Supply Chain Risk and Resilience
This domain tests whether you can identify, quantify and treat supply chain risk, and distinguish resilience engineering from generic risk listing. Expect questions on concentration measures, failure-mode scoring, and the relationship between time to recover and time to survive.
Process and tools
- The cycle is identify, analyze, evaluate, treat, then monitor and communicate, with a named owner and review date for every entry.
- A risk register records likelihood, impact, velocity, mitigation, residual risk and trigger indicators.
- Concentration can be measured with the Herfindahl-Hirschman Index: sum of squared market shares, ranging from near zero to 10,000. Above roughly 2,500 indicates high concentration.
- FMEA scores risk priority number as severity times occurrence times detection; it prioritizes where to act first.
- Tier-n mapping, supplier financial health screening, geopolitical monitoring and cyber assessment extend visibility beyond tier one.
Resilience levers
- Time to survive is how long your inventory and alternatives keep you running; time to recover is how long the supply takes to restore.
- Resilience requires time to survive to be at least as long as time to recover.
- Levers: dual sourcing, strategic buffer stock, buffer capacity, nearshoring, consignment stock, contractual force majeure clarity, insurance and tested business continuity plans.
Worked example
A single-source component has a time to recover of 45 days after a supplier fire. Current inventory and qualified alternate capacity give a time to survive of 30 days.
- Gap: 15 days of uncovered demand.
- Options: add 15 days of buffer stock, carrying capital and obsolescence cost; qualify a second source, which takes around 12 months and does not close this gap; or pre-position consignment stock at a distributor. The reasoning: quantifying the gap turns risk into a cost-versus-downtime decision with a defensible answer, rather than a preference for dual sourcing on principle.
Traps
- Listing risks with no owner, likelihood or impact, which is an observation list rather than a register.
- Confusing an issue that has already occurred with a risk that might occur.
- Assuming dual sourcing always reduces total risk; it adds qualification cost and quality variation.
- Ignoring tier-2 and tier-3 suppliers that sit behind a reliable tier-1.
- Treating force majeure as cover for foreseeable, manageable events.