Risk, Resilience and Business Continuity

Introduction

Materials management is exposed to uncertainty at every stage of the supply chain. A supplier may fail, a commodity price may rise, an incoming batch may be rejected, a port may close, or an information system may become unavailable. These events can interrupt production, increase cost, damage customer relationships and threaten organisational survival.

Risk management is the systematic process of identifying uncertain events, assessing their consequences and selecting appropriate controls. Resilience is the capability to resist, absorb, adapt to and recover from disruption. Business continuity is the planned ability to maintain critical products and services at an acceptable level during and after a disruptive event.

These ideas are related but not identical. Risk management is concerned mainly with anticipating and controlling threats. Resilience emphasises adaptive capacity and recovery. Business continuity translates risk knowledge into documented response and recovery arrangements.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Identify major supply, price, quality, geopolitical and operational risks.
2. Assess likelihood, impact and risk exposure using a risk matrix.
3. Apply Kraljic portfolio analysis to purchasing decisions.
4. Explain the roles of dual sourcing, inventory buffers and alternative specifications.
5. Develop a practical business continuity plan.
6. Evaluate trade-offs between efficiency, cost and resilience.
7. Recognise ethical, governance, technology and regulatory implications of supply risk.

1. The Nature of Materials Risk

A risk is an uncertain event or condition that may affect objectives. A disruption is the realised event, while an issue is a current problem requiring action. Materials risk can affect cost, availability, quality, safety, delivery, compliance or reputation.

Major categories of risk

Risk is often interconnected. For example, a drought may reduce agricultural supply, raise prices, lower quality and increase geopolitical competition for alternative sources. Consequently, risk registers should record causes, events, consequences, existing controls, owners and response actions rather than merely listing isolated problems.

2. Risk Assessment and the Risk Matrix

A practical assessment normally follows five steps:

1. Establish context: define products, facilities, suppliers, time horizon and risk criteria.
2. Identify risks: use process mapping, supplier visits, historical incidents, audits, interviews and external intelligence.
3. Analyse risks: estimate likelihood, impact, detectability and interdependence.
4. Evaluate risks: compare the result with the organisation’s risk appetite and escalation thresholds.
5. Treat and monitor: avoid, reduce, transfer, accept or prepare for the risk.

A commonly used screening measure is:

where R is the risk score, L is the likelihood rating and I is the impact rating. These are usually ordinal scores, such as 1 to 5, not precise probabilities. The multiplication is therefore a prioritisation convention, not a statement that the ratings are mathematically independent.

For a more quantitative estimate, expected loss may be used:

where EL is expected loss per assessment period, p is the probability of the event during that period, and C is the monetary consequence if it occurs. The units are currency per period. This expression is useful when probability and consequence can be estimated with reasonable confidence; it should not be used to disguise highly uncertain estimates as precise facts.

A risk matrix combines likelihood and impact into categories such as low, medium, high and extreme. A high score does not automatically require the most expensive control. Managers should consider control effectiveness, time to recovery, legal obligations, safety, alternative sources and the cost of resilience.

Worked example: prioritising supplier risks

A materials manager rates three risks on a five-point scale.

The single-source component receives the highest priority. Possible treatments include qualifying a second supplier, holding strategic stock, redesigning the component or negotiating recovery commitments. The assessment should be reviewed when demand, supplier capacity, regulation or geopolitical conditions change.

Risk matrices have limitations. Different assessors may interpret a rating differently; a score of 12 may arise from high likelihood and moderate impact or low likelihood and severe impact; and cascading risks may be hidden. A matrix should therefore support, not replace, professional judgement and scenario analysis.

3. Kraljic Portfolio Analysis

Kraljic portfolio analysis classifies purchased items according to two dimensions: profit impact and supply risk. Its purpose is not simply to label items, but to match purchasing strategy with the economic and supply characteristics of each category.

Profit impact may include annual spend, margin effect, switching cost and importance to the customer—not merely purchase price. Supply risk includes scarcity, qualification time, geographic concentration, intellectual-property dependence, logistics vulnerability and supplier power.

The model is dynamic. A formerly non-critical item may become strategic if a new product depends on it. Conversely, a bottleneck may become low risk after a second source is qualified. Portfolio analysis should therefore be reviewed periodically and after major design, market or regulatory changes.

4. Resilience Strategies

Resilience does not mean eliminating every risk. That would usually be impossible and uneconomic. It means designing sufficient capability to continue critical operations and recover within an acceptable time.

Supplier diversification and dual sourcing

Dual sourcing uses two approved suppliers for an item. It can reduce dependence and improve bargaining power, but it may increase qualification, tooling, inspection and coordination costs. A second supplier that has never been tested is not a fully effective alternative. Both sources should be capable, financially viable, contractually aligned and periodically exercised.

Diversification may be by supplier, country, transport route, manufacturing technology or material. Geographic diversity is not automatically real diversity if several suppliers depend on the same upstream mine, processor or port.

Inventory buffers

Safety stock protects against uncertainty in demand and replenishment lead time. In a simplified independent-demand model with a fixed lead time, safety stock can be represented as:

where SS is safety stock in units, z is the selected service-factor multiplier, σ_d is the standard deviation of demand per period, and L is lead time in the same period units. This formula assumes demand variation is independent across periods, lead time is fixed, demand is approximately normally distributed for the planning purpose, and replenishment policy is appropriate. It is not suitable without modification when lead time is highly variable, demand is intermittent, or the normal approximation is unreasonable.

If both demand and lead time vary, a commonly used approximation for the standard deviation of demand during lead time is:

where d̄ is average demand per period and σ_L is the standard deviation of lead time in periods. This approximation assumes demand and lead time are independent and ignores a covariance term. If they are correlated, a covariance adjustment is required. Safety stock is then often calculated as SS = z × σ_DLT.

Buffers also include time buffers, capacity buffers, cash reserves, substitute materials and information buffers. Excess inventory creates obsolescence, damage, insurance and working-capital costs. The correct question is not “How much stock can we hold?” but “What level of protection is justified by consequence, uncertainty and recovery time?”

Standardisation and substitution

Reducing unnecessary variety makes forecasting, purchasing and stock control easier. Approved alternatives, common specifications and modular design can reduce dependence on a unique material. Substitution must not bypass engineering approval, regulatory requirements, safety testing or customer commitments.

Contracts and collaboration

Contracts can define allocation rules, capacity reservations, lead times, quality requirements, audit rights, emergency communication, force-majeure treatment, price-adjustment mechanisms, continuity obligations and recovery priorities. Contracts are most effective when supported by supplier development, shared forecasts, visibility of constraints and periodic testing.

5. Scenario Planning and Stress Testing

Forecasting predicts a likely future; scenario planning examines several plausible futures. A useful scenario is not a vague story. It specifies assumptions, triggers, impacts, decisions, owners and indicators.

A materials team might examine:

• a sudden 30-day closure of a major port;
• a 40% increase in a critical commodity price;
• failure of the sole qualified supplier;
• a cyberattack that removes access to purchasing and inventory records;
• a regulatory ban on a chemical or country of origin.

For each scenario, the team should ask: Which materials are affected? What is the inventory position? Which customers and processes are critical? How long can operations continue? Which alternatives are technically and legally acceptable? What decisions must be made in the first 24 hours, first week and first month?

Stress testing may reveal that a company has several nominal suppliers but only one approved raw-material source, or that the warehouse has stock but records cannot be accessed during a system outage. Exercises should include procurement, operations, quality, engineering, finance, information technology, legal, communications and senior management.

6. Business Continuity Planning

A business continuity plan (BCP) documents how critical activities will continue during disruption and how normal operations will be restored. A practical BCP contains:

1. Governance: sponsor, plan owner, incident leader and decision authority.
2. Business impact analysis: critical processes, dependencies, maximum tolerable downtime and recovery priorities.
3. Resource analysis: people, suppliers, materials, facilities, utilities, systems and data.
4. Response procedures: escalation, communication, safety, containment and emergency purchasing.
5. Continuity arrangements: alternate suppliers, sites, transport routes, work methods and inventory locations.
6. Recovery procedures: repair, replenishment, validation, financial control and return to normal operations.
7. Testing and improvement: simulations, lessons learned, corrective actions and plan revision.

Two useful objectives are the recovery time objective (RTO) and recovery point objective (RPO). RTO is the targeted time within which a process or system should be restored. RPO is the maximum acceptable age of data after recovery, expressed as a time interval. For example, an RPO of four hours means that losing more than four hours of transactions is unacceptable. These objectives must be agreed with process owners; they are not automatically dictated by information technology.

A continuity plan should include contact details, escalation thresholds, approved substitutes, supplier capacity information, emergency order procedures, inventory locations, transport alternatives and communication templates. It must be accessible when the primary office, network or enterprise system is unavailable.

7. Applied Case: The Sole-Source Controller

This is an illustrative case. A manufacturer of industrial pumps purchased a programmable controller from one overseas supplier. The item represented only 2% of annual material spend, but the controller was essential to the finished product and required six months for technical qualification. Inventory covered five weeks of production.

Problem

A factory fire at the supplier reduced output by 70%. The supplier could not confirm recovery time. The purchasing department initially classified the item as low impact because its unit price was modest.

Analysis

A cross-functional review identified high supply risk, high customer impact and a six-month qualification period. Kraljic analysis placed the item in the strategic category. A scenario exercise showed that production would stop after five weeks and that an unapproved substitute could create warranty and safety exposure.

Approach and solution

The firm first obtained transparent allocation information and reserved the supplier’s remaining capacity. It then divided available stock among the highest-priority customer orders. Engineering began qualification of a second supplier and investigated a compatible controller requiring limited redesign. Procurement negotiated a framework agreement with the second source, including audit rights and annual capacity tests. The company also established a controlled buffer based on qualification lead time and disruption consequence rather than unit price alone.

Outcome

The company avoided an immediate complete shutdown, qualified the second source after testing, and revised its portfolio classification and continuity plan. The additional cost included testing, supplier development and inventory carrying cost, but this was judged lower than the expected cost of prolonged production loss and customer failure.

Learning points

1. Low purchase price does not imply low business importance.
2. A second source is valuable only when technically approved and operationally available.
3. Criticality must be assessed across the entire product and process.
4. Continuity decisions require cooperation among procurement, engineering, quality and operations.
5. Plans should be tested before a crisis occurs.

8. Governance, Ethics and Technology

Risk controls must comply with competition law, trade restrictions, product-safety requirements, environmental rules, data-protection obligations and contractual duties. Sharing forecasts with suppliers should not become an exchange of competitively sensitive information. Emergency buying does not justify bribery, falsified records, unsafe substitutions or discriminatory treatment of vulnerable suppliers.

Supplier due diligence should consider labour conditions, modern slavery risks, environmental impacts, corruption controls, cyber security and financial health. Organisations should establish reporting channels, segregation of duties, approval limits and audit trails. Resilience that depends on unsafe labour or environmental damage is not responsible resilience.

Digital tools can improve early warning through supplier portals, spend analytics, inventory visibility, external event monitoring and scenario dashboards. Artificial intelligence may help detect abnormal lead times, classify news or identify patterns in quality data. However, AI outputs may be incomplete, biased or based on outdated information. Human validation, explainability, data security and access controls remain essential. A digital risk dashboard is not a substitute for supplier relationships, physical verification or management judgement.

9. Performance Measures and Best Practice

Useful indicators include supplier on-time-in-full performance, defect rate, lead-time variability, percentage of critical spend with qualified alternatives, days of coverage for critical items, recovery time achieved in exercises, forecast accuracy, supplier financial-risk alerts and continuity-plan completion. Measures should distinguish prevention from recovery. A low incident count may mean effective control—or poor reporting.

Best practice includes:

• maintain a current risk register with named owners;
• classify materials by business criticality, not price alone;
• review Kraljic positions after design and market changes;
• qualify and periodically test alternative suppliers;
• combine inventory, capacity, information and design buffers;
• integrate procurement, engineering, quality, operations, finance and IT;
• define RTO, RPO and maximum tolerable downtime;
• test plans through simulations and update them after every exercise;
• monitor upstream dependencies and geographic concentration;
• document ethical, legal and approval requirements for emergency action.

Challenges and Limitations

Risk assessment is affected by incomplete information, cognitive bias, changing conditions and pressure to minimise cost. Suppliers may conceal financial or capacity problems, while buyers may overestimate the reliability of familiar sources. Diversification can reduce efficiency, weaken volume leverage and create quality variation. Large buffers can become obsolete, and contracts cannot overcome a physical shortage of a unique material. Scenario planning cannot predict every event. Resilience therefore requires a portfolio of controls, continuous learning and proportional investment.

Chapter Summary

Materials risk arises from uncertainty in supply, price, quality, geopolitics, operations, information, finance and the environment. Effective risk management identifies events, assesses likelihood and impact, selects proportionate treatments and assigns ownership. Risk matrices provide a useful screening method, while expected loss can support economic comparison when estimates are credible.

Kraljic portfolio analysis links profit impact and supply risk to purchasing strategies. Dual sourcing, standardisation, approved substitution, supplier collaboration, contracts and carefully designed buffers can improve resilience. Inventory formulas are useful only when their assumptions are understood. Scenario planning tests plausible disruptions, while business continuity planning defines response, continuity and recovery arrangements through objectives such as RTO and RPO.

Resilience must be governed ethically and legally. Technology can improve visibility and early warning, but it does not eliminate the need for human judgement, supplier development and practical exercises. The strongest materials organisations treat continuity as a cross-functional strategic capability rather than an emergency purchasing activity.

Key Terms

Risk: Uncertainty that may affect organisational objectives.

Disruption: A realised event that interrupts normal operations.

Resilience: The ability to resist, absorb, adapt to and recover from disruption.

Business continuity: The capability to maintain critical activities during and after disruption.

Risk register: A controlled record of risks, causes, consequences, controls, owners and actions.

Risk matrix: A grid that combines likelihood and impact ratings.

Risk appetite: The level and type of risk an organisation is willing to accept.

Expected loss: Probability multiplied by the consequence of an event.

Kraljic portfolio analysis: A purchasing framework based on profit impact and supply risk.

Strategic item: An item with high profit impact and high supply risk.

Bottleneck item: An item with low profit impact but high supply risk.

Dual sourcing: Use of two approved suppliers for the same requirement.

Safety stock: Inventory held to protect against uncertainty.

Buffer: Capacity, time, stock, information or financial protection against variation.

Scenario planning: Examination of several plausible future conditions.

Business impact analysis: Assessment of process consequences and recovery priorities.

RTO: Target time for restoring a process or system.

RPO: Maximum acceptable age of data after recovery.

Maximum tolerable downtime: Longest period a process can be unavailable before unacceptable harm occurs.

Supplier due diligence: Investigation of a supplier’s capability, integrity, financial condition and compliance.

Review Questions

Short Answer Questions

1. Distinguish between risk, disruption and business continuity.
2. What are the two dimensions in Kraljic portfolio analysis?
3. State two limitations of a risk matrix.
4. Define recovery time objective and recovery point objective.
5. Give two reasons why dual sourcing may fail to provide real resilience.

Long Answer Questions

1. Explain the major categories of materials risk and show how they may interact.
2. Describe the stages of a materials risk-management process.
3. Explain each Kraljic category and recommend a suitable purchasing strategy for each.
4. Discuss the benefits and costs of inventory buffers, supplier diversification and standardisation.
5. Describe the contents of an effective business continuity plan.

Analytical / Application Questions

1. A critical component has a likelihood rating of 4 and an impact rating of 5. Another has ratings of 5 and 3. Calculate both risk scores and explain why the numerical result alone should not determine the control decision.
2. A company has two suppliers, but both obtain their key raw material from the same country and port. Analyse whether this is genuine diversification and recommend further actions.
3. Design a continuity response for a cyberattack that makes purchasing and inventory records unavailable for 48 hours. Identify immediate actions, critical dependencies, communication needs and recovery priorities.

Multiple Choice Questions with Answers

Question 1

Which risk category includes tariffs, sanctions and border closures?

A. Geopolitical risk

B. Quality risk

C. Packaging risk

D. Routine demand risk

Correct Answer: A. Geopolitical risk

Question 2

A risk has likelihood 4 and impact 5 on a five-point scale. What is its screening score?

A. 9

B. 20

C. 25

D. 1

Correct Answer: B. 20

Question 3

Which Kraljic category has high profit impact and high supply risk?

A. Non-critical

B. Leverage

C. Bottleneck

D. Strategic

Correct Answer: D. Strategic

Question 4

What is the main purpose of a qualified second supplier?

A. To eliminate all inventory

B. To reduce dependence on one source

C. To avoid quality approval

D. To guarantee lower prices

Correct Answer: B. To reduce dependence on one source

Question 5

In the simplified safety-stock expression SS = z × σ_d × √L, what does z represent?

A. Average demand

B. Lead time in units

C. The selected service-factor multiplier

D. Supplier defect rate

Correct Answer: C. The selected service-factor multiplier

Question 6

What does an RTO specify?

A. The acceptable age of recovered data

B. The target time to restore a process or system

C. The annual purchase quantity

D. The supplier’s financial rating

Correct Answer: B. The target time to restore a process or system

Question 7

Why should a risk register assign an owner to each important risk?

A. To ensure responsibility for monitoring and action

B. To guarantee that the risk will occur

C. To remove the need for controls

D. To replace supplier contracts

Correct Answer: A. To ensure responsibility for monitoring and action

Question 8

Which is a limitation of multiplying ordinal likelihood and impact ratings?

A. It always requires monetary data

B. It proves that risks are independent

C. Different assessors may interpret ratings differently

D. It cannot rank any risks

Correct Answer: C. Different assessors may interpret ratings differently

Question 9

Which action best represents scenario planning?

A. Assuming only the most likely forecast will occur

B. Examining several plausible disruption conditions and responses

C. Ordering materials without a specification

D. Auditing only after a failure

Correct Answer: B. Examining several plausible disruption conditions and responses

Question 10

Why is an untested second supplier not a fully effective continuity measure?

A. It may lack technical, quality or operational readiness

B. It always increases product quality

C. It eliminates the need for contracts

D. It guarantees excess inventory

Correct Answer: A. It may lack technical, quality or operational readiness