Supply Chain Risk, Resilience and Continuity

Introduction

Supply chains create value by connecting suppliers, manufacturers, logistics providers, distributors and customers. The same interdependence that improves efficiency can also transmit disruption. A fire at a component supplier, a port closure, a cyberattack on a warehouse system, an export restriction or a sudden demand shock may interrupt material flow and reduce an organisation’s ability to serve customers.

Supply chain risk management is the systematic identification, assessment, treatment and monitoring of events that may prevent supply-chain objectives from being achieved. Resilience is the capability of a supply chain to prepare for disruption, absorb its effects, recover within an acceptable period and adapt after the event. Business continuity concerns the maintenance of critical operations during and after disruption. These ideas are related but not identical: risk management seeks to reduce exposure; resilience focuses on response and adaptation; continuity planning defines how essential activities will continue.

For materials managers, the subject is strategic because availability, cost, quality, safety and customer service depend on decisions made well before a disruption occurs.

Learning Objectives

After studying this chapter, learners should be able to:

1. Classify operational, supplier, transport, cyber, geopolitical and other supply-chain risks.
2. Explain the relationship between vulnerability, exposure, probability and consequence.
3. Apply qualitative risk matrices and basic quantitative risk measures.
4. Use scenario analysis to examine plausible disruption conditions.
5. Distinguish redundancy, flexibility, visibility and collaboration as resilience capabilities.
6. Develop business-continuity and recovery plans.
7. Evaluate trade-offs among resilience, cost, service and sustainability.
8. Recognise governance, ethical, regulatory and technology issues in risk management.

1. The Nature of Supply-Chain Risk

A risk is an uncertain event or condition that may have a positive or negative effect on objectives. In supply chains, risk may arise from internal processes, external partners, infrastructure, the environment or deliberate attacks. A disruption is the realised event; a crisis is a disruption whose scale, speed or consequences exceed normal management capacity.

Important distinctions include:

• Hazard: a source of potential harm, such as flooding or malware.
• Exposure: the extent to which an organisation or flow is subject to a hazard.
• Vulnerability: the susceptibility of a system to harm because of design, dependence or weak controls.
• Impact: the consequence if the event occurs.
• Resilience: the capability to withstand, recover and adapt.
• Continuity: the capability to maintain or restore critical services at an acceptable level.

A supply chain should be viewed as a network rather than a simple linear sequence. A single supplier may serve several plants, a logistics provider may operate many facilities, and one port or digital platform may connect numerous trading partners. Consequently, local failures can create systemic effects.

2. Major Categories of Risk

Operational risk

Operational risks originate in processes, people, equipment, facilities and information. Examples include inaccurate bills of material, poor inventory records, machine breakdown, inadequate maintenance, labour shortages, unsafe handling, quality failures and warehouse congestion. Operational risk is often amplified by weak standard operating procedures and excessive dependence on manual workarounds.

Supplier risk

Supplier risk includes financial failure, capacity limitations, poor quality, late delivery, labour disputes, unethical practices, regulatory non-compliance and loss of a critical sub-tier supplier. A supplier may appear reliable while depending on a vulnerable raw-material source several tiers upstream. Supplier segmentation should therefore consider both spend and criticality.

Transport and infrastructure risk

Transport risks include vehicle shortages, accidents, carrier insolvency, strikes, border delays, fuel-price volatility, port congestion, damaged cargo and incorrect documentation. Infrastructure risks include failures of roads, bridges, ports, airports, electricity, telecommunications and water systems. Just-in-time flows are especially sensitive to small delays when inventories are low.

Demand and market risk

Demand risk results from forecast error, product substitution, seasonality, promotions, customer cancellations and rapid changes in technology. Excess demand causes shortages and expediting; weak demand creates obsolete inventory and working-capital pressure. Demand and supply risks frequently interact.

Cyber and information risk

Modern supply chains depend on enterprise-resource-planning systems, warehouse-management systems, transport platforms, electronic data interchange, cloud services and operational technology. Threats include ransomware, phishing, credential theft, denial-of-service attacks, unauthorised changes to master data and supplier-system compromise. Cybersecurity is therefore a supply-chain responsibility, not only an information-technology responsibility.

Geopolitical, legal and regulatory risk

Tariffs, sanctions, export controls, war, civil unrest, political instability, customs changes and nationalisation can restrict material movement. Laws concerning forced labour, environmental protection, data privacy, product safety and modern slavery also create compliance obligations. A low-cost source may become commercially unusable if legal access changes.

Environmental and social risk

Floods, storms, droughts, heatwaves, wildfire and sea-level rise can damage facilities and restrict transport. Social risks include unsafe working conditions, discrimination, child labour and community conflict. Ignoring these risks may create legal, reputational and operational consequences.

3. Risk Identification and Assessment

Risk identification combines structured methods with operational knowledge. Useful techniques include process mapping, supplier interviews, site audits, failure-mode analysis, incident review, horizon scanning, contract review and examination of external data. A risk register records the risk owner, cause, event, consequence, existing controls, rating, treatment and review date.

A useful statement has the form: because of cause, event may occur, resulting in consequence. For example: because a product has a single approved source, supplier insolvency may stop production, resulting in lost sales and emergency procurement.

Probability–impact assessment

A common qualitative model assigns a score to probability and impact:

Here, R is the risk score, P is the probability score and I is the impact score. The scales may be 1–5, provided that the organisation defines them consistently. This multiplication is a prioritisation device, not a precise probability model. A score of 12 may arise from high probability and moderate impact or low probability and very high impact; management must inspect the two dimensions separately.

Impact should be assessed across relevant dimensions such as safety, customer service, revenue, cost, quality, legal compliance, reputation and recovery time. A five-level probability scale might range from rare to almost certain. A five-level impact scale might range from insignificant to catastrophic.

Thresholds must be adapted to the organisation. A low-frequency safety event may deserve more attention than a frequent administrative delay.

Expected loss

When credible numerical estimates exist, expected loss can support economic decisions:

where EL is expected loss per period, pᵢ is the probability of scenario i, and Cᵢ is its monetary consequence. Probabilities must refer to the same period and scenarios should be mutually exclusive and collectively sufficient for the analysis. Expected loss is an average planning measure; it does not describe the worst case and should not be used alone for safety, legal or catastrophic risks.

Risk appetite and risk tolerance

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of objectives. Risk tolerance is the permitted variation around a target. For example, an organisation may have zero tolerance for unsafe products but tolerate a defined level of late administrative paperwork. Clear limits improve escalation and decision consistency.

4. Resilience Capabilities

Resilience is built through a portfolio of capabilities rather than one control.

Redundancy

Redundancy provides alternative capacity, inventory, facilities, suppliers, routes or systems. Dual sourcing can reduce dependence on one supplier, while safety stock can absorb short interruptions. Redundancy improves protection but adds cost, qualification effort, coordination and sometimes environmental burden. Two suppliers located in the same flood zone do not provide genuine geographic redundancy.

Flexibility

Flexibility is the ability to change volume, product mix, process, supplier, route or schedule. Examples include common components, modular product design, cross-trained employees, multiple transport modes and contracts with adjustable quantities. Flexibility is valuable when the exact disruption is uncertain, whereas redundancy is more directly valuable when the failure point is known.

Visibility and transparency

Visibility means timely access to accurate information about inventory, orders, capacity, shipments, incidents and dependencies. Transparency extends visibility by encouraging relevant parties to disclose conditions and risks. Visibility does not remove risk; it reduces surprise and increases response time. Data quality, common definitions, ownership and cybersecurity are essential.

Agility and collaboration

Agility is the speed with which the network can sense and respond. Collaboration may include joint forecasts, supplier development, shared contingency plans, mutual assistance and coordinated customer communication. Collaboration should be supported by appropriate contracts and trust; forcing all risk onto suppliers may hide rather than reduce exposure.

Financial and organisational resilience

Cash reserves, insurance, access to credit and suitable commercial terms support recovery. Organisational resilience includes leadership, decision rights, trained teams, communication routines and a culture that reports weak signals instead of concealing them.

5. Scenario Analysis and Stress Testing

Scenario analysis explores plausible combinations of conditions rather than predicting one future. A scenario normally specifies the initiating event, duration, affected nodes, available information, operational constraints, customer priorities and recovery assumptions.

A practical process is:

1. Select critical products, services or flows.
2. Identify major dependencies and plausible hazards.
3. Construct a baseline and several severe-but-plausible scenarios.
4. Map effects on supply, production, inventory, transport, systems and customers.
5. Define decisions, triggers, owners and information requirements.
6. Test the response through a tabletop exercise or simulation.
7. Record gaps, assign actions and retest.

Stress testing should challenge assumptions such as uninterrupted electricity, available transport capacity, functioning telecommunications, cooperative suppliers and accurate inventory records. A scenario is not a forecast; it is a disciplined way to test preparedness.

6. Business Continuity and Recovery Planning

Business continuity management identifies critical activities and establishes how they will continue during disruption. A continuity plan normally contains:

• critical products, customers and processes;
• dependencies on people, facilities, materials, utilities, technology and suppliers;
• emergency contacts and authority levels;
• minimum acceptable service levels;
• alternative procedures and resources;
• communication protocols;
• recovery priorities and decision triggers;
• testing, training and review arrangements.

A business impact analysis determines which activities are most important and how quickly they must be restored. Two useful terms are:

• Recovery time objective (RTO): the target time within which an activity or system should be restored.
• Recovery point objective (RPO): the maximum acceptable amount of data loss measured in time.

For example, an RTO of 8 hours means restoration is targeted within eight hours; an RPO of 1 hour means data should be recoverable to a point no more than one hour before failure. These are planning objectives, not guarantees.

Continuity planning should distinguish response from recovery. Response protects life, stabilises the situation and communicates. Recovery restores capacity, validates quality, clears backlogs, reconciles records and returns to normal or redesigned operations. A plan that only lists emergency contacts is incomplete.

Recovery priorities

A typical sequence is safety and legal obligations, preservation of people and assets, restoration of critical information, provision of essential customer service, replenishment of materials, backlog reduction and normalisation. Priorities should be agreed before a crisis because conflict is likely during one.

7. Inventory and Network Decisions

Inventory can buffer uncertainty, but it cannot solve every risk. A general inventory relationship is:

where ROP is reorder point in units, d is average demand per time unit, L is lead time in the same time unit, and SS is safety stock in units. The formula assumes a continuous-review setting and uses average demand and lead time. If demand and lead time are variable, safety stock should reflect their distributions and desired service level; the simple formula alone is insufficient.

For independent demand and lead-time variability, one commonly used approximation is:

where σDL is the standard deviation of demand during lead time, σd is standard deviation of demand per period, σL is standard deviation of lead time, and d and L are the means. This approximation assumes independence and is most suitable when a normal approximation is reasonable. If demand and lead time are correlated, the covariance term should be included; if distributions are highly skewed or intermittent, simulation or empirical percentiles may be preferable.

Safety stock may then be estimated as:

where z is the standard-normal service factor associated with the selected cycle-service probability. The estimate is sensitive to data quality and the chosen service definition. Excess stock can become obsolete, while insufficient stock increases shortage and expediting risk.

Network design decisions include regional warehouses, postponement, local finishing, supplier diversification and alternative transport corridors. These choices should be evaluated using total cost and service consequences, not purchase price alone.

8. Worked Example: Prioritising Two Risks

A materials manager rates two risks on a 1–5 scale. Risk A, a routine carrier delay, has probability 4 and impact 2. Risk B, a cyberattack on the warehouse system, has probability 2 and impact 5.

Risk A score = 4 × 2 = 8.

Risk B score = 2 × 5 = 10.

Under the table used in this chapter, Risk A is moderate and Risk B is high. Risk B receives priority despite its lower probability because its consequence is more severe. The manager should still treat Risk A because repeated moderate delays may accumulate into significant service failure. Possible controls include an alternate carrier, manual dispatch procedures, tested data backups, offline contact lists and a recovery exercise.

9. Illustrative Case: Medical-Device Component Disruption

Background

The following is a fictional illustrative case. A medical-device assembler purchases a specialised molded component from one approved supplier. The component is low in purchase cost but essential to a regulated product. The supplier’s plant is located in a region exposed to seasonal flooding.

Problem

A flood closes the plant and contaminates tooling. The assembler has ten days of component inventory, while qualification of a new source normally takes six months. The enterprise-resource-planning system also becomes unavailable because the supplier’s cyber incident affects shared electronic transactions.

Analysis

The risk register identifies single-source dependence, geographic concentration, long qualification time, limited inventory visibility and digital interdependence. A probability–impact matrix rates the flood risk as high and the cyber dependency as high. A business-impact analysis shows that stopping production after ten days would affect hospitals and create regulatory and reputational consequences.

Approach and solution

The response team first confirms safety and product-quality requirements. It freezes non-essential component use, reconciles physical stock manually and allocates available material to urgent customer orders. The firm activates a pre-agreed alternate logistics provider, obtains approved emergency transport and communicates realistic delivery dates to customers and regulators.

For recovery, engineering begins qualification of a second supplier in another region. Procurement negotiates capacity reservations, while quality assurance approves a controlled substitute only after required testing. Information technology restores systems from tested backups and establishes an offline order-and-inventory procedure. The continuity plan is revised to include supplier cyber notification, manual transaction forms and a minimum data set for emergency operations.

Outcome

Production is reduced but does not stop. The organisation incurs premium freight and qualification cost, yet avoids a prolonged customer outage. Long-term measures include geographic diversification, dual tooling, a strategic component buffer, supplier financial and cyber assessments, annual disruption exercises and contractual requirements for incident reporting.

Learning points

The case demonstrates that criticality is not determined by spend. Physical, digital and regulatory dependencies can interact. Inventory helped only temporarily; recovery required engineering, quality, procurement, logistics, information technology and customer coordination. Resilience investments should therefore be evaluated at network level.

10. Governance, Ethics and Regulation

Risk management requires accountable ownership. The board or senior management should define risk appetite, while functional owners manage controls and report exceptions. Internal audit or independent review can test whether controls operate as stated. Risk registers should not become static documents; they require evidence, review dates and escalation criteria.

Ethical procurement requires due diligence on labour conditions, environmental effects, bribery, forced labour and community impacts. Transferring risk to a small supplier through unrealistic prices or lead times may increase hidden vulnerability and ethical harm. Supplier information must be collected proportionately and protected from misuse.

Regulatory requirements vary by industry and jurisdiction. Medical, food, aerospace, chemical and financial supply chains may require traceability, validated processes, records retention, product recall capability and formal incident reporting. Contract clauses should define notification times, audit rights, continuity expectations, data protection, subcontracting and recovery cooperation.

11. Technology and Contemporary Developments

Sensors, track-and-trace platforms, digital twins, artificial intelligence and control towers can improve detection and coordination. AI may identify unusual lead-time patterns, forecast demand, classify incidents or suggest alternative routes. However, AI outputs depend on representative data and clear human accountability. False alerts, biased supplier ratings, cyber compromise and unexplained recommendations can create new risk.

Useful safeguards include access controls, multifactor authentication, network segmentation, encrypted backups, supplier cybersecurity requirements, patch management, incident exercises and manual fallback procedures. Digital visibility should follow the principle of minimum necessary access. Data sharing should respect privacy, competition law and commercial confidentiality.

Contemporary resilience is moving from isolated contingency plans toward continuous sensing, ecosystem collaboration, climate adaptation and scenario-based investment. Organisations increasingly assess not only immediate disruption but also transition risks associated with decarbonisation, regulation and changing customer expectations.

12. Best-Practice Implementation Framework

A practical implementation cycle is:

1. Define objectives, critical services and risk appetite.
2. Map the end-to-end network, including important sub-tier dependencies.
3. Identify hazards, vulnerabilities, controls and early-warning indicators.
4. Assess probability, impact, uncertainty and interdependence.
5. Select treatments: avoid, reduce, transfer, accept or prepare to respond.
6. Build continuity and recovery plans with named owners.
7. Test through exercises, supplier reviews and controlled simulations.
8. Monitor performance and leading indicators.
9. Capture lessons from incidents and near misses.
10. Improve designs, contracts, inventory, capability and governance.

Leading indicators may include supplier financial deterioration, rising defect rates, increasing lead-time variance, cyber vulnerabilities, unusual route congestion and declining inventory-record accuracy. Lagging indicators include stockouts, recovery duration, customer losses and emergency freight cost. Both are necessary.

Challenges and Limitations

Risk scores can create false precision, especially when probability data are weak. Organisations may focus on visible first-tier suppliers while missing sub-tier dependencies. Redundancy can increase cost, emissions and complexity. Scenario analysis cannot represent every possible event, and continuity plans may fail if employees have not practised them. Visibility systems can produce large volumes of unreliable data. Finally, resilience is not an absolute condition: every system has limits, and decisions must balance service, affordability, safety, sustainability and fairness.

Chapter Summary

Supply-chain risk is the possibility that uncertainty will prevent objectives from being achieved. Major categories include operational, supplier, transport, demand, cyber, geopolitical, environmental and social risks. Effective assessment combines risk registers, probability–impact matrices, expected-loss analysis and scenario testing, while recognising the limitations of numerical scores.

Resilience depends on complementary capabilities: redundancy, flexibility, visibility, collaboration, financial strength and competent leadership. Inventory and alternative sources can buffer disruption, but they must be matched to criticality, cost and service requirements. Business continuity identifies critical activities, dependencies, minimum service levels, recovery time objectives and recovery point objectives. Recovery planning must be tested and continuously improved.

Strategic risk management also requires ethical procurement, regulatory compliance, cybersecurity, data governance and cross-functional accountability. The strongest organisations do not merely respond faster; they design networks that can sense change, absorb shocks, recover reliably and learn from disruption.

Key Terms

Risk: Uncertainty that may affect objectives.

Disruption: A realised event that interrupts normal supply-chain activity.

Hazard: A source of potential harm or loss.

Exposure: The extent to which a supply chain is subject to a hazard.

Vulnerability: Susceptibility to disruption because of dependence or weak controls.

Impact: The consequence of a risk event.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Risk register: A documented record of risks, controls, owners and actions.

Risk matrix: A tool that combines probability and impact ratings.

Expected loss: Probability-weighted average consequence across scenarios.

Resilience: The capability to prepare, absorb, recover and adapt.

Redundancy: Provision of alternative capacity, resources or routes.

Flexibility: The ability to change volume, mix, source, process or route.

Visibility: Timely access to accurate information about supply-chain conditions.

Business continuity: Maintenance or restoration of critical operations during disruption.

RTO: Target time for restoring an activity or system.

RPO: Maximum acceptable period of data loss measured in time.

Scenario analysis: Examination of plausible future conditions and their consequences.

Single-source dependence: Reliance on one supplier or source for a requirement.

Control tower: A coordinated capability for monitoring and managing supply-chain events.

Review Questions

Short Answer Questions

1. Distinguish a hazard, vulnerability and disruption.
2. What is the purpose of a risk register?
3. Explain why redundancy and flexibility are different resilience capabilities.
4. Define RTO and RPO.
5. Why should cyber risk be treated as a supply-chain issue?

Long Answer Questions

1. Explain the major categories of supply-chain risk and provide an example of each.
2. Describe how a materials manager can construct and use a probability–impact matrix.
3. Discuss the benefits and limitations of safety stock as a resilience measure.
4. Explain the stages of business-continuity and recovery planning.
5. Evaluate the role of governance, ethics and regulation in supply-chain resilience.

Analytical / Application Questions

1. A firm depends on one overseas supplier for a low-cost but critical component. Develop a risk assessment and recommend a portfolio of treatments.
2. Design a tabletop exercise for a warehouse-management-system ransomware incident. Specify decisions, information needs, recovery priorities and success criteria.
3. Compare two strategies: holding additional inventory and qualifying a second supplier. Identify the data and assumptions needed to select between them.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from risk management?

A. Resilience eliminates all uncertainty from a supply chain.

B. Resilience concerns preparing for, absorbing, recovering from and adapting to disruption.

C. Resilience is limited to purchasing insurance.

D. Resilience applies only to transport operations.

Correct Answer: B. Resilience concerns preparing for, absorbing, recovering from and adapting to disruption.

Question 2

A risk has a probability score of 4 and an impact score of 3. Using R = P × I, what is its score?

A. 7

B. 12

C. 16

D. 43

Correct Answer: B. 12

Question 3

Which is an example of supplier risk?

A. An inaccurate warehouse bin label

B. A carrier route delay caused by congestion

C. A critical supplier becoming financially insolvent

D. A customer changing a product preference

Correct Answer: C. A critical supplier becoming financially insolvent

Question 4

What does an RTO specify?

A. The maximum acceptable inventory value

B. The target time for restoring an activity or system

C. The percentage of orders transported by air

D. The maximum supplier payment period

Correct Answer: B. The target time for restoring an activity or system

Question 5

Which capability primarily provides alternative capacity or sources?

A. Redundancy

B. Forecast bias

C. Obsolescence

D. Standard costing

Correct Answer: A. Redundancy

Question 6

Expected loss is calculated by:

A. Adding all impacts without probabilities

B. Multiplying the highest impact by the lowest probability

C. Summing probability multiplied by consequence across scenarios

D. Dividing inventory by lead time

Correct Answer: C. Summing probability multiplied by consequence across scenarios

Question 7

Why is a low-spend component potentially a high supply-chain risk?

A. Spend always equals risk.

B. Criticality and lack of substitutes may matter more than purchase price.

C. Low-spend items never require quality control.

D. Low-spend items are always obsolete.

Correct Answer: B. Criticality and lack of substitutes may matter more than purchase price.

Question 8

Which activity is most appropriate during a business-impact analysis?

A. Identifying critical activities and acceptable restoration times

B. Selecting a brand colour for emergency forms

C. Removing all safety stock

D. Replacing every supplier immediately

Correct Answer: A. Identifying critical activities and acceptable restoration times

Question 9

What is a major limitation of a probability–impact matrix?

A. It cannot display any risks.

B. It may create false precision when ratings are subjective.

C. It requires no management judgement.

D. It measures only supplier prices.

Correct Answer: B. It may create false precision when ratings are subjective.

Question 10

Which control most directly improves cyber resilience?

A. Untested spreadsheets stored on one computer

B. Shared passwords for all suppliers

C. Multifactor authentication and tested backups

D. Removing all system access during normal operations

Correct Answer: C. Multifactor authentication and tested backups