Planning Under Uncertainty, Risk and Resilience

Introduction

Supply chains are planned with incomplete information. Demand forecasts contain error, suppliers may fail, transport networks may be disrupted, and political or climatic events can invalidate assumptions that appeared reasonable when a plan was approved. Consequently, advanced supply-chain planning is not the search for a single “best” forecast or schedule. It is the design of decisions that remain economically and operationally acceptable across a range of possible futures.

Uncertainty refers to imperfect knowledge about future conditions. Risk is the possibility that uncertainty will produce an adverse consequence, usually described through likelihood and impact. Resilience is the capability of a supply chain to prepare for disruption, absorb its effects, recover, and adapt. These ideas are related but distinct: uncertainty concerns knowledge, risk concerns exposure and consequences, and resilience concerns the system’s response capability.

Traditional efficiency emphasizes low inventory, high asset utilization, supplier consolidation and minimal cost. Resilience may require spare capacity, multiple suppliers, alternative logistics routes, strategic inventory and investment in visibility. The central managerial problem is therefore a trade-off: how much protection should be purchased, against which threats, and at what cost?

Learning Objectives

By the end of this chapter, the reader should be able to:

1. distinguish variability, uncertainty, risk, disruption and resilience;
2. use sensitivity analysis and probabilistic forecasts in planning decisions;
3. explain and apply Monte Carlo simulation, scenario planning and stress testing;
4. identify supply, demand, geopolitical, financial, cyber and climate risks;
5. design inventory, capacity, sourcing and logistics buffers;
6. construct contingency plans and response playbooks;
7. evaluate resilience investments against efficiency and total-cost objectives; and
8. recognize the governance, ethical and technological requirements of resilient planning.

1. The Nature of Uncertainty in Supply Chains

Planning uncertainty has several sources:

Random variation is not always the same as structural uncertainty. If daily demand has a stable distribution, historical data may support probabilistic forecasting. If a new tariff, product launch or climate regime changes the data-generating process, historical frequencies may be unreliable. This distinction matters because statistical precision cannot compensate for a wrong structural assumption.

A useful risk statement identifies four elements: the cause, the event, the consequence and the control. For example: “A drought reduces reservoir levels; semiconductor output is constrained; customer orders are delayed; dual sourcing and conservation inventory reduce exposure.” This is more actionable than a broad statement such as “water risk is high.”

2. Probabilistic Forecasting and Decision-Relevant Uncertainty

A point forecast gives one expected value, such as 10,000 units next month. A probabilistic forecast describes a distribution of possible demand. It may be represented by quantiles, prediction intervals or a full probability distribution. For example, a forecast may state that monthly demand has a median of 10,000 units, a 10th percentile of 8,200 and a 90th percentile of 12,400.

Forecast uncertainty should be separated from process variability where possible. Forecast uncertainty concerns uncertainty about the expected future level; process variability concerns natural variation around that level. As the forecast horizon increases, uncertainty commonly increases because more events can intervene.

For a replenishment period, let:

• D = demand during the relevant protection period;
• μ_D = expected demand;
• σ_D = standard deviation of demand;
• Q_α = α-quantile of demand.

If a planner wants a cycle-service target of α and uses a simple order-up-to policy, the required order-up-to level is approximately:

This expression is general: it does not assume a normal distribution. If demand is normally distributed, then:

where z_α is the standard-normal quantile associated with service probability α. The normal approximation is unsuitable when demand is strongly skewed, intermittent, bounded, or affected by promotions unless the distribution is appropriately transformed or simulated.

When independent period demand has mean μ and standard deviation σ, and the protection period contains n periods, aggregate demand has:

and, under independence,

If demands are correlated, the variance is instead:

Positive correlation increases aggregate uncertainty; therefore, the square-root rule must not be applied blindly to correlated demand.

Safety stock under variable demand and lead time

Let L denote lead time, D demand per unit time, and assume demand and lead time are independent. With mean demand μ_D, standard deviation σ_D, mean lead time μ_L, and standard deviation σ_L, the variance of demand during lead time is approximately:

Thus, a normal-approximation safety stock is:

and the reorder point is:

The formula assumes a stable demand and lead-time process, independence between demand and lead time, and that a normal approximation is acceptable. If supply disruptions create a heavy-tailed or multimodal lead-time distribution, empirical quantiles or simulation are preferable.

Worked example

A component has mean daily demand of 100 units and standard deviation of 20 units. Mean lead time is 5 days with a standard deviation of 1.5 days. For a 95% cycle-service target, use z_0.95 ≈ 1.645. Assuming independence:

Therefore, σ_DL ≈ 159.4 units, and:

Expected demand during lead time is 500 units, so:

This is not a guarantee against shortage. It is a decision calibrated to the assumed distribution and service definition. If a single disruption can delay supply by 30 days, ordinary safety stock is not a sufficient contingency.

3. Sensitivity Analysis

Sensitivity analysis changes one or more assumptions and observes the effect on an outcome. It is useful for identifying value drivers, testing the robustness of a decision and prioritizing data-quality improvement.

Suppose annual total cost is represented by:

where C_p is purchase cost, C_h is annual holding cost per unit of inventory I, C_s is shortage cost per expected shortage unit E(S), and C_x X represents disruption or mitigation cost. The equation is a simplified decision model, not a universal cost identity. It is useful only when the cost terms are defined consistently and double counting is avoided.

A one-way sensitivity analysis varies one input while holding others constant. A two-way analysis varies two inputs, such as demand growth and supplier lead time. A tornado chart can rank the change in total cost caused by plausible low and high values. However, one-way analysis may conceal interactions. For example, high demand and long lead time may jointly create a shortage much larger than the sum of their separate effects.

The elasticity of an outcome Y to an input x is approximately:

It is dimensionless and useful for comparing drivers measured in different units. Sensitivity is not probability: an assumption can have a large effect but a low likelihood, or a small effect but a high likelihood.

4. Monte Carlo Simulation

Monte Carlo simulation represents uncertain inputs with probability distributions, repeatedly samples those inputs, calculates outcomes and summarizes the resulting distribution. It is appropriate when multiple uncertainties interact or when analytical formulas are difficult.

A basic procedure is:

1. define the decision and performance measures;
2. identify uncertain inputs, such as demand, yield, lead time and disruption duration;
3. assign distributions using historical data, external evidence or expert elicitation;
4. specify dependencies and correlations;
5. sample one coherent set of inputs;
6. run the planning or cost model;
7. repeat many times; and
8. inspect percentiles, tail losses, service levels and decision rankings.

For simulation trial r, an outcome can be written as:

where D_r, L_r, S_r and R_r are sampled demand, lead time, supply and risk variables. The estimated mean outcome is:

where N is the number of trials. The simulation standard error of the estimated mean is approximately s_Y/√N, where s_Y is the sample standard deviation of simulated outcomes. More trials reduce sampling error, but they do not correct a poorly specified model.

A common error is to sample demand and lead time independently when shortages themselves cause supplier expediting and longer lead times. Correlations, conditional distributions and common-cause events must be represented when material. Another error is false precision: a distribution with two decimal places is not more credible merely because a spreadsheet displays it that way.

Simulation results should be communicated through decision measures: probability of stockout, probability of service below target, 95th-percentile inventory, expected margin, time to recovery and conditional cash exposure. Managers should see both central estimates and tails.

5. Scenario Planning and Stress Testing

Scenario planning develops internally consistent narratives about alternative futures. Unlike a forecast, a scenario is not necessarily the most likely outcome. It is a structured exploration of what could happen and what the organization would do.

A practical scenario process is:

1. define the focal decision and horizon;
2. identify predetermined trends, such as installed capacity or contractual commitments;
3. identify critical uncertainties, such as trade access or demand substitution;
4. select two high-impact uncertainties and construct a scenario matrix;
5. describe implications for customers, suppliers, assets, cash and workforce;
6. test strategies against each scenario; and
7. define indicators that signal movement toward a scenario.

A scenario should include assumptions, causal logic, operational consequences and management actions. “Severe disruption” is not sufficiently specified unless its duration, geography, affected products and recovery constraints are stated.

Stress testing is more severe and often less probable. It asks whether a plan remains viable under deliberately adverse conditions. Examples include a 40% demand surge, loss of the largest supplier for eight weeks, closure of a major port, simultaneous energy and transport inflation, or a cyberattack that removes planning-system access.

The distinction is useful:

6. Risk Identification and Assessment

Risk registers should connect threats to nodes, flows and decisions. A useful register records the risk event, causes, affected products or sites, early-warning indicators, existing controls, owner, response time and residual exposure.

A simple expected-loss model is:

where p_i is the probability of risk event i, L_i is its monetary loss, and m is the number of mutually exclusive events. If events can occur jointly, summing separate expected losses may misrepresent dependence and interaction; a joint simulation or conditional model is then required. Expected loss also fails to express risk appetite when rare catastrophic losses are unacceptable.

Useful categories include:

• Supply risk: supplier insolvency, quality failure, capacity loss, raw-material scarcity and excessive concentration.
• Demand risk: forecast bias, substitution, cannibalization, promotion failure and abrupt market decline.
• Geopolitical risk: sanctions, tariffs, export controls, conflict, border closure and political instability.
• Climate risk: acute hazards such as floods and storms, and chronic hazards such as heat, sea-level rise and water stress.
• Operational and cyber risk: equipment failure, unsafe conditions, ransomware, data manipulation and loss of control systems.
• Financial and compliance risk: currency movements, credit deterioration, corruption, labour violations and regulatory non-compliance.

Risk assessment should consider concentration. A low-cost supplier may be strategically risky if it is the only qualified source, located in the same hazard zone as a key plant, or dependent on one sub-tier producer. Tier-two and tier-three visibility is often essential because disruption propagates through lower tiers.

7. Designing Buffers and Resilience Capabilities

A buffer absorbs uncertainty, but buffers differ in what they protect:

Diversification is not automatically resilient. Two suppliers may share a raw-material source, port, power grid or geopolitical exposure. Effective redundancy requires independence or at least differentiated failure modes. Postponement can reduce finished-goods variety while preserving the ability to respond to uncertain product mix. Modular product design can make substitution and repair easier.

Inventory decisions should distinguish cycle stock, safety stock, anticipation stock and strategic or emergency stock. Strategic stock should have explicit release rules, replenishment logic, expiry controls and ownership. Otherwise it becomes hidden obsolete inventory.

A resilience investment can be assessed through incremental net benefit:

This comparison should include the time value of money for multi-year investments. If cash flows occur over several years, net present value is:

where I₀ is initial investment, CF_t is net cash flow in year t, r is the discount rate and T is the evaluation horizon. Risk-adjusted cash flows must not also be discounted with an unjustifiably high rate without explaining the treatment of risk.

8. Contingency Planning and Response Playbooks

A contingency plan states what will be done when predefined conditions occur. A response playbook converts the plan into executable actions. It should include:

1. Trigger: measurable threshold, such as supplier confirmation failure for 48 hours.
2. Detection and verification: data source, responsible analyst and validation step.
3. Decision rights: incident leader, escalation authority and approval limits.
4. Immediate actions: protect people, preserve data, secure inventory and communicate.
5. Operational actions: allocate scarce supply, activate alternate sources, change routes or revise the production schedule.
6. Stakeholder communication: customers, employees, regulators, suppliers, insurers and investors.
7. Recovery criteria: conditions for returning to normal planning.
8. After-action review: root cause, performance, control weaknesses and updates.

Playbooks should be rehearsed. Tabletop exercises expose ambiguous authority and unrealistic assumptions without waiting for a real crisis. The objective is not to predict every event; it is to reduce decision latency and prevent avoidable confusion.

9. Illustrative Case: MedSure Diagnostic Kits

Background

MedSure, a fictional manufacturer of diagnostic kits, sells a temperature-sensitive product to hospitals. It sources a reagent from one approved supplier in a region exposed to seasonal flooding. The supplier is inexpensive and has historically delivered within 12 days, but lead time has occasionally reached 28 days. Demand is rising and hospitals penalize shortages more heavily than moderate excess inventory.

Problem

The planning team proposes reducing inventory because the average forecast error has improved. The risk team argues that the single-source arrangement and flooding exposure make the decision unsafe. Management must decide whether to retain the current arrangement, qualify a second supplier, or hold additional inventory.

Analysis

The team first separates ordinary uncertainty from disruption risk. It builds a probabilistic demand forecast, models lead time with an empirical distribution rather than a normal distribution, and adds a flood event that increases lead time by 20 days with an estimated annual probability based on external hydrological evidence. It then simulates three policies:

• Policy A: single supplier and ordinary safety stock;
• Policy B: single supplier plus strategic inventory sized for a defined disruption window;
• Policy C: dual sourcing, with the second supplier initially more expensive and having limited capacity.

The model reports expected total cost, probability of hospital shortage, 95th-percentile shortage, working capital and time to recovery. Sensitivity analysis varies flood probability, qualification cost and the shortage penalty. Stress testing removes the primary supplier for six weeks and tests whether Policy C can allocate scarce secondary capacity to critical hospitals.

Approach and solution

Simulation shows Policy A has the lowest routine cost but unacceptable tail exposure. Policy B materially reduces short-term shortages but increases expiry risk because reagent shelf life is limited. Policy C has higher purchase cost but lowers dependence and recovers faster. MedSure adopts a staged version of Policy C: qualify the second source, reserve capacity contractually, hold a smaller strategic inventory, and use a trigger based on river-level alerts and supplier-confirmed capacity.

The playbook gives the incident leader authority to release strategic stock, prioritize hospital orders using clinical criticality, activate secondary supply and communicate allocation rules. Inventory is rotated through normal demand so that the emergency buffer does not silently expire.

Outcome and learning points

The decision is not justified by average cost alone. It is justified by reduced tail loss, faster recovery and protection of clinically important customers. The case illustrates five lessons: improved forecast accuracy does not eliminate supply risk; diversification must be qualified and contractually usable; simulation should include dependencies and disruption states; strategic inventory requires expiry governance; and resilience decisions must reflect customer criticality, not merely aggregate service averages.

10. Technology, AI and Governance

Digital twins, control towers, event streams and supplier-risk platforms can improve visibility and accelerate scenario analysis. Machine-learning models may detect abnormal lead times, estimate demand quantiles or identify network patterns. However, predictive accuracy does not establish causal understanding or guarantee actionability. Models trained on stable historical data may fail under unprecedented disruptions.

Responsible use requires data lineage, documented assumptions, version control, validation, monitoring for drift and human override. Planners should know whether a risk score is based on verified supplier data, inferred proxies or outdated information. Automated allocation can also embed unfairness: during scarcity, allocating only by historical volume may disadvantage smaller hospitals or vulnerable markets. Allocation rules should be transparent, legally compliant and aligned with ethical priorities.

Cybersecurity is part of resilience, not an IT afterthought. Access controls, network segmentation, backups, recovery testing and offline procedures are necessary because a planning system that is unavailable can create a physical supply disruption. Sharing supplier-risk information must also respect confidentiality, competition law, privacy and contractual obligations.

11. Limits and Trade-offs

Resilience has limits. More suppliers can increase audit burden and quality variation. More inventory can create obsolescence, emissions and working-capital pressure. Local sourcing may reduce transport exposure but increase unit cost or concentrate risk in a smaller production base. Capacity reserved for emergencies may be idle during normal periods. A risk-free supply chain is impossible and potentially unaffordable.

Three governance principles are especially important:

• Proportionality: protection should reflect consequence, reversibility and stakeholder importance.
• Transparency: assumptions, risk appetite and trade-offs should be visible to decision makers.
• Accountability: named owners must monitor triggers, maintain controls and review outcomes.

Resilience should therefore be managed as a portfolio of capabilities rather than a single inventory target. The right question is not “How much buffer is enough?” but “Which combination of buffers, flexibility, visibility and recovery capability provides acceptable performance across plausible and severe futures?”

Best-Practice Checklist

• Use distributions and quantiles when a point forecast hides material uncertainty.
• Test demand–lead-time dependence rather than assuming independence.
• Separate routine variability from structural disruption scenarios.
• Validate simulation inputs, correlations and tail assumptions.
• Use scenarios to examine strategy and stress tests to expose failure points.
• Map tier-two and tier-three dependencies for critical materials.
• Qualify alternative suppliers and routes before an emergency occurs.
• Define triggers, authority, communications and recovery criteria in playbooks.
• Measure service, cost, cash, emissions, recovery time and customer criticality together.
• Rehearse plans and update them after incidents, near misses and major market changes.

Chapter Summary

Planning under uncertainty requires more than improving a single forecast. Probabilistic forecasts describe ranges of possible demand; sensitivity analysis identifies influential assumptions; Monte Carlo simulation examines interacting uncertainties; scenario planning develops coherent alternative futures; and stress testing evaluates survival under severe conditions. Supply, demand, geopolitical, climate, cyber and financial risks should be linked to specific nodes, consequences, indicators and owners.

Resilience is created through a portfolio of buffers and capabilities, including inventory, capacity, supplier and route redundancy, postponement, visibility, liquidity and recovery playbooks. These capabilities impose costs and may reduce routine efficiency, so decisions should compare total cost and service with tail exposure, recovery speed and stakeholder consequences. Effective resilience is governed through transparent assumptions, explicit triggers, rehearsals, ethical allocation rules and continuous learning.

Key Terms

Uncertainty: Imperfect knowledge about future conditions.

Risk: The possibility that an uncertain event produces an adverse consequence.

Disruption: An event that materially interrupts normal supply-chain flows or decisions.

Resilience: The ability to prepare for, absorb, recover from and adapt to disruption.

Probabilistic forecast: A forecast represented by a distribution or range of possible outcomes.

Quantile: A value below which a specified proportion of outcomes falls.

Safety stock: Inventory held to protect against uncertainty in demand or replenishment.

Reorder point: Inventory position at which replenishment is initiated.

Sensitivity analysis: Examination of how output changes when input assumptions change.

Monte Carlo simulation: Repeated random sampling used to estimate distributions of model outcomes.

Scenario planning: Exploration of coherent alternative futures and their strategic implications.

Stress testing: Evaluation of a system under deliberately severe conditions.

Buffer: A resource or capability that absorbs variation or disruption.

Postponement: Delaying final product commitment until demand information improves.

Redundancy: Availability of alternative sources, routes, capacity or systems.

Risk appetite: The level and type of risk an organization is willing to accept.

Response playbook: A predefined set of actions, roles, triggers and communications for an incident.

Tail risk: Low-probability exposure with potentially extreme consequences.

Control tower: A coordinated visibility and decision-support capability for supply-chain operations.

Review Questions

Short Answer Questions

1. Distinguish uncertainty, risk and resilience.
2. Why can a point forecast be inadequate for inventory planning?
3. State two assumptions behind the standard safety-stock formula for variable demand and lead time.
4. What is the difference between scenario planning and stress testing?
5. Identify four types of supply-chain buffers.

Long Answer Questions

1. Explain how probabilistic forecasting, sensitivity analysis and Monte Carlo simulation complement one another.
2. Discuss the efficiency–resilience trade-off using inventory, capacity and supplier redundancy as examples.
3. Describe how a supply-chain risk register should be constructed and governed.
4. Explain the design elements of an effective disruption-response playbook.
5. Critically evaluate the benefits and limitations of AI-enabled supply-chain risk analytics.

Analytical / Application Questions

1. A firm faces uncertain demand, variable lead time and a possible port closure. Design a combined probabilistic, simulation and stress-testing approach, specifying inputs, outputs and decision criteria.
2. Using the MedSure case, compare the strategic logic of ordinary safety stock, disruption inventory and dual sourcing. State which additional data would most affect the decision.
3. Construct a resilience scorecard for a critical component that includes cost, service, recovery time, concentration, climate exposure and ethical customer-priority considerations.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a probabilistic forecast from a point forecast?

A. A probabilistic forecast gives only the most likely value.

B. A probabilistic forecast describes a distribution or range of possible outcomes.

C. A probabilistic forecast eliminates forecast error.

D. A probabilistic forecast is used only for financial data.

Correct Answer: B. A probabilistic forecast describes a distribution or range of possible outcomes.

Question 2

Under independent period demand, how does the standard deviation of aggregate demand over n periods change?

A. It becomes nσ.

B. It becomes σ/n.

C. It becomes √nσ.

D. It remains σ regardless of n.

Correct Answer: C. It becomes √nσ.

Question 3

Which method is primarily intended to identify how strongly outputs respond to changed assumptions?

A. Sensitivity analysis

B. Supplier qualification

C. Postponement

D. Cycle counting

Correct Answer: A. Sensitivity analysis

Question 4

What is a key requirement for a credible Monte Carlo simulation?

A. All inputs must be assigned the same distribution.

B. Dependencies among uncertain inputs should be represented when material.

C. The model must use only average values.

D. The number of trials removes the need for valid assumptions.

Correct Answer: B. Dependencies among uncertain inputs should be represented when material.

Question 5

Which activity is most characteristic of stress testing?

A. Selecting the median demand forecast

B. Testing a plan against deliberately severe conditions

C. Calculating routine purchase price variance

D. Replacing all suppliers with one low-cost supplier

Correct Answer: B. Testing a plan against deliberately severe conditions

Question 6

A supplier’s low price is accompanied by dependence on one port and one sub-tier raw-material source. What is the principal concern?

A. Excessive product postponement

B. Hidden concentration and common-cause failure risk

C. Overly high forecast quantiles

D. Guaranteed route redundancy

Correct Answer: B. Hidden concentration and common-cause failure risk

Question 7

If mean daily demand is 100 units and mean lead time is 5 days, what is expected demand during lead time, before safety stock is added?

A. 20 units

B. 105 units

C. 500 units

D. 5,000 units

Correct Answer: C. 500 units

Question 8

Which item should a response playbook define explicitly?

A. Only the annual sales target

B. Triggers, decision rights, actions and recovery criteria

C. Only the supplier’s historical price

D. A guarantee that disruption will not occur

Correct Answer: B. Triggers, decision rights, actions and recovery criteria

Question 9

Why is resilience not equivalent to holding unlimited inventory?

A. Inventory never protects against demand uncertainty.

B. Inventory can create cost, obsolescence and expiry while failing to address some disruption types.

C. Inventory cannot be measured financially.

D. Inventory always increases lead time.

Correct Answer: B. Inventory can create cost, obsolescence and expiry while failing to address some disruption types.

Question 10

Which governance practice is most appropriate for AI-based supply-chain risk scoring?

A. Hide model assumptions from planners.

B. Use automated outputs without monitoring.

C. Maintain data lineage, validate models and provide human oversight.

D. Ignore model drift because historical data are objective.

Correct Answer: C. Maintain data lineage, validate models and provide human oversight.