustainable: collecting low-value products over long distances may create more environmental impact than it avoids. Decisions should therefore be assessed across the product life cycle.

Carbon measurement is central to sustainable logistics. Organisations commonly distinguish direct emissions from owned or controlled sources, indirect emissions from purchased energy, and other value-chain emissions such as purchased transport, supplier production, business travel, use of sold products and disposal. Emissions calculations typically require activity data, such as fuel consumed, kilometres travelled, tonnes moved or electricity purchased, combined with appropriate emission factors.

A simple transport estimate is:

Emissions = activity data × emission factor

For freight, activity may be expressed as tonne-kilometres, though actual fuel, load factor, empty running, routing and vehicle type affect results. Good carbon accounting defines organisational and operational boundaries, documents assumptions, avoids double counting and improves data quality over time. Carbon reduction claims should not rely solely on offsets. Priority should generally be given to measuring accurately, avoiding unnecessary movement, improving utilisation, shifting to lower-emission modes where feasible, adopting cleaner energy and then addressing residual emissions transparently.

Human Rights, Compliance and Ethical Decision-Making

Logistics decisions can affect people who have little power to influence commercial terms. Risks include forced labour, child labour, unsafe workplaces, excessive working hours, wage violations, discrimination, harassment, modern slavery, unsafe transport practices and displacement of communities. Responsible sourcing requires more than a supplier signature on a code of conduct. It involves risk-based due diligence, worker voice, credible audits, corrective action and escalation when violations are not addressed.

Compliance covers laws, regulations, permits, trade controls, customs requirements, competition rules, data protection, product safety, environmental obligations and anti-bribery standards. Compliance is a minimum requirement, not a substitute for ethical conduct. An action may be legal yet irresponsible—for example, using a legal contractual loophole to transfer severe safety risks to vulnerable subcontractors.

Ethical decision-making becomes difficult when objectives conflict. A project team may face a choice between a low-cost supplier with uncertain labour practices and a more expensive supplier with stronger controls. A manager may need to decide whether to disclose a forecast error that could trigger penalties, or whether to delay shipment to investigate a safety concern. Ethical analysis should make affected stakeholders visible and should not reduce every decision to shareholder cost.

A practical ethical process includes five questions:

1. What are the facts, uncertainties and assumptions?

2. Who may be affected, including workers, communities and future stakeholders?

3. Which laws, contractual duties, professional standards and organisational values apply?

4. What alternatives prevent or reduce harm while meeting the legitimate objective?

5. Can the decision be explained openly and defended if made public?

This process can be supported by rights-based reasoning, which protects fundamental rights; utilitarian reasoning, which compares total consequences; justice-based reasoning, which examines fair distribution of benefits and burdens; and virtue ethics, which considers the character and integrity of the decision-maker. No single approach resolves every dilemma, but using more than one perspective reduces ethical blind spots.

Cybersecurity and Digital Supply Chain Risk

Digital systems connect suppliers, warehouses, carriers, customers and financial institutions. This connectivity improves visibility but creates cyber exposure. Threats include ransomware, credential theft, malware, data manipulation, denial-of-service attacks, fraudulent payment instructions and compromise of connected operational technology.

Cyber risk should be assessed as a supply chain risk rather than an information-technology issue alone. A warehouse management system outage may stop picking; manipulated inventory data may trigger incorrect replenishment; a compromised transport platform may expose customer information or redirect cargo. Controls include multifactor authentication, least-privilege access, network segmentation, encryption, secure backups, patch management, vendor due diligence, incident response exercises and tested recovery procedures.

Technology also supports risk and sustainability management. Control towers can combine shipment, inventory, weather and event data. Analytics can identify unusual delays, supplier concentration or empty kilometres. Internet-of-Things devices can monitor temperature, location and equipment condition. Artificial intelligence may improve forecasting and anomaly detection, but its outputs depend on data quality and model governance. Automated decisions require human oversight, explainability where appropriate, protection against bias and clear accountability when recommendations are wrong.

Illustrative Case: Resilience and Responsible Sourcing at Meridian Components

Background. Meridian Components, an illustrative manufacturer of industrial control equipment, purchased electronic modules from one low-cost overseas supplier. Its project team had achieved high inventory turns and relied on a single port and a single enterprise platform for order visibility.

Situation. A regional disruption closed the supplier’s plant for three weeks and restricted port operations. At the same time, a cyber incident interrupted electronic data interchange. Meridian had limited visibility beyond its direct supplier. A proposed emergency source could deliver quickly but had unresolved concerns relating to excessive working hours and weak worker-safety controls.

Analysis. The team mapped the network and identified concentration risk in the supplier, port, component specification and digital interface. The module was classified as critical because no immediate substitute existed and customers used the finished equipment in safety-sensitive applications. The team assessed probability, impact, recovery time, detection capability and existing controls. It also identified an ethical risk: accepting the emergency source without due diligence could expose workers to harm and create legal and reputational consequences.

Approach. Meridian adopted a staged response. In the short term, it prioritised orders according to customer criticality, used a qualified alternate transport route and restored communication through a verified manual process. It engaged the emergency supplier only after an accelerated assessment covering worker safety, labour practices, quality and traceability. The supplier had to provide a corrective-action plan and permit independent follow-up.

For the medium term, Meridian qualified a second supplier in a different region, redesigned the module for component substitution, increased a targeted strategic buffer and required suppliers to report sub-tier dependencies. It introduced multifactor authentication, offline backups and cyber-incident notification clauses. For sustainability, the project team compared transport, inventory and supplier alternatives using cost, service, carbon and labour-risk measures rather than unit price alone.

Outcome. The organisation restored critical deliveries without accepting an unexamined labour risk. Its revised network cost slightly more under normal conditions, but it reduced dependence on one source and improved recovery capability. The project also established a cross-functional risk committee involving procurement, logistics, information security, quality, legal and sustainability personnel.

Learning points. First, resilience depends on design choices made before disruption. Second, visibility must extend beyond tier-one suppliers and include digital dependencies. Third, emergency procurement does not suspend ethical responsibility. Finally, a recommendation is stronger when it measures service, cost, carbon, human-rights exposure and cyber control together.

Implementation Challenges and Common Mistakes

Organisations often underestimate risks because departments hold fragmented information. Procurement may know supplier prices, logistics may know route performance, information security may know system vulnerabilities, and sustainability teams may know emissions data, yet no one sees the full dependency. Cross-functional governance is therefore essential.

Another mistake is confusing certification with actual performance. A certificate or audit report may indicate a control framework, but it does not guarantee safe conditions, accurate emissions or resilient operations. Supplier assessments should be risk-based, proportionate and supported by evidence.

Overreliance on risk scores is also dangerous. Scores can conceal uncertainty, encourage superficial ranking and create a false sense of control. Scenario analysis should include severe but plausible events, cascading effects and simultaneous disruptions. Managers should also account for behavioural risk: incentives that reward only cost reduction may encourage concealment of problems.

Sustainability projects face data limitations, inconsistent boundaries and greenwashing risk. Claims should be specific, comparable and supported by traceable evidence. Carbon reductions must be distinguished from avoided emissions, offsets and changes caused by reduced business activity. Social performance is particularly difficult to measure because worker experience may not be visible through conventional audits.

Resilience investments can fail when they are implemented without governance. Each major risk should have an accountable owner, defined indicators, a response threshold and a review cycle. Useful indicators may include supplier concentration, recovery time, forecast error, percentage of critical suppliers assessed, inventory coverage, cyber incident response time, emissions per shipment, injury rates, corrective-action closure and grievance resolution.

Current Developments and Best Practice

Several developments are reshaping logistics risk management. Geopolitical fragmentation is increasing attention to regionalisation, trade compliance and strategic materials. Climate change is encouraging organisations to assess physical risks to facilities, transport corridors and suppliers. Regulatory expectations increasingly require disclosure and due diligence across value chains. Customers and investors are demanding more credible evidence rather than broad sustainability statements.

Best practice is characterised by integration. Leading organisations connect enterprise risk management with supply chain design, procurement, continuity, cybersecurity, sustainability and ethics. They use scenario-based planning, maintain current network maps, test recovery plans, develop supplier collaboration and make trade-offs explicit. They also distinguish critical risks from merely inconvenient risks and allocate resources accordingly.

For a logistics project, a strong recommendation should normally contain: a clearly bounded problem; a network and stakeholder map; evidence-based risk prioritisation; alternative responses; cost and service implications; carbon and social assessment; legal and cyber considerations; implementation responsibilities; indicators; and a review mechanism. The recommendation should state what is known, what is uncertain and what assumptions must be validated.

Chapter Summary

Supply chain risk concerns uncertainty that can impair flows, performance or objectives. Vulnerability, exposure, resilience and continuity are related but distinct concepts. Effective risk management begins with mapping physical, informational, financial, regulatory, social and environmental dependencies, including critical lower-tier suppliers.

Resilience combines redundancy, flexibility, visibility, collaboration, buffering and adaptability. Continuity plans define critical processes, recovery objectives, responsibilities and tested response procedures. Sustainability integrates economic, environmental and social considerations, while ESG provides a framework for governance and performance disclosure. Circular logistics supports reuse, repair, refurbishment and recovery but must be assessed across the life cycle.

Carbon measurement depends on reliable activity data, appropriate emission factors and transparent boundaries. Human-rights due diligence, compliance, cybersecurity and ethical reasoning are essential because logistics decisions affect workers, communities, customers and future generations. The most robust project recommendations make trade-offs visible and evaluate cost, service, resilience, carbon, ethics and governance together.

Key Terms

Supply chain risk: The possibility that uncertainty will impair supply chain objectives or flows.

Vulnerability: The degree to which a supply chain is susceptible to disruption.

Exposure: The assets, processes or flows that may be affected by a risk.

Resilience: The capability to prepare for, absorb, adapt to and recover from disruption.

Business continuity: The planned capability to maintain critical operations during interruption.

Redundancy: Provision of alternative resources, suppliers, routes or facilities.

Flexibility: The ability to change operations in response to changing conditions.

Visibility: Timely knowledge of relevant supply chain events, status and dependencies.

Risk register: A structured record of risks, controls, owners, indicators and responses.

Scenario analysis: Examination of possible future disruption conditions and consequences.

ESG: Environmental, social and governance dimensions of organisational performance.

Circular economy: An economic model that retains products, materials and value through reuse, repair, refurbishment and recovery.

Carbon accounting: Measurement and reporting of greenhouse-gas emissions using defined boundaries and activity data.

Human-rights due diligence: A process for identifying, preventing, mitigating and addressing human-rights impacts.

Modern slavery: Severe exploitation involving forced labour, trafficking or related coercion.

Business continuity plan: A documented arrangement for maintaining and recovering critical activities.

Recovery time objective: The targeted time within which a process or system should be restored.

Cybersecurity: Protection of digital systems, information and operations from unauthorised or harmful activity.

Greenwashing: Misleading presentation of environmental performance or claims.

Ethical decision-making: A reasoned process for considering duties, rights, consequences, fairness and affected stakeholders.

Review Questions

Short Answer Questions

1. Distinguish vulnerability, exposure and resilience in a supply chain.

2. What is the purpose of a supply chain risk register?

3. Explain the relationship between activity data, emission factors and carbon measurement.

4. Identify four capabilities that contribute to supply chain resilience.

5. Why is compliance not always equivalent to ethical conduct?

Long Answer Questions

1. Explain how a logistics project can map and prioritise risks across a multi-tier supply network.

2. Discuss the trade-offs between efficiency and resilience, using inventory, supplier diversification and transport capacity as examples.

3. Explain how ESG and circular economy principles influence logistics network design.

4. Describe the main elements of an effective business continuity and recovery programme.

5. Discuss the role of human-rights due diligence, cybersecurity and governance in responsible supply chain management.

Analytical / Application Questions

1. A company depends on one overseas supplier, one port and one digital ordering platform. Develop a risk assessment and recommend a resilience portfolio, explaining the cost, service and sustainability trade-offs.

2. An emergency supplier offers critical components at half the normal price but cannot provide evidence of safe labour conditions. Apply at least two ethical frameworks and recommend a decision process.

3. Design a dashboard for a logistics project that combines resilience, carbon, human-rights, compliance and cybersecurity indicators. Explain why each indicator is useful and identify possible measurement limitations.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from business continuity?

A. Resilience concerns only inventory, whereas continuity concerns only transport.

B. Resilience includes preparation, absorption, adaptation and recovery, while continuity focuses on maintaining and restoring critical operations.

C. Resilience is a legal requirement, whereas continuity is always voluntary.

D. Resilience measures emissions, while continuity measures labour conditions.

Correct Answer: B. Resilience includes preparation, absorption, adaptation and recovery, while continuity focuses on maintaining and restoring critical operations.

Question 2

A supplier has a low probability of failure but provides a component with no substitute and a very long recovery time. What is the most appropriate conclusion?

A. The risk can be ignored because its probability is low.

B. The risk should be assessed as potentially high because impact and persistence may be severe.

C. The risk is eliminated by using a risk register.

D. The risk is operational only and does not require strategic attention.

Correct Answer: B. The risk should be assessed as potentially high because impact and persistence may be severe.

Question 3

Which action most directly improves supply chain visibility?

A. Removing all supplier reporting requirements

B. Mapping only the organisation’s internal warehouses

C. Tracking relevant events, dependencies and status across critical supply tiers

D. Increasing inventory without collecting information

Correct Answer: C. Tracking relevant events, dependencies and status across critical supply tiers

Question 4

Which is an example of circular logistics?

A. Disposing of returned products without inspection

B. Increasing single-use packaging for all shipments

C. Recovering, refurbishing and reselling usable products through a reverse logistics system

D. Choosing the cheapest transport route regardless of waste

Correct Answer: C. Recovering, refurbishing and reselling usable products through a reverse logistics system

Question 5

The basic calculation ‘activity data multiplied by emission factor’ is used to estimate what?

A. Supplier concentration

B. Greenhouse-gas emissions

C. Recovery time objective

D. Cybersecurity maturity

Correct Answer: B. Greenhouse-gas emissions

Question 6

Why should an organisation not rely solely on supplier certification when assessing human-rights risk?

A. Certification always increases transport cost.

B. Certification may not reveal actual worker conditions or unresolved violations.

C. Certification applies only to financial reporting.

D. Supplier certification prevents all forms of collaboration.

Correct Answer: B. Certification may not reveal actual worker conditions or unresolved violations.

Question 7

Which control would most directly reduce the risk of unauthorised access to a logistics information system?

A. Multifactor authentication and least-privilege access

B. Increasing shipment batch size

C. Reducing the number of product categories

D. Replacing carbon reporting with financial reporting

Correct Answer: A. Multifactor authentication and least-privilege access

Question 8

A logistics project recommends a cheaper supplier but ignores unsafe working conditions. Which principle is most clearly violated?

A. Stakeholder and ethical responsibility

B. Demand smoothing

C. Load consolidation

D. Inventory turnover

Correct Answer: A. Stakeholder and ethical responsibility

Question 9

What is the main purpose of scenario analysis in supply chain risk management?

A. To guarantee that a disruption will not occur

B. To examine plausible disruption conditions and evaluate response options

C. To replace all operational data with assumptions

D. To measure only historical transport cost

Correct Answer: B. To examine plausible disruption conditions and evaluate response options

Question 10

Which recommendation best reflects integrated supply chain decision-making?

A. Select the lowest unit-cost option without further analysis.

B. Evaluate alternatives using cost, service, resilience, carbon, social risk and governance criteria.

C. Prioritise emissions alone, regardless of service or safety.

D. Transfer all responsibility to the carrier.

Correct Answer: B. Evaluate alternatives using cost, service, resilience, carbon, social risk and governance criteria.