Risk, Resilience, Sustainability, Ethics and Governance

Introduction

Entrepreneurial firms operate through networks of suppliers, logistics providers, employees, technologies, regulators and customers. These networks create value, but they also create exposure. A cyberattack can stop production; a flood can close a warehouse; a supplier may violate labour standards; a sudden regulation can make a product unlawful; or a sustainability failure can destroy customer trust. Operations and supply chain management therefore involves not only efficiency and cost, but also preparedness, responsibility and accountability.

Risk management seeks to understand uncertain events and reduce their adverse effects. Resilience concerns the ability of a system to withstand disruption, adapt and recover. Sustainability asks whether operations can create economic value without degrading environmental and social systems. Ethics and governance establish the principles, controls and responsibilities that guide decisions.

For entrepreneurs, these issues are strategic rather than merely administrative. Limited cash, dependence on a few suppliers and weak bargaining power may increase vulnerability. At the same time, smaller firms can often innovate rapidly, build close supplier relationships and design circular business models from the beginning.

Learning Objectives

By the end of this chapter, you should be able to:

1. Identify and classify operational and supply chain risks.
2. Assess risk using qualitative and quantitative techniques.
3. Apply continuity, scenario-planning and resilience frameworks.
4. Evaluate environmental and social impacts across a product life cycle.
5. Explain circular economy practices and responsible sourcing.
6. Describe compliance, traceability and governance controls.
7. Analyse trade-offs between efficiency, resilience, sustainability and cost.
8. Recommend practical controls for an entrepreneurial enterprise.

1. Understanding Operational and Supply Chain Risk

Risk is the possibility that uncertainty will affect objectives. A useful distinction is between a hazard, which is a potential source of harm, and an event, which is the occurrence that produces consequences. For example, severe rainfall is a hazard; a flooded distribution centre is an event; lost sales and damaged inventory are consequences.

Supply chain risks may originate inside or outside the firm. Common categories include:

Risk can be assessed through likelihood and impact, but these dimensions must be defined carefully. A five-point scoring matrix may support prioritisation, yet it is not a precise probability model. Scores should therefore be treated as decision aids rather than objective facts.

A quantitative approach is expected monetary loss (EML):

Here, pᵢ is the probability of scenario i, Lᵢ is its monetary loss, and the summation covers all relevant scenarios. Probabilities must be mutually exclusive and collectively exhaustive for the calculated EML to represent an expected value. EML is useful for comparing alternatives, but it does not capture risk appetite, catastrophic consequences, uncertainty in the estimates or non-financial harm.

Worked Example: Expected Loss

Suppose an online retailer estimates a 4% annual probability of a cyber incident costing £60,000 and a 10% probability of a transport disruption costing £12,000. If the events are treated as separate scenarios for this simple estimate:

EML = (0.04 × £60,000) + (0.10 × £12,000) = £2,400 + £1,200 = £3,600

The expected annual loss is £3,600. This does not mean the firm will lose exactly £3,600; it is a long-run probability-weighted average. Management might rationally spend more than £3,600 on controls if the cyber event threatens survival or customer safety.

Risk assessment should consider inherent risk, present before controls, and residual risk, remaining after controls. Controls may be preventive, detective or corrective. Supplier qualification is preventive; an incoming quality inspection is detective; a product recall is corrective.

2. Risk Identification and Assessment Frameworks

A practical risk process contains five linked activities:

1. Establish context: define objectives, boundaries, stakeholders, time horizon and risk appetite.
2. Identify risks: use process mapping, interviews, historical data, audits, supplier reviews and scenario workshops.
3. Analyse risks: estimate likelihood, impact, velocity, interdependence and control effectiveness.
4. Evaluate and prioritise: compare risks with agreed tolerances.
5. Treat, monitor and communicate: select controls and review changing conditions.

A process map or value-stream map is especially useful because it reveals single points of failure, long lead times, manual handoffs and hidden dependencies. A failure mode and effects analysis (FMEA) examines how a process can fail, its effects, causes and existing controls. Traditional FMEA often ranks severity, occurrence and detectability separately; multiplying ordinal scores can create misleading precision. The method is most useful when supported by clear definitions and team discussion.

Risk treatment options are commonly described as:

• Avoid: discontinue the activity or design that creates unacceptable exposure.
• Reduce: lower likelihood or consequence through controls.
• Transfer or share: use insurance, contracts or partnerships, while recognising that accountability cannot always be transferred.
• Accept: retain the risk when treatment cost exceeds benefit and exposure is within tolerance.
• Exploit: in opportunity-risk settings, deliberately increase exposure to capture an advantage.

3. Business Continuity and Resilience

Business continuity is the capability to continue critical activities during and after disruption. Resilience is broader: it includes anticipation, absorption, adaptation, recovery and sometimes transformation. A resilient supply chain is not simply one with large inventories. It combines visibility, alternatives, flexible capacity, decision rights, relationships and learning.

A business continuity management system normally includes:

• a business impact analysis;
• identification of critical products, processes and dependencies;
• recovery priorities and minimum service levels;
• continuity strategies;
• documented response plans;
• communication and escalation arrangements;
• training, exercises and continual improvement.

Two important time measures are:

• Recovery time objective (RTO): the maximum targeted time within which a process or service should be restored.
• Recovery point objective (RPO): the maximum acceptable period of data loss, measured in time.

For example, an e-commerce firm may set an RTO of four hours for order processing and an RPO of fifteen minutes for transaction data. These are management requirements, not predictions of actual recovery.

Resilience strategies include dual sourcing, qualified substitutes, postponement, modular product design, safety stock, local capacity, alternate logistics routes, cross-training, backup power, data redundancy and collaborative forecasting. Each creates cost or complexity. Dual sourcing may reduce dependency but sacrifice volume discounts; extra inventory improves availability but increases capital and obsolescence risk.

Scenario Planning and Stress Testing

Forecasts generally extend an assumed future. Scenario planning explores several plausible futures, including conditions that are unlikely but highly consequential. A robust scenario process:

1. identifies critical uncertainties;
2. constructs internally consistent scenarios;
3. tests operational, financial and stakeholder consequences;
4. identifies early-warning indicators;
5. develops trigger-based actions.

A stress test asks what happens under a deliberately severe condition, such as a 30-day supplier closure, a 40% demand reduction or simultaneous transport and cyber disruption. The purpose is not to predict the exact future, but to reveal vulnerabilities and improve choices.

4. Sustainability and Life-Cycle Thinking

Sustainability in operations has three connected dimensions:

• Environmental: emissions, energy, water, waste, biodiversity and resource depletion.
• Social: health and safety, wages, working time, human rights, inclusion and community effects.
• Economic: durable profitability, productivity, employment and long-term viability.

The triple-bottom-line perspective encourages firms to evaluate people, planet and prosperity together. It should not be interpreted as permission to trade away fundamental rights for financial gain. Certain harms, such as forced labour or unsafe products, are ethical and legal limits rather than ordinary cost trade-offs.

Life-cycle thinking examines impacts from raw-material extraction through manufacturing, distribution, use and end-of-life. It prevents burden shifting. A lighter package may reduce transport emissions but be difficult to recycle; an electric product may have higher manufacturing impacts but lower use-phase emissions. Life-cycle assessment (LCA) is a structured method for quantifying environmental impacts, but results depend on system boundaries, functional units, data quality and allocation choices.

A basic carbon inventory may be expressed as:

Activity data may be litres of fuel, kilowatt-hours of electricity or kilograms of material. Emission factors convert the activity into a common unit such as kilograms of CO₂-equivalent. The calculation is meaningful only when boundaries, factor sources, time period and treatment of renewable energy are documented. Scope classifications commonly distinguish direct emissions from owned or controlled sources, purchased energy, and other value-chain emissions.

Sustainability metrics should be balanced. Useful indicators include emissions per product, energy intensity, water use, waste diversion, injury frequency, supplier audit closure time, percentage of spend covered by responsible-sourcing checks and product return or repair rates. A single ratio can encourage gaming; a dashboard with definitions and assurance is more reliable.

5. Circular Economy and Sustainable Operations

A linear model follows take–make–use–dispose. A circular economy seeks to retain product, component and material value for as long as possible while reducing virgin-resource dependence and waste. Practices include:

1. Design for durability and repair: extend useful life.
2. Design for disassembly: make components separable.
3. Reuse and refurbishment: return products to productive use.
4. Remanufacturing: restore products to specified performance.
5. Industrial symbiosis: use one organisation’s by-product as another’s input.
6. Product-service systems: sell access or performance rather than ownership.
7. Reverse logistics: collect returns, packaging and end-of-life products.

Circularity requires economic viability. A take-back programme can fail if collection costs exceed recovered value or if returned products lack reliable quality. Entrepreneurs should design contracts, information systems and customer incentives together with the physical recovery process.

6. Responsible Sourcing, Ethics and Human Rights

Responsible sourcing extends procurement beyond price, quality and delivery. It asks whether suppliers respect labour rights, environmental duties, anti-corruption requirements and product-safety obligations. Due diligence is a risk-based process, not a one-time questionnaire. It commonly involves policy commitment, supplier mapping, risk prioritisation, prevention and mitigation, monitoring, remediation and public communication.

Ethical issues include child labour, forced labour, unsafe conditions, discrimination, excessive working hours, wage theft, privacy violations, bribery and misleading sustainability claims. A code of conduct is useful only when supported by purchasing practices. Unrealistic lead times and constant price pressure can create the very labour abuses that an audit policy claims to prevent.

Audits have limitations. Announced audits may produce staged compliance; workers may fear retaliation; subcontracting may remain invisible; and social conditions can change after the audit. More credible approaches combine worker voice, confidential grievance channels, unannounced checks where appropriate, documentary evidence, supplier development and remediation. Terminating a supplier immediately may remove income without solving harm; however, severe or unremedied violations may require disengagement.

7. Compliance, Traceability and Governance

Compliance means meeting applicable laws, regulations, contractual requirements and internal standards. Relevant areas may include product safety, data protection, employment, environmental permits, competition, customs, sanctions, anti-bribery, financial reporting and sector-specific licensing. Entrepreneurs should obtain competent legal advice for their jurisdiction; compliance cannot be inferred from general guidance alone.

Traceability is the ability to follow the history, application, location or ownership of an item. It may be:

• one step back: identify the immediate supplier;
• one step forward: identify the immediate customer;
• full chain: connect materials, transformations, movements and transactions across multiple tiers.

Traceability supports recalls, authenticity, sustainability claims and root-cause analysis. It does not automatically prove ethical behaviour. A blockchain or other immutable record cannot make inaccurate, fraudulent or incomplete input data true. Technology must therefore be combined with verification, access controls and accountability.

Governance allocates authority, responsibility and oversight. Effective controls include segregation of duties, approval limits, supplier onboarding, conflict-of-interest declarations, documented procedures, access management, audit trails, incident reporting, whistleblowing protection, corrective-action tracking and management review. A small firm may not have a formal board committee, but it can still assign an owner for risk, maintain a risk register and review critical controls monthly.

A useful governance principle is the “three lines” concept: operational managers own and manage risk; risk or compliance functions support and challenge; independent assurance evaluates the system. In a small enterprise, one person may hold several roles, but compensating controls—such as owner review, external accounting support or periodic independent checks—are important.

8. Technology, Data and Artificial Intelligence

Digital technologies improve visibility through sensors, enterprise systems, supplier portals, geographic tracking and analytics. Artificial intelligence can support demand sensing, anomaly detection, predictive maintenance and document review. Yet digitalisation creates cyber, privacy, bias, explainability and dependence risks. Automated recommendations should not be treated as authoritative when data are incomplete or conditions have changed.

Good practice includes data ownership, validated master data, least-privilege access, backups, multifactor authentication, system recovery tests, human review of high-impact decisions and supplier cybersecurity requirements. AI-generated sustainability claims or risk scores require source verification and auditability. A technically sophisticated system with poor governance can increase, rather than reduce, operational risk.

9. Integrated Decision-Making: The Resilience–Efficiency–Sustainability Tension

Operations decisions often involve competing objectives. Lean inventory may reduce waste and cost but increase stockout exposure. Local sourcing may shorten transport distance but have higher unit cost or lower capacity. Recycling may reduce virgin material use but require energy and reverse logistics. Responsible governance therefore requires explicit assumptions, stakeholder analysis and transparent trade-offs.

A practical decision sequence is:

1. identify the objective and non-negotiable constraints;
2. map dependencies and affected stakeholders;
3. compare alternatives across cost, service, risk, environmental and social criteria;
4. test alternatives under adverse scenarios;
5. select controls and indicators;
6. review outcomes and revise the decision.

Weighted scoring can structure discussion, but weights are value judgments. A high score does not make an option ethically acceptable if it violates law or fundamental rights.

Applied Case: GreenBite Foods (Illustrative)

Background

GreenBite Foods is a fictional entrepreneurial firm producing plant-based snack bars. It buys cocoa ingredients from an importer, packaging from a regional converter and uses a contract manufacturer. Sales have grown rapidly through online channels.

Problem

A severe port disruption delays cocoa deliveries. At the same time, a customer discovers that a packaging supplier has made an unsubstantiated “fully recyclable” claim. GreenBite has limited visibility beyond its direct suppliers, no tested continuity plan and no documented approval process for sustainability claims.

Analysis

The firm’s critical dependencies are cocoa availability, contract-manufacturing capacity, packaging supply and online order fulfilment. The port disruption is a supply and logistics risk with high impact. The packaging claim is a compliance, reputational and governance risk. Lack of tier-two visibility increases uncertainty. A rapid supplier switch could preserve sales but introduce quality, food-safety or labour risks.

Approach and Solution

GreenBite first conducts a business impact analysis and identifies cocoa and food-safe packaging as critical inputs. It qualifies a second cocoa source, sets a minimum stock policy based on demand variability and lead time, and agrees allocation priorities with the manufacturer. It creates a supplier code covering labour, environmental and anti-bribery expectations, then uses risk-based due diligence rather than relying solely on certificates.

For packaging, the firm withdraws the unsupported claim, verifies material composition and revises the label. It establishes a claim-approval control requiring evidence review by operations and an independent second approver. A digital batch record links finished products to ingredient lots and packaging batches. A quarterly exercise tests port closure, cyber outage and product recall scenarios.

Outcome

The second source prevents a prolonged stockout, although its higher price reduces short-term margin. The corrected packaging communication avoids misleading customers and improves credibility. Traceability reduces the time needed to identify affected lots during a simulated recall. Management also discovers that its purchasing targets had encouraged excessive supplier lead-time pressure and revises them.

Learning Points

The case demonstrates that resilience is a system capability, not a single inventory decision. Sustainability claims require evidence and governance. Responsible sourcing must include purchasing behaviour, supplier development and remediation. Traceability is valuable when records are accurate and linked to operational decisions.

Challenges and Limitations

Risk estimates are often affected by ambiguity, limited data, correlated events and changing conditions. Historical data may be poor guides to climate extremes, geopolitical shocks or novel cyber threats. Resilience investments can be difficult to justify because their benefit is the disruption that does not occur. Sustainability metrics may encourage superficial compliance, especially when firms optimise easily measured indicators rather than actual outcomes. Supplier audits can create administrative burden without improving worker welfare. Finally, small firms may lack specialist staff and bargaining power. Partnerships, industry associations, external assurance and phased implementation can help address these constraints.

Best-Practice Checklist for Entrepreneurs

• Maintain a current risk register linked to strategic objectives.
• Map critical suppliers, tiers, locations and dependencies.
• Define RTOs, RPOs, escalation roles and communication channels.
• Test continuity plans rather than merely documenting them.
• Use multiple indicators for service, cost, environmental and social performance.
• Verify sustainability claims and retain evidence.
• Apply risk-based responsible-sourcing due diligence.
• Build traceability proportionate to product and regulatory risk.
• Protect whistleblowers and provide credible grievance mechanisms.
• Review cyber controls, backups and third-party access.
• Record decisions, assumptions, owners and deadlines.
• Learn from incidents, near misses and exercises.

Chapter Summary

Operational and supply chain risks arise from demand, supply, processes, logistics, finance, technology, the environment, society and regulation. Effective management identifies risks, analyses likelihood and consequences, evaluates controls and monitors residual exposure. Expected monetary loss can support comparison, but it cannot replace judgement about catastrophic, ethical or legally unacceptable outcomes.

Business continuity focuses on maintaining critical operations, while resilience includes anticipation, absorption, adaptation and recovery. Scenario planning and stress testing expose vulnerabilities that ordinary forecasts may conceal. Sustainability requires life-cycle thinking across environmental, social and economic dimensions. Circular practices retain value through durability, repair, reuse, refurbishment, remanufacturing and reverse logistics.

Responsible sourcing requires due diligence, worker voice, remediation and alignment between supplier standards and purchasing practices. Compliance, traceability and governance provide accountability through policies, controls, records, oversight and assurance. Digital tools and AI can improve visibility but introduce cyber, privacy, data-quality and bias risks. Entrepreneurial success depends on integrating efficiency with resilience, sustainability, ethics and trustworthy governance.

Key Terms

Operational risk: The possibility that internal processes, people, systems or external events will disrupt objectives.

Supply chain risk: Uncertainty affecting the flow of materials, information, money or products across supply relationships.

Inherent risk: Exposure before controls are applied.

Residual risk: Exposure remaining after controls.

Expected monetary loss: Probability-weighted average loss across defined scenarios.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Business continuity: Capability to continue critical activities during disruption.

Resilience: Ability to anticipate, absorb, adapt to and recover from disruption.

RTO: Target maximum time for restoring a process or service.

RPO: Maximum acceptable period of data loss.

Scenario planning: Exploration of several plausible future conditions.

Life-cycle thinking: Assessment of impacts from inputs through use and end-of-life.

Circular economy: System that retains product, component and material value and reduces waste.

Responsible sourcing: Procurement that considers human rights, environmental and ethical performance.

Due diligence: Risk-based process of identifying, preventing, mitigating and addressing harm.

Traceability: Ability to follow an item’s history, location, use or ownership.

Governance: Structures and processes for direction, accountability and oversight.

Residual risk: Risk left after treatment and controls.

Review Questions

Short Answer Questions

1. Distinguish between a hazard, an event and a consequence.
2. What is the difference between an RTO and an RPO?
3. Identify three circular economy practices.
4. Why can supplier audits fail to reveal labour abuse?
5. What does traceability enable during a product recall?

Long Answer Questions

1. Explain a complete operational risk-management process and illustrate each stage with an entrepreneurial example.
2. Compare business continuity and resilience, including the role of scenario planning and stress testing.
3. Discuss how life-cycle thinking changes sustainability decisions in operations.
4. Explain why responsible sourcing must address a buyer’s own purchasing practices.
5. Evaluate the governance controls required for reliable sustainability claims.

Analytical / Application Questions

1. A firm faces a 5% probability of a £40,000 cyber loss and a 15% probability of a £8,000 transport loss. Calculate the simple expected monetary loss and explain why the firm might still spend more than that amount on controls.
2. Design a continuity and traceability plan for a small food producer dependent on one overseas ingredient supplier.
3. A proposed supplier is 12% cheaper but has weak labour transparency and a long single-source lead time. Analyse the decision using cost, resilience, ethical and governance criteria.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. Risk before any controls are applied

B. Risk remaining after controls are applied

C. Risk transferred entirely to an insurer

D. Risk that has already caused a loss

Correct Answer: B. Risk remaining after controls are applied

Question 2

A recovery point objective primarily specifies:

A. The maximum acceptable period of data loss

B. The maximum inventory quantity

C. The number of approved suppliers

D. The time needed to qualify a product

Correct Answer: A. The maximum acceptable period of data loss

Question 3

A firm estimates a 5% probability of a £40,000 loss and a 15% probability of an £8,000 loss. What is the simple expected monetary loss?

A. £2,000

B. £3,200

C. £3,600

D. £48,000

Correct Answer: C. £3,600

Question 4

Which practice most directly supports a circular economy?

A. Increasing single-use packaging

B. Designing products for repair and disassembly

C. Purchasing only from the nearest supplier

D. Maximising batch size regardless of demand

Correct Answer: B. Designing products for repair and disassembly

Question 5

Why is life-cycle thinking important?

A. It considers impacts only during manufacturing

B. It eliminates the need for environmental data

C. It prevents impacts from being shifted between life-cycle stages

D. It guarantees that every product is recyclable

Correct Answer: C. It prevents impacts from being shifted between life-cycle stages

Question 6

Which is an example of a preventive control?

A. A product recall after a defect is found

B. A post-incident investigation

C. Supplier qualification before approval

D. A customer complaint report

Correct Answer: C. Supplier qualification before approval

Question 7

What is a major limitation of an immutable digital record for traceability?

A. It cannot store any transaction information

B. It makes inaccurate input data truthful

C. It does not verify whether the original input data are accurate

D. It prevents all unauthorised access automatically

Correct Answer: C. It does not verify whether the original input data are accurate

Question 8

Responsible sourcing is best understood as:

A. Selecting the cheapest supplier available

B. A one-time supplier questionnaire

C. Risk-based due diligence addressing ethical, social and environmental impacts

D. Transferring all responsibility to a certification body

Correct Answer: C. Risk-based due diligence addressing ethical, social and environmental impacts

Question 9

Which action best represents scenario planning?

A. Using one forecast as the only future view

B. Testing several plausible futures and identifying trigger actions

C. Ignoring low-probability events

D. Reducing all risks to a single score

Correct Answer: B. Testing several plausible futures and identifying trigger actions

Question 10

Why might dual sourcing improve resilience?

A. It guarantees lower purchase prices

B. It removes all quality risks

C. It reduces dependence on one supplier

D. It eliminates the need for supplier monitoring

Correct Answer: C. It reduces dependence on one supplier