Supply Chain Risk, Resilience, and Sustainability
This domain tests how risk is identified, scored and treated; how resilience is designed in; and how environmental and social performance is measured across the chain.
Identifying and scoring risk
Risk sources include supply failure, demand volatility, process and quality failures, logistics disruption, financial insolvency, cyber attack, geopolitical and trade action, and ESG exposure. Tier-2 and tier-3 visibility matters because most disruptions originate below the direct supplier. Tools include risk matrices (probability x impact), key risk indicators, supplier financial screening, and FMEA, where RPN = severity x occurrence x detection. Criticality analysis overrides raw RPN when severity is extreme.
Response and resilience
Responses are avoid, mitigate, transfer (insurance, contracts), and accept. Resilience levers are redundancy (dual sourcing, buffer stock, spare capacity), flexibility (multi-skilled labour, interchangeable plants), visibility (multi-tier mapping, control towers) and collaboration (shared forecasts, joint contingency plans). Simchi-Levi distinguishes time to recover (how long a node takes to return to full output) and time to survive (how long the firm can operate on inventory and alternatives); resilience requires survive time greater than recover time. Business continuity plans need owners, triggers and tested playbooks.
Sustainability
Triple bottom line covers economic, environmental and social performance. GHG Protocol scopes: scope 1 direct fuel, scope 2 purchased energy, scope 3 everything else in the value chain, usually the largest share. Circular economy design covers reuse, remanufacture and recycling, supported by extended producer responsibility. Supplier codes of conduct, ISO 14001, conflict-minerals due diligence and disclosure regimes translate commitments into requirements. In logistics, carbon per ton-kilometre and mode shift are the practical levers.
Worked example: RPN versus criticality
Three failure modes. A: severity 8, occurrence 3, detection 5, RPN 120. B: severity 5, occurrence 6, detection 4, RPN 120. C: severity 9, occurrence 2, detection 2, RPN 36. A and B tie, but A carries severity 8 against 5, so A is prioritised first because the consequence is worse, not just more likely. C has the lowest RPN yet the highest severity, so it should be handled with a detection control rather than dismissed; a single high-severity event can end the business even at low probability.
Traps that cost marks
Treating the risk matrix as a precise calculation. Ranking on RPN alone and ignoring severity. Claiming scope-3 reduction from own-site efficiency. Assuming dual sourcing removes risk when both suppliers share a sub-tier site. Writing a business continuity plan without owners or testing. Confusing resilience with inventory, which helps survive time but not recover time.