14. Supply Chain Risk, Resilience and Business Continuity

Introduction and Context

Supply chains create value by connecting suppliers, manufacturers, logistics providers, distributors, retailers and customers. The same interdependence that creates efficiency also creates vulnerability. A disruption at a port, factory, data centre, transport corridor or critical supplier can affect organisations far beyond the point where the event occurs. Consequently, supply chain risk is not merely an operational concern; it is a strategic issue involving revenue, reputation, compliance, customer service, working capital and organisational survival.

Supply chain risk refers to the possibility that an uncertain event or condition will negatively affect the flow of materials, information, funds or services. Risk may arise from routine operational failures, supplier weakness, cyberattacks, natural hazards, climate change, geopolitical conflict, regulatory intervention, labour disruption or sudden changes in demand. Business continuity is the organised capability to maintain or restore critical operations after a disruptive event. Resilience is broader: it is the capacity of a supply chain to anticipate, absorb, adapt to and recover from disruption while continuing to provide essential outcomes.

Traditional supply chain design often emphasised low cost, high utilisation, lean inventories and global sourcing. These objectives remain important, but a narrow focus on efficiency can produce fragility. A resilient supply chain balances efficiency with preparedness, flexibility, visibility and recovery capability. The managerial question is therefore not whether risk can be eliminated—it cannot—but how risk can be understood, prioritised and managed at an economically justified level.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the nature, sources and consequences of supply chain risk.

2. Distinguish risk, vulnerability, resilience, robustness and business continuity.

3. Apply risk registers, risk mapping, FMEA, scenario planning and stress testing.

4. Evaluate mitigation options such as redundancy, flexibility, postponement, inventory and collaboration.

5. Design the main elements of a supply chain continuity plan.

6. Use resilience metrics and digital technologies to support managerial decisions.

7. Assess governance, ethical, cyber, climate and regulatory considerations.

8. Recommend an appropriate resilience strategy in a practical supply chain situation.

The Architecture of Supply Chain Risk

Risk can enter through any supply chain flow. Material risk concerns shortages, defects, contamination and transportation failure. Information risk includes inaccurate forecasts, delayed status data, system outages and cyber compromise. Financial risk includes supplier insolvency, currency volatility, price shocks and customer default. Process risk arises from inadequate capacity, poor quality, weak maintenance, unsafe procedures or excessive dependence on individuals. External risk includes earthquakes, floods, pandemics, trade restrictions, war, terrorism and regulatory change.

A useful distinction is between the source of a risk and its consequence. A flood may be the source; plant closure, missed deliveries and lost sales are consequences. A cyberattack may begin in a logistics provider's system but propagate through inventory records, transport bookings and customer communications. Risk analysis must therefore examine both direct and cascading effects.

Three characteristics determine the seriousness of a risk. Probability describes how likely the event is. Impact describes the magnitude of its consequences. Velocity describes how quickly the effect reaches the organisation. A low-probability event with extreme impact and very high velocity may deserve greater attention than a frequent but easily contained delay. Interconnectedness is also important: a single supplier may be acceptable if alternatives exist, but dangerous if it provides a unique component shared by several products.

Supply chain exposure is shaped by network structure. Globalisation can provide access to specialised capabilities and lower-cost production, but it may increase lead times, geopolitical exposure and dependence on distant nodes. Single sourcing can support quality and collaboration, yet it creates concentration risk. Just-in-time replenishment reduces inventory cost, but leaves less time to react. Outsourcing may improve expertise while reducing direct control. These are not automatically bad choices; they are trade-offs requiring explicit risk assessment.

Risk, Vulnerability, Resilience and Continuity

Risk is the effect of uncertainty on objectives. Vulnerability is the degree to which a supply chain is susceptible to harm when exposed to a hazard. Resilience is the capability to withstand disruption, adapt and recover. Robustness refers more narrowly to the ability to continue operating without major change under adverse conditions. Agility is the ability to respond rapidly to changes in demand or supply. Flexibility is the ability to change volume, mix, source, route or process at reasonable cost.

Business continuity management translates these ideas into plans and responsibilities. It identifies critical activities, acceptable downtime, required resources, recovery priorities and communication arrangements. Disaster recovery commonly focuses on restoring technology and facilities, whereas business continuity encompasses people, suppliers, processes, information, customers and governance. A continuity plan is useful only when it is owned, resourced, communicated and tested.

Resilience has at least three phases. Before disruption, organisations anticipate, prevent and prepare. During disruption, they detect, respond, coordinate and prioritise. After disruption, they recover, learn and redesign. The recovery stage should not simply restore the previous configuration if that configuration created excessive exposure. Disruption can provide evidence for improving network design, contracts, technology and operating procedures.

A Risk-Assessment Process

A practical risk-management process begins with establishing context. Managers define the products, markets, facilities, suppliers and service commitments under review. They identify critical objectives such as customer availability, safety, regulatory compliance, cash flow or maximum tolerable downtime. Risk criteria should be agreed before individual risks are assessed; otherwise decisions may be driven by the most recent or visible event.

The next stage is risk identification. Workshops, supplier interviews, process mapping, historical data, audit findings, incident records, intelligence reports and site inspections can be used. The analysis should include tier-two and tier-three dependencies where they are material. A supply chain map should show physical locations, transport links, information systems, utilities, substitute materials and decision rights. Mapping often reveals hidden dependencies such as one port, one cloud provider, one certification laboratory or one specialist tooling supplier.

Risk analysis estimates likelihood and consequence. A qualitative matrix may classify each as low, medium or high. A more rigorous approach assigns scales and documents the basis of judgement. Expected loss can be estimated as:

Expected loss = probability of event × financial consequence.

This calculation is not sufficient for every decision because reputational, safety, legal and strategic effects may not be easily monetised. It is nevertheless useful for comparing alternatives. Managers should also estimate time to impact, duration, detectability and recovery cost.

A risk register records the risk description, cause, event, consequence, owner, existing controls, inherent rating, residual rating, treatment action, deadline and status. The distinction between inherent and residual risk is important. Inherent risk exists before controls; residual risk remains after controls. A risk register should be actively reviewed rather than maintained as a static compliance document.

Risk Mapping and Heat Maps

A heat map plots risks according to likelihood and impact. It provides a visual basis for prioritisation, but it can create false precision. Ratings may be subjective, scales may not be consistent, and low-frequency catastrophic events may be underrepresented. Heat maps should therefore be supported by narrative assumptions and escalation rules. A risk map is most valuable when it leads to decisions about ownership, investment, monitoring and contingency action.

Failure Mode and Effects Analysis

Failure Mode and Effects Analysis (FMEA) examines how a process, product or system can fail. For each failure mode, the team considers its effect, cause, existing controls and ratings for severity, occurrence and detectability. A traditional Risk Priority Number is calculated as:

RPN = Severity × Occurrence × Detectability.

FMEA is particularly useful for warehouse processes, packaging, cold chains, transport handoffs and production logistics. Its limitation is that multiplication can give disproportionate importance to numerical ratings and may hide a severe event with a low occurrence score. Organisations should use judgement and escalation thresholds in addition to RPN.

Scenario Planning and Stress Testing

Scenario planning explores plausible combinations of events rather than predicting one precise future. Examples include a major supplier failure combined with a demand surge, a cyberattack during a port closure, or a climate event occurring during peak season. Scenarios should describe assumptions, triggers, time horizon, affected nodes, available responses and decision points.

Stress testing asks whether the supply chain can meet defined performance requirements under severe but plausible conditions. Tests may examine loss of a facility, reduction in transport capacity, extended supplier lead time, a 30-day system outage or a sudden increase in demand. The purpose is not to forecast exactly what will happen, but to discover thresholds, bottlenecks and recovery constraints. Results should be converted into actions such as pre-approved alternate routes, reserved capacity, safety stock or manual operating procedures.

Designing Resilience: Strategic Choices and Trade-offs

Resilience is created through a portfolio of capabilities rather than one universal solution. The appropriate combination depends on product criticality, demand uncertainty, lead time, margin, regulatory requirements and the cost of interruption.

Redundancy provides alternatives: multiple suppliers, facilities, carriers, communication channels or energy sources. It reduces dependence but may increase cost, qualification effort and coordination complexity. Dual sourcing is not effective if both suppliers depend on the same sub-supplier or geographical corridor. Geographic diversification should therefore be assessed at the level of shared infrastructure and common hazards.

Flexibility enables substitution and rapid reconfiguration. Examples include common components, modular product design, cross-trained employees, adaptable production lines, multiple transport modes and contracts with volume options. Flexibility is especially valuable when the timing or form of disruption is uncertain. It usually requires investment in capability before it is needed.

Buffering absorbs variation through inventory, time, capacity, cash or information. Safety stock is appropriate when demand or replenishment uncertainty justifies its carrying cost. Critical items may require strategic stock even when average demand is low. However, inventory alone cannot solve a prolonged shortage, product obsolescence or loss of a unique capability. Buffers should be positioned according to lead time, product value, shelf life and recovery options.

Visibility improves detection and decision quality. It includes accurate inventory records, supplier status, shipment tracking, exception alerts and knowledge of upstream dependencies. Visibility without response authority has limited value. Data must be timely, reliable and connected to actions such as rerouting, expediting, allocation or customer communication.

Postponement delays final configuration, packaging or localisation until demand is clearer. It reduces forecast exposure and can allow common inventory to serve multiple markets. Its feasibility depends on product design, process capability and customer requirements.

Collaboration and contractual design can improve resilience. Joint forecasting, shared capacity information, supplier development, collaborative emergency procedures and transparent allocation rules reduce reaction time. Contracts should clarify continuity obligations, notification periods, data protection, audit rights, recovery priorities, force majeure interpretation and responsibilities for alternate supply. Price-only procurement can undermine resilience if it discourages supplier investment and transparency.

The central trade-off is between resilience and cost, but resilience also competes with speed, sustainability, working capital and simplicity. A decision should consider total cost of risk, including disruption loss, recovery expenditure, customer penalties, reputation and lost strategic opportunity. Resilience investments should be directed toward critical flows rather than applied uniformly.

Business Continuity Planning in Practice

Business continuity planning begins with a business impact analysis. The analysis identifies critical products and processes, their dependencies, maximum tolerable period of disruption, recovery time objective and recovery point objective. The recovery time objective is the target time for restoring an activity. The recovery point objective specifies the acceptable amount of data loss, expressed in time or transaction terms.

A continuity plan normally defines:

• critical activities and service priorities;
• responsible decision-makers and delegated authority;
• emergency contacts and escalation criteria;
• alternate suppliers, facilities, routes and systems;
• inventory, transport and workforce contingencies;
• manual workarounds and data recovery procedures;
• customer, regulator, employee and media communication;
• health, safety, security and legal requirements; and
• recovery, review and documentation arrangements.

Incident response should follow a clear command structure. A crisis team coordinates enterprise decisions, while functional teams manage procurement, transport, operations, information technology, finance, human resources and communications. The structure must avoid confusion between operational problem-solving and strategic prioritisation. During scarcity, allocation principles should be established in advance, especially for essential goods, regulated products and vulnerable customers.

Plans must be exercised. Tabletop exercises test assumptions and roles through discussion. Simulation exercises test coordination under time pressure. Technical recovery tests examine systems and data. Supplier and logistics-provider participation is important because internal plans may fail at external interfaces. Each exercise should produce corrective actions with owners and deadlines.

Measuring Resilience and Risk Performance

No single measure captures resilience. Useful indicators include supplier concentration, percentage of spend with single-source suppliers, time to detect disruption, time to respond, time to recover, order fill rate during disruption, forecast error, inventory coverage for critical items, alternate-source qualification, recovery-plan test completion and percentage of tier-one suppliers with validated continuity plans.

A performance dashboard should combine leading and lagging indicators. Leading indicators include overdue supplier audits, declining financial health, rising lead-time variability, cyber vulnerabilities, severe-weather alerts and low emergency stock. Lagging indicators include stockouts, missed deliveries, recovery duration, customer complaints and financial loss. Metrics should be segmented by critical product, region and supplier tier; averages can conceal serious exposure.

The concept of time to recovery is particularly useful. A resilient network aims to limit both the depth of performance decline and the duration of recovery. Managers may represent disruption performance as a resilience curve showing service level before, during and after an event. The area of lost performance provides an approximate measure of disruption burden. Such measures support comparison of alternative network designs, though estimates should be treated as decision aids rather than exact scientific facts.

Technology, Cyber Risk and Analytics

Digital technologies can strengthen resilience through end-to-end visibility, automated alerts, predictive maintenance, digital twins, control towers, supplier-risk platforms and scenario analytics. Internet of Things devices can monitor temperature, location, vibration and equipment condition. Artificial intelligence can identify unusual patterns, estimate delay risk and support demand or capacity scenarios. Digital twins can represent network nodes and test the consequences of closing a facility or changing a route.

Technology also creates new dependencies. A connected supply chain may be vulnerable to ransomware, credential theft, software defects, data manipulation, third-party compromise and system concentration. Cybersecurity must therefore be treated as a supply chain issue rather than solely an information-technology issue. Essential controls include multi-factor authentication, least-privilege access, network segmentation, patch management, secure backups, supplier assurance, incident reporting and tested manual workarounds.

Analytics are only as reliable as the data and assumptions behind them. Poor master data, incomplete supplier mapping or biased historical records can produce confident but incorrect recommendations. Human oversight remains essential for high-impact decisions, particularly where safety, fairness, legal duties or scarce-resource allocation are involved.

Climate, Geopolitical and Responsible Risk Management

Climate risk includes acute events such as floods, storms and wildfires and chronic effects such as heat, water scarcity and sea-level rise. Assessment should consider facility location, transport corridors, energy availability, insurance, supplier capability and future operating conditions. Adaptation may involve relocation, drainage, cooling, alternative materials, regional inventory or revised product specifications. Climate resilience and sustainability must be considered together: a backup arrangement that increases emissions or resource depletion may create another form of long-term risk.

Geopolitical risk includes sanctions, export controls, conflict, border restrictions, political instability and changes in industrial policy. Organisations need reliable screening, country and corridor analysis, legal review and contingency sourcing. Ethical risk includes forced labour, unsafe conditions, corruption, discriminatory allocation and environmental harm. Due diligence should extend beyond first-tier suppliers where risk warrants it. Organisations should provide grievance mechanisms, protect whistleblowers and avoid treating compliance as a purely documentary exercise.

Governance requires clear accountability. The board or senior leadership sets risk appetite and ensures adequate resources. Procurement, operations, logistics, finance, information security, legal and sustainability functions share responsibility. Suppliers should be engaged as partners in risk reduction, while contractual power should not be used to transfer unreasonable risk to weaker parties. Transparent communication during disruption supports trust and reduces misinformation.

Illustrative Case: The Northstar Medical Devices Network

Background

Northstar Medical Devices, a fictional manufacturer, supplies sterile diagnostic cartridges to hospitals through distributors in three regions. The cartridges require a specialised polymer produced by one approved supplier. Northstar uses a lean inventory policy because the polymer has a controlled shelf life. Finished products are assembled at one central plant and transported by two contracted carriers.

Situation and Problem

A severe flood closes the polymer supplier for an uncertain period. At the same time, one carrier experiences a cyber incident and cannot provide reliable shipment status. Hospitals begin placing larger orders because they fear shortage. Northstar has ten days of polymer inventory and faces a potential stockout within three weeks. The supplier has no qualified alternate source, and the polymer specification requires regulatory approval.

Analysis

The risk team maps the network and identifies three linked concentrations: single-source polymer, single assembly plant and dependence on carrier information systems. A heat map rates polymer interruption as high impact and medium likelihood, but scenario analysis shows that the combination of demand surge and transport visibility loss produces a much more severe outcome. FMEA identifies incorrect polymer handling and allocation errors as additional failure modes. A business impact analysis classifies hospital supply as critical, with strict requirements for product safety and traceability.

Approach and Strategy

Northstar activates its continuity team. It verifies the supplier's physical condition, secures available polymer inventory and establishes daily executive review. Orders are prioritised using agreed clinical and contractual criteria rather than distributor pressure alone. The company contacts regulators to discuss an accelerated qualification pathway for a technically equivalent polymer, while maintaining safety controls and documented testing.

The logistics team switches urgent shipments to a second carrier and uses manual confirmation procedures while the first carrier's systems are investigated. Customer communication provides realistic allocation quantities and expected dates. Engineering begins a design review to determine whether a common cartridge platform can reduce future material dependence. Procurement negotiates a recovery and continuity plan with the supplier, including emergency information-sharing and investment in alternate capacity.

Outcome

In this illustrative case, Northstar avoids a complete service interruption by combining inventory prioritisation, alternate transport, regulatory engagement, manual controls and transparent communication. The event still creates financial cost and delayed deliveries. After recovery, Northstar approves dual sourcing, increases strategic stock for the polymer, maps critical tier-two dependencies, tests carrier cyber contingencies and adds disruption scenarios to its annual planning cycle.

Learning Points

The case demonstrates that resilience is a system property. Inventory alone would not have solved the problem because demand increased and transport visibility failed. Early mapping exposed concentration risk, while pre-agreed priorities reduced conflict. Regulatory and ethical obligations limited the speed of substitution, showing why continuity planning must begin before a crisis. Finally, recovery created an opportunity to redesign the network rather than merely return to its previous state.

Common Errors and Limitations

A frequent mistake is equating resilience with holding more inventory. Inventory can become obsolete, may be unavailable at the wrong location and does not address cyber, labour, quality or infrastructure failure. Another error is relying on a supplier's self-assessment without validation. Contracts and questionnaires cannot substitute for site evidence, financial review, performance data and exercises.

Organisations also tend to focus on visible tier-one suppliers while ignoring lower-tier dependencies. Risk ownership may be unclear when procurement, operations and technology functions each assume that another group is responsible. Excessive use of heat maps can encourage superficial scoring, while excessive modelling can delay practical action. Plans may fail because contact lists are outdated, authority is centralised, manual procedures are untested or employees are unaware of their roles.

Resilience initiatives can create unintended effects. Multiple suppliers may increase quality variation; emergency air freight may increase emissions; extensive monitoring may threaten privacy; and aggressive cost transfer may weaken small suppliers. Managers should assess these effects and apply proportional controls. A resilient supply chain is not one that prevents every disruption, but one that makes informed trade-offs, protects critical outcomes and learns systematically.

Current Developments and Best Practice

Recent supply chain practice is moving from static risk registers toward continuous sensing and dynamic response. Organisations increasingly combine external intelligence, supplier financial signals, weather information, cyber ratings, shipment data and operational performance. Regionalisation and multi-local sourcing are being considered alongside global networks, although regional duplication may not be economical for every product.

Leading practice includes the following principles:

1. Map critical products, dependencies and shared infrastructure beyond the first tier.

2. Establish risk appetite, critical service levels and escalation thresholds.

3. Combine qualitative judgement with quantitative analysis and scenario testing.

4. Design redundancy and flexibility selectively around critical flows.

5. Integrate procurement, logistics, operations, finance, technology and sustainability.

6. Require continuity evidence from important suppliers and logistics providers.

7. Treat cybersecurity and data integrity as operational resilience issues.

8. Test plans, document lessons and close corrective actions.

9. Communicate honestly with employees, customers, suppliers and regulators.

10. Review resilience after incidents and changing climate, market or geopolitical conditions.

Chapter Summary

Supply chain risk arises from uncertainty affecting material, information, financial and service flows. It may originate internally or externally and may cascade through interconnected networks. Resilience is the capacity to anticipate, absorb, adapt and recover, while business continuity provides the plans, roles and resources needed to maintain critical operations.

Effective management begins with context setting, network mapping, risk identification, analysis, prioritisation and treatment. Risk registers, heat maps, FMEA, scenario planning and stress testing help managers expose vulnerabilities and understand recovery thresholds. Resilience strategies include redundancy, flexibility, buffering, visibility, postponement, collaboration and sound contractual design. Their value must be weighed against cost, sustainability, complexity and other risks.

Continuity planning requires business impact analysis, recovery objectives, clear governance, alternate resources, communication procedures and regular exercises. Metrics should include both leading indicators and actual disruption performance. Digital technologies improve visibility and prediction but create cyber and data risks. Climate, geopolitical, ethical and regulatory issues must be integrated into supply chain governance. The central managerial principle is to protect critical outcomes through a balanced portfolio of preparedness, response, recovery and learning capabilities.

Key Terms

Risk: The effect of uncertainty on supply chain objectives.

Supply chain vulnerability: The susceptibility of a supply chain to disruption or harm.

Resilience: The capability to anticipate, absorb, adapt to and recover from disruption.

Robustness: The ability to continue operating under adverse conditions without major change.

Business continuity: The capability to maintain or restore critical activities after disruption.

Risk appetite: The level and type of risk an organisation is willing to accept.

Risk register: A structured record of risks, controls, owners, ratings and actions.

Risk heat map: A visual display of risks according to likelihood and impact.

FMEA: A method for analysing failure modes, causes, effects and controls.

Risk Priority Number: A traditional FMEA score based on severity, occurrence and detectability.

Scenario planning: Exploration of plausible future conditions and their consequences.

Stress testing: Examination of performance under severe but plausible conditions.

Redundancy: Provision of alternative suppliers, facilities, routes, systems or resources.

Flexibility: The ability to change volume, mix, source, route or process.

Safety stock: Inventory held to protect against demand or replenishment uncertainty.

Visibility: Timely knowledge of supply chain status, events and dependencies.

Recovery time objective: The target time for restoring a disrupted activity.

Recovery point objective: The acceptable amount of data loss after a system disruption.

Control tower: An integrated capability for monitoring, analysing and coordinating supply chain activity.

Concentration risk: Exposure created by excessive dependence on one supplier, location, system or corridor.

Review Questions

Short Answer Questions

1. Distinguish between supply chain risk and supply chain vulnerability.

2. What is the difference between robustness and resilience?

3. State the three traditional components used to calculate an FMEA Risk Priority Number.

4. Define recovery time objective and recovery point objective.

5. Why should cyber risk be treated as a supply chain issue?

Long Answer Questions

1. Explain the major sources of supply chain risk and their potential cascading effects.

2. Describe a systematic process for identifying, assessing and treating supply chain risk.

3. Discuss how redundancy, flexibility, buffering and visibility contribute to resilience, including their trade-offs.

4. Explain the purpose and main contents of a business continuity plan.

5. Evaluate the role of scenario planning, stress testing and resilience metrics in managerial decision-making.

Analytical / Application Questions

1. A manufacturer depends on one overseas supplier for a critical component and has long replenishment lead times. Using risk mapping and scenario planning, recommend a resilience portfolio and justify the trade-offs.

2. A logistics provider suffers a ransomware attack during peak season, making shipment data unavailable. Design an immediate response and a longer-term continuity improvement plan.

3. A company wants to increase safety stock for every product after a major disruption. Critically assess this proposal and recommend a more selective, evidence-based approach.

22. Multiple Choice Questions with Answers

Question 1

Which characteristic explains why a low-probability event may still require urgent attention when its effects spread almost immediately?

A. High velocity

B. Low detectability

C. High utilisation

D. Low concentration

Correct Answer: A. High velocity

Question 2

What is the primary purpose of a business impact analysis?

A. To calculate supplier prices

B. To identify critical activities, dependencies and acceptable disruption periods

C. To replace all single-source suppliers

D. To forecast daily customer demand

Correct Answer: B. To identify critical activities, dependencies and acceptable disruption periods

Question 3

A company qualifies two suppliers, but both depend on the same upstream refinery. Which risk remains significant?

A. Postponement risk

B. Common-dependency concentration risk

C. Excessive visibility

D. Low product variety

Correct Answer: B. Common-dependency concentration risk

Question 4

In traditional FMEA, the Risk Priority Number is calculated using severity, occurrence and:

A. Profitability

B. Flexibility

C. Detectability

D. Inventory turnover

Correct Answer: C. Detectability

Question 5

Which action best illustrates flexibility rather than redundancy?

A. Contracting a second carrier

B. Holding inventory at two warehouses

C. Designing products to use interchangeable components

D. Operating two separate data centres

Correct Answer: C. Designing products to use interchangeable components

Question 6

What does a recovery time objective specify?

A. The maximum acceptable data loss

B. The target time for restoring an activity

C. The probability of supplier failure

D. The period used to calculate safety stock

Correct Answer: B. The target time for restoring an activity

Question 7

Why is a heat map insufficient as the sole basis for supply chain risk decisions?

A. It cannot display any risk visually

B. It eliminates the need for risk owners

C. Its ratings may be subjective and may understate rare catastrophic events

D. It can only be used for financial risks

Correct Answer: C. Its ratings may be subjective and may understate rare catastrophic events

Question 8

During the Northstar illustrative case, why could inventory alone not solve the disruption?

A. The product had no customers

B. Demand increased and transport visibility also failed

C. The supplier had unlimited capacity

D. Regulators prohibited all inventory use

Correct Answer: B. Demand increased and transport visibility also failed

Question 9

Which is a leading resilience indicator?

A. Actual recovery duration after a disruption

B. Number of customer complaints after stockout

C. Percentage of critical suppliers with tested continuity plans

D. Revenue lost in the previous disruption

Correct Answer: C. Percentage of critical suppliers with tested continuity plans

Question 10

Which control most directly reduces the impact of a ransomware event on supply chain operations?

A. Removing all supplier contracts

B. Using multi-factor authentication, segmentation, backups and tested manual workarounds

C. Increasing product variety without system changes

D. Reducing shipment tracking

Correct Answer: B. Using multi-factor authentication, segmentation, backups and tested manual workarounds