1. Foundations of Global Supply Chain Risk and Resilience

Introduction and context

Global supply chains connect suppliers, manufacturers, logistics providers, distributors, financial institutions, technology platforms, regulators, and customers across countries and continents. These networks create access to specialized capabilities, lower-cost production, broader markets, and economies of scale. At the same time, they expose organizations to events and conditions that may interrupt material flows, information flows, financial settlements, or customer service.

A disruption may arise from a natural hazard, geopolitical conflict, cyberattack, supplier failure, labour dispute, transport bottleneck, quality incident, regulatory change, demand shock, or financial crisis. The consequences are rarely confined to the location where the event begins. A factory shutdown in one country may delay production elsewhere; a shortage of a specialized component may stop an entire assembly line; and a cyber incident affecting a logistics platform may prevent goods from being released even when inventory is physically available.

Supply chain risk and resilience management therefore concerns more than emergency response. It involves understanding how exposure is created, how vulnerability develops, how risk propagates through networks, and how organizations can prepare for, absorb, adapt to, and recover from disruption. The subject combines strategic management, operations, procurement, logistics, information systems, finance, engineering, and organizational behaviour.

This chapter establishes the conceptual foundation for the subject. It distinguishes closely related terms, explains the evolution of supply chain risk management, introduces major analytical models, and considers how managers can balance efficiency with resilience.

Learning objectives

After studying this chapter, students should be able to:

1. Define risk, uncertainty, vulnerability, disruption, robustness, agility, adaptability, redundancy, recovery, and resilience.

2. Explain how globalization and interdependence influence supply chain exposure.

3. Distinguish between hazards, exposure, vulnerability, consequences, and supply chain risk.

4. Describe the evolution from traditional risk management to integrated resilience management.

5. Apply conceptual frameworks to identify and assess supply chain risk.

6. Explain the managerial trade-offs between efficiency, leanness, flexibility, redundancy, and resilience.

7. Evaluate the role of visibility, collaboration, technology, governance, and ethical decision-making.

8. Use a practical case to interpret supply chain disruption and formulate resilience responses.

From supply chains to interconnected risk systems

A supply chain is often represented as a sequence: raw-material suppliers provide inputs to manufacturers, manufacturers produce goods, logistics providers transport them, distributors position them, and customers purchase them. This linear representation is useful for basic analysis but incomplete for global risk management. In practice, a supply chain is a network with multiple tiers, reverse flows, shared infrastructure, financial relationships, digital connections, and common dependencies.

A focal firm may have direct contractual relationships with only its first-tier suppliers while remaining dependent on second- or third-tier suppliers for critical minerals, electronic components, packaging, or specialist services. Several apparently independent suppliers may also depend on the same upstream producer, port, cloud platform, energy grid, or transport corridor. Such common dependencies create hidden concentration risk.

Interdependence has several dimensions. Physical interdependence exists when one facility depends on another for materials or components. Informational interdependence arises when planning, ordering, tracking, and customs processes rely on shared data systems. Financial interdependence occurs through credit, payment terms, insurance, and working-capital relationships. Institutional interdependence develops through common regulations, standards, labour markets, and infrastructure. A disruption in one dimension may trigger effects in others.

The managerial challenge is not to eliminate all risk. Risk is inherent in commercial activity, and attempts to remove it completely may make operations unaffordable or inflexible. The objective is to understand significant exposures, determine acceptable levels of risk, and design capabilities that support continuity and recovery at an appropriate cost.

Core concepts and terminology

Risk

Risk is the effect of uncertainty on objectives. In supply chain management, objectives may include cost, service, quality, delivery time, safety, revenue, compliance, sustainability, and reputation. Risk is frequently described using the likelihood of an event and the magnitude of its consequences, although modern approaches also consider uncertainty about the event itself, the speed of impact, interdependencies, and the organization’s ability to respond.

Risk is not synonymous with danger. A hazard is a potential source of harm, whereas risk reflects the relationship between the hazard, exposure, vulnerability, and consequences. A severe storm may create little supply chain risk for a firm with no facilities, suppliers, or customers in the affected area, but substantial risk for a firm dependent on a single port in that region.

Uncertainty

Uncertainty refers to incomplete knowledge about future conditions, events, relationships, or outcomes. Some uncertainty is measurable: historical data may support an estimate of transport delay frequency. Other uncertainty is deep or ambiguous: decision-makers may not know the relevant possibilities, their probabilities, or how different actors will behave. This distinction matters because conventional probability-based models are more useful for recurring, measurable risks than for unprecedented or highly ambiguous events.

Hazard, exposure, vulnerability, and consequence

A hazard is a potentially disruptive source, such as flooding, malware, industrial action, political instability, or supplier insolvency. Exposure is the extent to which assets, activities, people, or flows are located within the path of the hazard. Vulnerability is the susceptibility of the exposed system to harm. Consequence is the resulting effect on objectives.

For example, a port closure is the hazard. A firm’s dependence on that port is its exposure. Its inability to reroute cargo or access alternative inventory is its vulnerability. Production stoppage, lost sales, and customer penalties are consequences. This decomposition helps managers avoid treating risk as an unexplained score and directs attention toward practical interventions.

Disruption

A disruption is an event or condition that interrupts or materially degrades normal supply chain operations. Disruptions vary by duration, geographic scope, predictability, speed of onset, and recoverability. A short delay in one shipment may be operationally manageable, whereas the loss of a sole-source supplier may require redesign, qualification, and strategic restructuring.

Disruption should be distinguished from routine variability. Variability is normal fluctuation in demand, lead time, yield, or transportation performance. A disruption exceeds the operating assumptions or available capacity of the system. Nevertheless, persistent variability can become disruptive when buffers are too small or when several fluctuations occur simultaneously.

Vulnerability

Vulnerability is the degree to which a supply chain is susceptible to disruption and unable to withstand its effects. Common sources include single sourcing, long and opaque tiers, excessive geographic concentration, low inventory buffers, inflexible production assets, weak supplier finances, poor data quality, and inadequate crisis governance. Vulnerability is not fixed; it changes with product design, market conditions, technology, contracts, and managerial decisions.

Robustness

Robustness is the ability of a supply chain or process to continue functioning under a range of foreseeable disturbances without major change. Robust systems may use protective infrastructure, stable designs, standardized components, safety stock, supplier qualification, and preventive controls. Robustness emphasizes resistance and performance stability.

Agility

Agility is the capacity to respond quickly and effectively to changes in demand, supply, or operating conditions. Agile supply chains can reallocate inventory, alter production schedules, switch transport modes, or communicate decisions rapidly. Agility depends on information quality, decision authority, process flexibility, and available response options.

Adaptability

Adaptability is the capacity to modify structures, relationships, processes, or strategies in response to changing conditions over a longer time horizon. Whereas agility concerns rapid response, adaptability concerns learning and redesign. Examples include qualifying new suppliers, relocating production, redesigning a product to use alternative components, or changing the network configuration.

Redundancy

Redundancy is the provision of additional or alternative capacity, resources, routes, suppliers, or information systems beyond the minimum required for normal operations. Dual sourcing, reserve production capacity, backup data centres, alternative ports, and safety stock are forms of redundancy. Redundancy can reduce vulnerability but may increase cost, complexity, inventory obsolescence, and coordination requirements.

Recovery

Recovery is the process of restoring supply chain operations after disruption. Recovery may involve repairing facilities, replacing equipment, replenishing inventory, requalifying suppliers, resolving backlogs, and rebuilding customer confidence. Recovery time and recovery point are useful concepts: the former concerns how quickly operations must be restored, while the latter concerns the acceptable loss of data, transactions, or service history.

Resilience

Resilience is the capacity of a supply chain to prepare for disruption, resist or absorb its effects, respond effectively, recover within an acceptable time, and adapt to improve future performance. Resilience is therefore broader than recovery. It includes anticipation, protection, response, restoration, learning, and transformation. A resilient supply chain does not necessarily avoid every disruption; it limits consequences and returns to an acceptable state or develops a better configuration.

Relationships among the concepts

These concepts describe different properties rather than interchangeable labels. Robustness reduces the effect of foreseeable disturbances. Agility enables rapid short-term response. Adaptability supports structural change. Redundancy provides options and spare capacity. Recovery restores performance. Resilience integrates these capabilities across time.

A low-cost, highly optimized network may perform efficiently under normal conditions but be vulnerable to rare events. Conversely, excessive redundancy may protect service but reduce competitiveness. The appropriate balance depends on product criticality, customer expectations, demand uncertainty, disruption severity, lead times, regulatory obligations, and the cost of failure.

A useful conceptual expression is:

Supply chain risk = f(hazard, exposure, vulnerability, consequence, and response capability).

This is not a precise universal equation. It is a reasoning device. Risk may be reduced by lowering the likelihood of a hazard, reducing exposure, decreasing vulnerability, limiting consequences, or improving response capability. Managers should examine all five possibilities rather than focusing only on event prevention.

The evolution of supply chain risk management

Traditional risk management often focused on insurable hazards, physical assets, occupational safety, and compliance. Supply chain decisions were commonly evaluated through cost, quality, and delivery measures, while disruption planning was treated as a contingency activity. This approach was often organization-centred and concerned primarily with direct suppliers.

As outsourcing and global sourcing expanded, firms became more dependent on external partners and geographically dispersed networks. Procurement savings could be accompanied by longer lead times, reduced visibility, supplier concentration, and exposure to political and infrastructure conditions outside the firm’s control. Supply chain risk management emerged as a broader discipline concerned with continuity across organizational boundaries.

The field then moved toward enterprise-wide and network-based approaches. Risks in procurement, production, logistics, information systems, finance, compliance, and reputation were increasingly recognized as interconnected. Business continuity planning, supplier development, scenario analysis, insurance, contractual controls, and crisis management became linked rather than isolated activities.

More recent thinking emphasizes resilience and adaptive capacity. It recognizes that not all disruptions can be predicted, that systems may fail through cascading effects, and that organizations must learn from near misses as well as major incidents. The emphasis has shifted from asking, “How can every disruption be prevented?” to asking, “How can the network continue to create value when assumptions fail?”

Frameworks for understanding supply chain risk

The risk pathway framework

The risk pathway framework traces a chain from source to outcome:

Hazard → exposure → vulnerability → disruption → operational consequence → strategic consequence.

For example, geopolitical tension may restrict exports of a critical mineral. A manufacturer exposed through sole sourcing experiences component shortages. Vulnerability is increased by long qualification times and the absence of substitute designs. The immediate disruption is production delay; later consequences may include lost market share, contractual penalties, and reputational damage.

The framework supports targeted controls. Supplier diversification addresses exposure and concentration. Product redesign reduces vulnerability. Inventory buffers limit immediate consequences. Crisis communication and customer prioritization reduce strategic damage.

The prevention–response–learning cycle

A second framework treats resilience as a continuous cycle:

1. Anticipation: identify plausible threats, dependencies, early-warning indicators, and scenarios.

2. Preparation: establish plans, contracts, skills, inventories, alternatives, and governance arrangements.

3. Absorption: maintain essential functions while disruption is occurring.

4. Response: coordinate decisions, allocate scarce resources, communicate, and activate alternatives.

5. Recovery: restore service and clear operational backlogs.

6. Learning and adaptation: investigate causes, revise assumptions, and redesign the system.

The cycle prevents resilience from being reduced to a document kept by a crisis team. It places learning and investment between incidents, when most resilience decisions are made.

The bow-tie perspective

The bow-tie model separates preventive controls from mitigative controls. On the left side, organizations attempt to prevent a disruptive event or reduce its likelihood. At the centre is the initiating event. On the right side, organizations limit consequences and support recovery after the event occurs.

For a supplier-quality risk, preventive controls may include audits, process capability assessment, specifications, and incoming inspection. Mitigative controls may include approved alternate suppliers, quarantine procedures, recall plans, and customer communication. The model is useful because a strong prevention programme does not eliminate the need for response capability.

Network and systems thinking

Network analysis examines nodes, links, flows, centrality, concentration, and common dependencies. A node may be a supplier, factory, warehouse, port, information system, or service provider. A link may represent a material, financial, informational, or contractual relationship. Highly central nodes can become points of leverage and points of failure.

Systems thinking adds feedback loops and unintended consequences. Increasing inventory may improve protection but raise obsolescence and cash requirements. Switching suppliers may reduce geographic concentration but introduce quality risk. Expediting goods may restore service but increase emissions and cost. Resilience decisions should therefore be evaluated across the network and over time, not only within one function.

Measuring risk and resilience

Risk registers remain useful when they identify the source, affected process, owner, existing controls, indicators, consequence, and planned treatment. However, a simple likelihood-impact matrix can conceal interdependencies and false precision. A low-probability event with catastrophic consequences may deserve attention even when its numerical score resembles a frequent minor delay.

Useful assessment methods include scenario analysis, stress testing, failure mode and effects analysis, fault-tree analysis, business impact analysis, supplier financial review, geographic mapping, and network concentration analysis. Scenario analysis asks what would happen under a defined condition. Stress testing examines whether performance remains acceptable under severe but plausible assumptions. Failure mode analysis evaluates how a process may fail, why it may fail, and how failure can be detected or controlled.

Resilience indicators should reflect both capability and outcome. Examples include time to recover, time to survive without replenishment, percentage of critical suppliers with validated alternatives, visibility beyond the first tier, recovery-plan exercise performance, inventory coverage for critical items, and the proportion of shipments with viable alternate routes. Metrics must be interpreted carefully. A high inventory level does not automatically indicate resilience if inventory is in the wrong location or cannot be used.

Practical and managerial applications

Procurement and supplier management

Procurement teams influence resilience through sourcing structure, supplier selection, contracts, qualification, development, and relationship management. Lowest unit price should not be the sole criterion. Total risk cost may include disruption exposure, quality failure, switching cost, compliance risk, and recovery expense.

Supplier segmentation can distinguish strategic, bottleneck, routine, and leverage categories. Critical suppliers require deeper visibility, continuity planning, financial monitoring, collaborative improvement, and sometimes joint investment. Dual sourcing is not automatically effective: two suppliers may share the same upstream source or be located in the same hazard zone.

Logistics and network design

Logistics resilience can be improved through alternate ports, multimodal capability, flexible carrier contracts, regional distribution, route diversification, and postponement. Network design decisions should account for service requirements, customs conditions, infrastructure reliability, border risk, emissions, and recovery time. A geographically dispersed network may reduce local hazard exposure but increase coordination complexity and lead-time variability.

Inventory and capacity

Safety stock, strategic reserves, spare parts, and flexible capacity provide time to respond. Their value is highest when replenishment is difficult, demand is critical, and alternatives are limited. However, buffers require disciplined positioning and review. Excess inventory can become obsolete, conceal process problems, and reduce financial flexibility. Capacity reservations and cross-training may provide resilience without holding large physical stocks.

Product and process design

Design choices strongly influence resilience. Standardized interfaces, modular products, component commonality, postponement, and design-for-substitution can make it easier to change suppliers or configurations. Engineers and procurement professionals should collaborate early because a small design decision may determine whether a component can be sourced from multiple regions.

Governance and leadership

Resilience requires clear ownership. A risk committee may establish priorities, while business units own specific exposures. Escalation thresholds, decision rights, communication protocols, and crisis roles should be defined before an event. Senior leaders must also resolve conflicts between short-term cost targets and long-term continuity.

Digital applications and analytics

Digital technologies can improve visibility, prediction, collaboration, and response. Supplier portals, transport management systems, control towers, satellite data, internet-of-things sensors, and event-monitoring platforms can provide early indications of delay or disruption. Advanced analytics can identify patterns in lead times, quality, weather, financial stress, or geopolitical conditions.

Artificial intelligence may support anomaly detection, scenario generation, demand sensing, and recommendation of alternate routes or suppliers. Its value depends on data quality, model validation, explainability, cybersecurity, and human oversight. Automation can accelerate a poor decision if governance is weak. Digital dependence also creates cyber and technology concentration risks, so resilience planning must include system redundancy, access controls, incident response, and recovery testing.

Illustrative case: Northstar Medical Devices

Background

Northstar Medical Devices, a fictional manufacturer, produces diagnostic equipment for hospitals in several regions. Its products require a specialized sensor purchased from one approved supplier. The supplier has a strong quality record and offers competitive pricing. Because the sensor is subject to regulatory approval, qualification of an alternative source would take approximately nine months.

Situation and problem

A severe earthquake damages infrastructure near the supplier’s factory. The factory remains structurally intact but cannot obtain electricity and specialist packaging materials. Northstar has six weeks of sensor inventory at its assembly plants. Hospital orders are stable, and several contracts include delivery commitments.

The initial risk appears to be a supplier disruption. Further analysis reveals additional vulnerabilities: the supplier’s second-tier packaging provider is also located in the affected region; Northstar’s inventory is concentrated at one assembly plant; production software is hosted by a single external platform; and the firm has no pre-approved substitute sensor.

Analysis

Using the risk pathway framework, the earthquake is the hazard. Northstar’s dependence on one supplier and one region represents exposure. Long qualification time, common regional dependencies, limited inventory at other plants, and lack of design alternatives represent vulnerability. Potential consequences include assembly stoppage, delayed hospital deliveries, contractual penalties, and reputational damage.

The crisis team conducts a rapid business impact analysis. It classifies hospital emergency orders as highest priority, postpones lower-priority commercial orders, transfers some inventory between plants, and contacts the supplier to understand restoration conditions. It also investigates whether a compatible sensor can be sourced from an already qualified supplier used in another product line.

Strategy and solution

In the short term, Northstar creates a controlled allocation process, increases communication with hospitals, and uses expedited transport for available inventory. It asks the supplier to prioritize critical components and works with the packaging provider to identify a temporary alternative. The company activates manual procedures for essential planning transactions in case the external software platform becomes unavailable.

In the medium term, Northstar begins qualification of a second sensor supplier, redesigns the product interface to permit component substitution, and establishes inventory positioning rules for critical components. It maps second- and third-tier dependencies and adds regional disruption indicators to its monitoring system.

In the long term, the company adopts a resilience scorecard that includes recovery time, alternate-source readiness, geographic concentration, system recovery capability, and customer-priority performance. Supplier contracts are revised to include continuity information, notification duties, recovery expectations, and collaborative testing.

Outcome

Northstar avoids a complete production stoppage, although some deliveries are delayed. The company incurs higher transport and qualification costs but preserves its most critical hospital relationships. The post-incident review finds that the original supplier risk score understated the exposure because it did not consider the packaging dependency, inventory location, or digital platform concentration.

Learning points

The case illustrates that resilience is a network capability rather than a single-supplier attribute. It also shows that inventory alone cannot compensate for long qualification times, that visibility must extend beyond direct suppliers, and that response priorities should reflect customer and societal consequences. Finally, resilience investments often produce value by preserving options before a disruption occurs.

Challenges, limitations, and common mistakes

One common mistake is treating risk assessment as a one-time exercise. Networks, suppliers, products, regulations, and geopolitical conditions change continuously. Assessments must be refreshed after major sourcing, design, technology, or market decisions.

A second mistake is relying on first-tier visibility. Direct suppliers may not know or disclose their own critical dependencies, especially when contracts, incentives, or data systems are weak. A third is confusing redundancy with resilience. Multiple suppliers are ineffective if they share a common upstream source or lack sufficient capacity during a regional crisis.

A fourth mistake is optimizing for average performance. Average lead time and average cost can conceal extreme variability and tail events. Managers should examine ranges, correlations, recovery time, and the consequences of simultaneous failures. A fifth mistake is creating plans that have never been exercised. Tabletop simulations, supplier drills, cyber exercises, and recovery tests reveal unclear authority and unrealistic assumptions.

Resilience also has limitations. It requires investment and may reduce short-term efficiency. It cannot eliminate uncertainty, and some disruptions exceed available resources. Moreover, resilience for one organization may transfer risk to suppliers, workers, communities, or the environment. Ethical analysis is therefore essential.

Governance, ethics, and professional responsibility

Risk decisions involve stakeholders with unequal power and unequal exposure. A buyer may demand extreme flexibility from a small supplier without compensating the supplier for reserved capacity. A firm may divert scarce products to its most profitable customers while neglecting vulnerable communities. A resilience strategy that relies on unsafe labour conditions, environmental damage, or opaque data practices is not professionally sustainable.

Governance should include accountability, documented assumptions, escalation procedures, auditability, and transparent reporting. Contracts should allocate responsibilities fairly and define information-sharing expectations without creating unreasonable burdens. Data used for monitoring suppliers or workers must be handled lawfully and proportionately. Cybersecurity and privacy controls are part of responsible resilience management, not merely technical concerns.

Regulatory requirements may address business continuity, product safety, critical infrastructure, customs, sanctions, data protection, financial reporting, and environmental performance. Organizations must understand applicable obligations across jurisdictions and avoid assuming that compliance in one country satisfies all network responsibilities.

Emerging directions and best practices

Current practice is moving toward multi-tier mapping, continuous sensing, scenario-based planning, regionalization where appropriate, circular supply networks, and closer integration of sustainability with resilience. Climate-related disruption is encouraging firms to assess physical exposure, transition risk, water stress, energy dependence, and adaptation requirements. Geopolitical uncertainty is increasing attention to strategic materials, trade restrictions, sanctions, and industrial policy.

Useful best practices include:

• connect risk management with strategy, procurement, operations, finance, technology, and sustainability;
• identify critical products, processes, suppliers, facilities, data, and infrastructure;
• map dependencies beyond the first tier where criticality justifies the effort;
• combine prevention, protection, response, recovery, and learning;
• maintain validated alternatives rather than merely naming possible alternatives;
• use exercises and simulations to test plans and decision rights;
• measure recovery capability as well as normal efficiency;
• build collaborative relationships with suppliers and logistics partners;
• use digital tools with strong data governance and human oversight; and
• review resilience investments against customer, societal, ethical, and environmental consequences.

Chapter Summary

Global supply chains are interconnected networks whose performance depends on physical, informational, financial, institutional, and technological relationships. Risk arises from the interaction of hazards, exposure, vulnerability, consequences, and response capability. Uncertainty concerns incomplete knowledge; disruption is an interruption of normal operations; vulnerability reflects susceptibility; and resilience integrates preparation, absorption, response, recovery, and adaptation.

Robustness supports continuity under foreseeable disturbances, agility enables rapid action, adaptability supports structural change, redundancy provides alternatives, and recovery restores acceptable performance. Globalization and outsourcing have increased efficiency and market access while also creating longer dependencies, geographic concentration, hidden tiers, and common points of failure. Supply chain risk management has consequently evolved from narrow hazard control toward network-based, enterprise-wide resilience management.

Risk pathway analysis, the prevention–response–learning cycle, the bow-tie model, and network thinking provide complementary ways to analyse exposure and design controls. Effective practice combines supplier management, network design, inventory and capacity decisions, product design, governance, digital visibility, scenario analysis, and continuous learning. Resilience must also be ethically governed because risk can be transferred across firms, workers, communities, and the environment.

Key Terms

Risk: The effect of uncertainty on supply chain objectives.

Uncertainty: Incomplete knowledge about future events, conditions, relationships, or outcomes.

Hazard: A potential source of disruption or harm.

Exposure: The extent to which a supply chain is subject to a hazard.

Vulnerability: Susceptibility to disruption and inability to withstand its effects.

Disruption: An event or condition that interrupts or materially degrades normal operations.

Consequence: The effect of a disruption on operational, financial, strategic, or stakeholder objectives.

Robustness: The ability to continue functioning under foreseeable disturbances without major change.

Agility: The ability to respond rapidly and effectively to changing conditions.

Adaptability: The ability to modify structures, processes, or strategies over time.

Redundancy: Additional or alternative capacity, resources, routes, or systems beyond the minimum required.

Recovery: The process of restoring operations after disruption.

Resilience: The capacity to prepare for, absorb, respond to, recover from, and learn from disruption.

Interdependence: The condition in which supply chain entities or processes rely on one another.

Visibility: The ability to access and interpret relevant information about supply chain activities and conditions.

Single-source risk: Dependence on one supplier for a critical input.

Common dependency: A shared upstream resource, facility, platform, route, or infrastructure on which several entities depend.

Business impact analysis: A structured assessment of how disruption affects processes, resources, customers, and objectives.

Stress testing: Examination of performance under severe but plausible conditions.

Time to recover: The time required to restore an acceptable level of supply chain performance.

Review Questions

Short Answer Questions

1. Distinguish between a hazard, exposure, vulnerability, and consequence.

2. What is the difference between robustness and agility?

3. Why does globalization increase both efficiency and supply chain risk?

4. Define redundancy and explain one possible disadvantage of excessive redundancy.

5. Why should supply chain risk assessment extend beyond first-tier suppliers?

Long Answer Questions

1. Explain the evolution of supply chain risk management from traditional hazard control to resilience management.

2. Discuss the relationship among robustness, agility, adaptability, redundancy, recovery, and resilience.

3. Explain the risk pathway framework and demonstrate how it supports managerial decision-making.

4. Analyse how procurement, logistics, inventory, product design, and governance contribute to supply chain resilience.

5. Discuss the ethical and governance challenges involved in designing resilient global supply chains.

Analytical / Application Questions

1. A manufacturer relies on two suppliers, but both obtain a critical component from the same upstream producer. Analyse the risk using the concepts of exposure, vulnerability, common dependency, and redundancy.

2. A firm has high inventory but no alternate transport route and poor visibility beyond direct suppliers. Evaluate whether its supply chain is resilient and recommend priorities for improvement.

3. Using the Northstar Medical Devices case, design a prevention–response–learning cycle that addresses both the immediate disruption and the firm’s long-term network vulnerability.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from recovery?

A. Resilience concerns only preventing disruptions, while recovery concerns responding to them.

B. Resilience includes preparation, absorption, response, recovery, and adaptation; recovery focuses on restoring operations.

C. Resilience means maintaining excess inventory, while recovery means reducing inventory.

D. Resilience applies only to suppliers, while recovery applies only to manufacturers.

Correct Answer: B. Resilience includes preparation, absorption, response, recovery, and adaptation; recovery focuses on restoring operations.

Question 2

A firm depends on several suppliers that all use the same port. Which concept most directly describes this hidden exposure?

A. Common dependency

B. Agility

C. Postponement

D. Routine variability

Correct Answer: A. Common dependency

Question 3

Which action primarily improves adaptability rather than immediate agility?

A. Expediting an urgent shipment

B. Reallocating existing inventory between plants

C. Redesigning a product so that alternative components can be used

D. Increasing the frequency of delivery tracking

Correct Answer: C. Redesigning a product so that alternative components can be used

Question 4

In the risk pathway framework, inability to reroute cargo is best classified as:

A. A hazard

B. Exposure

C. Vulnerability

D. A consequence

Correct Answer: C. Vulnerability

Question 5

Which is an example of a mitigative control in a bow-tie model?

A. Supplier process auditing before production begins

B. Product specifications that prevent quality variation

C. An approved alternate supplier activated after a disruption

D. Preventive maintenance on production equipment

Correct Answer: C. An approved alternate supplier activated after a disruption

Question 6

Why may a simple likelihood-impact matrix be inadequate for global supply chain risk?

A. It cannot be used for any operational decision.

B. It may conceal interdependencies and give false precision about rare catastrophic events.

C. It measures only supplier prices.

D. It automatically overestimates routine variability.

Correct Answer: B. It may conceal interdependencies and give false precision about rare catastrophic events.

Question 7

Which situation best illustrates robustness?

A. A company rapidly changes production schedules after a demand shock.

B. A network continues operating during foreseeable disturbances because its facilities and processes are well protected.

C. A company redesigns its product after learning from a disruption.

D. A firm uses artificial intelligence to identify an anomaly.

Correct Answer: B. A network continues operating during foreseeable disturbances because its facilities and processes are well protected.

Question 8

Northstar’s original risk assessment understated its exposure mainly because it:

A. Used too many alternative suppliers.

B. Focused on direct supplier performance without considering downstream dependencies and concentration.

C. Maintained too much inventory at every facility.

D. Used customer prioritization during the disruption.

Correct Answer: B. Focused on direct supplier performance without considering downstream dependencies and concentration.

Question 9

Which metric most directly evaluates recovery capability?

A. Average purchase price

B. Number of routine suppliers

C. Time required to restore acceptable performance

D. Annual marketing expenditure

Correct Answer: C. Time required to restore acceptable performance

Question 10

What is a major governance concern when resilience costs are shifted to a small supplier?

A. The supplier may have too much inventory visibility.

B. The arrangement may transfer risk unfairly and create ethical and continuity problems.

C. The buyer will automatically achieve greater adaptability.

D. The supply chain will no longer have any uncertainty.

Correct Answer: B. The arrangement may transfer risk unfairly and create ethical and continuity problems.