The Risk Communicator: April 2011

If you operate a business you are operating or relying on supply chains, and if you intend to stay in business you must manage the risk of supply chain disruptions. While assessment methodologies may vary, it makes little difference if a threat is intentional (security), accidental (safety) or an act of god (i.e., an earthquake). It also matters little if the portion of the supply chain you are dependent upon is within your organizational control or not. If it is disrupted you are affected. However, since elements of your supply chains are probably distributed over large portions of the planet, merely assessing the risks to which you are vulnerable is a daunting task. Simply reducing the scope of the assessment to only those operations you control isn't the solution: your secure factory cut off from their utilities is still losing money. You need to know what the risks are, act to prevent what is feasible, and develop plans to survive what you cannot prevent.

The fact is that none of us can do this by ourselves, regardless of whether "we" means the U.S. government or a small assembly plant in Georgia. We need to work with vast numbers of service providers, suppliers and others to determine the risks involved and to implement countermeasures or contingencies. Essentially, we need to establish a common language among all stakeholders and set expectations of performance.

Indeed, we already do this all the time. When we buy a USB flash drive we are selecting a product manufactured to certain standards developed by the industry that relate to its ability to interface with our computer and to how its storage capacity is rated. This is because the computer industry realized long ago the need for common component standards.

What those of us with risk management responsibilities must do is determine what are our essential operations and then assess what can disrupt them. This assessment needs to take place at a macro level to provide us with the big picture, as immediately diving into the details may prevent us from seeing the forest for the trees. Equipped with the big picture we are now better positioned to either define what we need to be accomplished or to select suppliers/service providers (business partners) that have the procedures in place that address our risk management needs. If our business partners are addressing the risk issues that could affect our supply chain we can stay out of the weeds and save money. After all, distant partners will know their operating environments better than we possibly could, and if they have done the work it isn't necessary to spend money to duplicate it. Where risk needs are not being addressed we do need to drill down further.

There is already one set of international business standards devoted to managing supply chain risks. By being international they have widespread acceptance and are well supported. The International Standardization Organization has grouped these into the ISO 28000 series and the pace of their adoption has now reached critical mass. The management system framework established by ISO 28000 can be used to cover all aspects of security: risk assessment, emergency preparedness, business continuity, sustainability, recovery, resilience and/or disaster management -- whether relating to terrorism, piracy, cargo theft, fraud or many other security disruptions. ISO 28000 is the only published and certifiable international standard that takes a holistic, risk-based approach to managing risks associated with any disruptive incident in the supply chain.

Consider the March 2011 Sendai earthquake and ensuing tsunami in Japan. While is was initially reported as a tragically freak combination, those who had adopted ISO 28002 (focused on supply chain security and not exclusively on security threats) would have understood the risk. While the 2011 earthquake was somewhat stronger than previous earthquakes in the region it actually produced a smaller tsunami (23.6 meters in height) than those produced by the same fault line in 1933 (28.7 meters) and 1896 (38.2 meters). Despite a strong tendency for our security departments to want to develop security and risk management programs for our business partners to use and to guide internal operations, it is not possible to cost effectively implement them on a wide enough scale to effectively manage risk.

I am a proponent of using international standards, but I do caution that they need to be used intelligently. If a company is certified to a particular ISO management standard the auditor determines if the company has the processes and practices in place to execute the company's management policy. A review of your company's management policies will help determine if they address your risk management needs. If the company has obtained certification of its management system, check on the reputation of the certification body and see if it is accredited to issue such a certification. Most countries maintain an accreditation body that links to the International Accreditation Forum. These national accreditation bodies provide lists of the organizations accredited to certify companies to specific standards. In the U.S. the accreditation body is the ANSI-ASQ National Accreditation Board.

Steven O'Malley is International Standardization Ship & Supply Chain Security Standards Coordinator and a partner with Analytical Innovative Solutions LLC. Previously he was the Director of Supply Chain & Maritime Security for SAIC, and a career U.S. Coast Guard officer. He has a masters degree in transportation management from Florida Institute of Technology. He is based out of the Atlanta metro area and can be contacted at aninso.llc@gmail.com