SCRLC Metrics / Quantifying Risk (Track #4)

1. SCRLCMetrics / Quantifying Risk (Track #4) Edward Erickson Track Co-leader June 7, 2007

2. Agenda • Overview • Scope • Deliverables • Schedule / Milestones • What we need from the Council • Case Study

3. Overview • Participation Excellent from thought leaders – lacking from practitioners • Survey Response Rate Poor • 3 companies (P&G, Boeing, Cisco) + TSA • 2 thought leaders (Stanford, Zurich) • Despite this track members believe that: • this is a critical focus area • it will lag the other tracks and will have a longer payoff time frame • Research members will lead the effort in the early phases

4. Scope • In Scope • How to portray SC risk modeling & analysis results in an impactful way • Methods for quantifying SC risk to support decision making & measuring the impact of actions • Methods for modeling SC risk & identifying potential improvement actions • Tools & techniques for determining important risk events and the scope of models • How to ground SC risk data in reality • Out of Scope • Standards definitions • Tool/Modeling development • Industry specific methods

5. Deliverables – To Date • Survey practitioners to understand current SC risk metric practices • Survey thought leaders to determine Best Known Methods (BKMs)

6. Metrics/Quantifying Researcher Risk Survey Who: All SCRLC research organizations – 1 survey per organization Why: Get a good sample of all of the metrics/quantifying risk best practices from a research/theoretical point of view. Questions: • What is the best way known way to quantify SC risk? • What is the best way you’ve seen in practice to measure SC risk? • What are the major gaps you see between the best methods and what you’ve seen in practice? • What are your current area of expertise and interest in measuring SC risk?

7. Summary of Researcher Survey Results (2 out 5 Responded) Where We Need to Be • Integrated view of supply chain risk • Utilize distributions for occurrence and intensity • Driven by historical loss/occurrence data • Application of expert knowledge to address gaps in data • Lack of data-driven analysis on key areas of supply chain risk • Lack of understanding for all risks affecting the supply chain • Focus on consequences rather than vulnerabilities and triggers • Focus narrowly on cost – should include customer impact • Focus only on most recent disruptions • Minimal use of stochastic modeling Where We Are • Independent focus on supplier, disaster and IT risks • Focus on easy to measure risks • Lack of data • Limited to analysis of the averages

8. Metrics/Quantifying Practitioner Risk Survey Who: All SCRLC companies & government agency members – 1 survey per organization Why: Get a good sample of all of the metrics/quantifying risk practices across all member companies Questions: • To what degree is SC risk management driven at your company (e.g. not at all, a strategic program, an ongoing part of the business, etc)? • Where do you want see your company in 2 years with respect to SC risk measurement and metrics • Do you use metrics/measurement as part of your SC risk management organization? • If you don't, what metrics/measurements could you envision as part of an effective process for managing risk? • If you do, what metrics/measurements do you currently use? • What data do you use to manage SC risk and manage your SC risk programs? • How do you use these data to manage SC risk and manage your SC risk programs? • What tools do you use to drive SC risk management decisions?

9. Summary of Practitioner Survey Results (4 out 10 Responded)

10. Deliverables - Planned • BKMs for portraying SC risk modeling & analysis results in an impactful way • BKMs for measuring SC risk and deciding what mitigation actions to pursue • BKMs and tools used for modeling risk and how to manage scope of these models • BKMs on SC risk data collection • BKMs for how to measure risk improvement based on supply chain improvements

11. Schedule / Milestones • May’07 Kickoff & Agreement on Scope/Deliverables/Milestones/Meeting Schedule Complete survey on Metrics/Quantifying metrics Session to review survey results and prepare for June core team update • June’07 Session on post core team update, change scope, etc • July’07 Session on Best Known Methods (BKMs) for measuring risk & deciding what mitigation actions to pursue • August’07 BKMs & tools used for modeling risk & how to manage scope of these models • September’07 BKMs on event probability data collection • November’07 BKMs for how to measure risk improvement based on supply chain improvements Monthly teleconference except for months with core team meeting (9 meetings/yr)

12. What we need from the Council • Are you supportive of the longer term view required? • Are you supportive of the defined deliverables? • Fill out the survey • Join the team

13. CiscoCase Study

14. Trans. & Logistics Customers Components Transformation Supply Chain Risk Mgmt. (SCRMx)The Challenge Risk Measures & Processes Process / DNA Risk Tolerance Risk Strategy Strategic Partner Site Risk Mgmt(PSRM) Comparative RiskMitigation CrisisDrills Tactical Focus &Governance QuantifyRisks Risk Map& Modeling Risk Budget Foundational Business ContinuityPlans (BCP) - Partner Crisis Mgmt.Plan PandemicPlan Business Continuity Mgmt. (BCM) - Process Responsive

15. High Level Process Quantify • Iterative process combining metrics and probabilistic modeling • Use exposure and recovery metrics to assess and determine focus areas • Use probabilistic modeling to quantify and measure the impact to the business and pareto key drivers Measure Assess

16. Time to Recover (Wks) 52 Week Time to Recover (TTR) Revenue Impact ($) $2.6 Bil Revenue Impact X X Probability of an Event Occurring (%) Probability of an Catastrophic Site Fire = %.01 Probabilistic Revenue Impact ($) Probabilistic Revenue Impact = $26 Mil Probabilistic Revenue Impact Site Revenue ($/Wk) Prod. X Company Y $50 Mil /Qtr

17. Risk MapRev. vs Risk (Prod. View) TTR (Product View) Rev @ Risk (Prod. View) Pareto of Drivers ROI BCP What products should I be most concerned about? What are the most critical components? What is their impact & likelihood? What are the drivers? What will be my ROI? Are my partners resilient? Product Operations Risk Map Rev vs Risk (Site View) TTR (Site View) Rev @ Risk (Site View) Pareto of Drivers ROI BCP What sites should I be most concerned about? What are the most critical issues? What is the impact & likelihood? What are the drivers? What will be my ROI? Are my partners resilient? Manufacturing Operations Rev @ Risk (E2E) Risk Map Rev. vs Risk (Event) ROI TTR (Top Product) What is my Risk? How has it changed? What are my costed options? What has it cost me? What is the impact to my customer? What should I be most concerned about? Exec. Mgmt. / Finance Cisco Case Study – Key Metrics

18. Cisco Case Study - Probabilistic Modeling Methodology Outputs Inputs Integrated Model Disruption Revenue @ Risk (Prod) Site/Region Events & Frequency Revenue @ Risk (Horiz.) Capacity Impact Revenue @ Risk (E2E.) Time to Recover Revenue @ Risk (Event) Expected Capacity Loss • Excel Based • Monte Carlo • Crystal Ball Engine • Direct Data Links Supply chain redundancies Sensitivity Analysis identifying risk drivers Financial Impact What-if Analysis Site Revenue Objective: Quantify drivers of risk and potential improvement from mitigations