BCI Supply Chain Resilience 2011 Public Version

Supported by: Sponsored by:
Supply Chain Resilience 2011

An international survey of more than 550 organizations from over 60 countries, which
considers the causes and consequences of disruption, the techniques and approaches
to identify key supply chains, and methods to gain assurance of resilience capability
3rd Annual Survey

Supply Chain Resilience 2011. Copyright © 2011 The Business Continuity Institute. Al RightsPublished
Reserved. November 2011 1
Contents
03 Executive summary
04 Introduction
05 Part 1: Sources and levels of disruption with their short and longer term consequences
14 Part 2: Identifying and assuring key supply chains
23 Part 3: Winning business with Business Continuity Management
26 Conclusions & recommendations
27 Respondent profiles
30 About the survey, the BCI, CIPS and the report’s sponsors
Supply Chain Resilience 2011. Copyright © 2011 The Business Continuity Institute. Al Rights Reserved. 2
Executive Summary
Introduction  Supply chain incidents led to a loss of are likely to be effective in practice.
productivity for almost half of businesses
This survey is the third in a series, starting in  The ability to demonstrate resilience is
along with increased cost of working (38%)
2009, that set out to consider the challenge of starting to become a factor in purchasing
and loss of revenue (32%).
developing resilient supply chains. decisions with 28% of respondents stating
 The longer term consequences of that they always or often have to provide
The survey in 2011 considers the sources and
disruption in the supply chain included assurance to prospective clients.
consequences of disruption along with their
shareholder concern (19%), damage to
origins within the supply chain system. Conclusions & Recommendations
reputation (17%), and expected increases
It majors on the methods used to understand
in regulatory scrutiny (11%). Effectively managing supply chain continuity is
supply chain vulnerability and measures taken critical not just because of the immediate
to ensure continuity.  The earthquakes and tsunami experienced
costs of disruption but as a result of the
in Japan and New Zealand this year,
Key Findings longer term consequences to stakeholder
affected 20% of responding organizations,
confidence and reputation that arise from
 85% of survey respondents experienced at headquartered in 18 different countries
failure.
least one disruption. and across 12 different industry sectors.
Fortunately, supply chain and BCM
 40% of analysed disruptions originated  For 17% of respondents the financial costs
management techniques are being brought
below the immediate tier one supplier. of the largest single incident totalled a
together to better understand the risk and
million or more Euros. For those with
 Adverse weather was the main cause of provide methods for managing continuity of
weaker supply chains, the number
disruption at 51%, with unplanned IT and key supply chains.
experiencing higher financial costs almost
telecommunication outages in second
doubled to 32%. Notwithstanding the level of risk mitigation
place at 41%. Sources of disruption can,
that can be achieved through these actions,
however, vary significantly by sector and  Only 8% of respondents could confirm that
responsibility for resilience cannot be
geography. all of their key suppliers had Business
outsourced, so organizations still need their
Continuity (BCM) programmes in place to
 Cyber attack rose to become a top three own BCM programmes to consider and deal
deal with disruption. Less than half of
source of disruption in the Financial with the consequences of supply chain failure.
businesses check that BCM programmes
Services sector.
Introduction
85% of responding organizations stated they experienced at least one supply chain incident that
caused disruption to their organization
This report is the third in a series that can be made, requiring Business Continuity
started in 2009 to consider the challenge of Management (BCM) programmes to be Number of supply chain incidents in the past
developing resilient supply chains. reviewed in light of likely supply chain 12 months that caused disruption to the
behaviour when faced with disruption. organization (Base: 377)
The drivers of vulnerability in supply chains
have been well documented1. Whether So, what do we mean by supply chain?
product or supply chain complexity, ICT Here's one definition that we like
dependency, lean/Just-In-Time methods, (Christopher 2005): 4% 3%
single sourcing, outsourcing or the broader 15%
“The network of organizations that are 6%
globalisation of sourcing and supply chains. involved, through upstream and down-
Supply chains are now multi-tiered and stream relationships, in the different
0
multi-layered; an interactive system, whose processes and activities that produce 16% 1-5
operational efficiency allows risks to value in the form of products and services
propagate fast and efficiently. 6-10
in the hands of the ultimate consumer”.
11-20
The survey in 2011 considers the sources of Levels of supply chain disruption remain 21-50
disruption along with their origin within the undiminished with 85% of survey 51+
supply chain system. The survey majors on respondents experiencing at least one
the methods used to understand the disruptive incident. Among those who
vulnerability and measures taken to ensure didn’t experience disruption, they 56%
supply chain continuity. commented that the disruption was very
By identifying key supply chains and modest or that the business continuity
evaluating their likely resilience, better measures that had in place meant that 1. “The Drivers of Supply Chain Vulnerability: An Integrated Framework”, Dr
informed decisions on supply chain strategy there was no substantive disruption. Helen Peck, International Journal of Physical Distribution and Logistics Manage-
ment, Vol. 35, No4, 2005. pp210-232 ISSN 0960 0035
Part 1: Sources and levels of disruption with
their short and longer term consequences
Major sources of disruption on supply chains
Only 15% of the overall sample could
firmly state they did not suffer from a 51%
disruptive supply chain incident. 85%

reported at least one incident, while 41%
almost a third reported more that six.

21%
Adverse weather is the source of most
disruption over the past 12 months, as
21%
it was in 2010, with 51%.
Unplanned IT or telecom outages 17% Adverse weather (windstorm/tornado, flooding,snow etc)
follow in second place at 41%. Unplanned outtage of IT or telecommunication systems
Transport network disruption rises to 16% Transport network disruption
third place in this year’s survey. Earthquake/tsunami
15%
The new entrant is earthquake/ Failure in service provision by an outsourcer
tsunami given the events in Japan in
13% Loss of talent/skills
March 2011 but also in New Zealand.
Product quality incident
At 21% this is a significant result given
11%
the wide representation of sectors and Volcanic ash cloud
countries involved in the survey and it Insolvency
10%
underlines the sensitivity of globalised
Civil unrest/conflict
supply chains to disruption.
9% Industrial dispute
With the continued difficult economic
Fire
environment disruption through 9%
supplier insolvency remains prominent Cyber attack(e.g. malware, DDOS attack)
Base: 340
in the list of causes disruption. 8%
‘Watch list’ sources of disruption
Looking at some of the movers from

8%
2010, the loss of talent and skills has
risen up the list.
7%
Human illness/influenza has fallen
from its high in the 2010 survey, 7%
which reflected the swine flu
epidemic. 6%
Sustainability issues such as

6%
environmental incidents and business
ethics incidents are still there.
5%
Intellectual property violation also Energy scarcity (loss of supply or rapid price increase)
records a relatively high level of 4% Human illness(e.g. influenza)
incidence and it is one to watch for Health & Safety incident
the future. 4%
New laws or regulations
We are always interested to see the Data breach(loss or theft of confidential information)
3%
extent to which disruption has Environmental incident
strategic reputational consequences Act of terrorism
3%
on organizations, and the levels of Product safety incident
adverse media coverage provide an 3% Adverse media coverage
indicator of this threat—especially as Business ethics incident (e.g. human rights,corruption)
the fault may well lie with the 1% Tighter credit insurance conditions
supplier, but it is the buying Intellectual Property violation
organization that suffers. 1% Animal disease
Base: 340
Leading sources of disruption vary by sector
Considering the following six
Financial Retail & IT & Transport &
industry sectors some Manufacturing Government
Services Wholesale Communications Storage
important distinctions
Adverse Adverse weather
Adverse weather Adverse weather
emerge: Unplanned weather Product quality (windstorm,
(windstorm, flooding, (windstorm,
1 outage of IT or (windstorm, incident
snow, etc)
flooding, snow,
flooding, snow,
Financial Services: It is not a telecom systems flooding, snow, etc)
etc)
surprise that this sector is etc)
most sensitive to unplanned Adverse weather

Transport Unplanned outage of Unplanned outage Unplanned
IT or telecommunication 2 (windstorm, Earthquake/
network IT or telecom of IT or telecom outage of IT or
flooding, snow, Tsunami
outages, given the high disruption systems systems telecom systems
etc)
reliance on technology and
Adverse weather
outsourcing. However Cyber attack Failure in service
(windstorm,
looking down the list, what 3 (malware, Fire
flooding, snow,
Earthquake/Tsunami Industrial dispute provision by an
DDOS) outsourcer
etc)
this clearly enables is a
vulnerability to cyber attack,
manufacturing respondents are dominated by weather (82%) than other sectors and 55%
whether through malware such as a virus or a
product quality incidents. 92% reported at reported industrial disputes causing
distributed denial of service attack. While the
least one disruptive incident. The earthquake disruption. The earthquake/tsunami was in a
cyber threat has been a “hot topic” through
and tsunami had a particular impact on this close fourth position (46%)
much of 2011, only in the financial services
sector with high levels of force majeure
sector does it reach a top three position with Government: Failure in service provision by
invocations (44%).
13%, almost double the survey average. an outsourcer reaches a top three position in
IT & Communications: This sector reported this sector. This likely reflects not only the
Retail/Wholesale sector: No surprises in
the lowest levels of disruption with 29% long standing trend to outsourcing and shared
terms of the disruptions that affect supply
stating their organization had not suffered any services in the public sector but also the
chains in this sector although the prominence
disruptions. impact of price pressures within these
of fires is not found in other sectors.
contracts and reduction in capacity to deal
Transport & Storage: Respondents in this
Manufacturing: Sources of disruption among with disruptions.
sector reported more heavily on adverse
And by geography...
The top three causes of
Continental Middle East & Australia &
disruption are given for each UK Asia USA
Europe Africa New Zealand
country or geographical Adverse Adverse
cluster in the adjacent table. weather Unplanned outage Adverse weather weather
Earthquake/ Unplanned outage of IT
1 (windstorm, of IT or telecom
tsunami or telecom systems
(windstorm, (windstorm,
Given the high proportion of flooding, systems flooding, snow, etc) flooding,
snow, etc) snow, etc)
UK based respondents in
the survey population, it is Unplanned Adverse weather Unplanned Unplanned
outage of IT (windstorm, outage of IT or Transport network Earthquake/ outage of IT
no surprise to see that the 2 or telecom flooding, snow, telecom disruption tsunami or telecom
top three in the UK is very systems etc) systems systems
close to the overall survey
Transport Unplanned outage
results. Loss of Product quality Earthquake/
3 network
talent/skills incident
Product quality incident of IT or telecom
tsunami
disruption systems
Respondents in Asia and the
Middle East and Africa are main causes of supply chain disruption in Asia Beyond the countries and regions listed, some
notable in that adverse weather does not but their effects registered prominently in the other countries had interesting variations
feature in their top three. And while USA as well. although it should be noted that the sample
unplanned outages of IT or telecom systems size is small.
The USA response is noticeable by the
are common to both regions, they are unique
strength of response to adverse weather at  Respondents in Canada had “industrial
in having product quality incidents featuring
76%, far higher than other regions while 36% disputes” as the second source of supply
so prominently. Social unrest in the Middle
were affected by the earthquake/tsunami. chain disruption behind IT.
East & North Africa did register in the survey
response for this cluster with 22% citing this Continental Europe was the only geography to  Respondents in the Central & Latin America
cause. In this region, 92% of respondents give prominence to “loss of talent/skills” as a cluster registered the failure of service
reported at least one disruptive incident. leading source of supply chain disruption provision by an outsourcer as the lead
although this featured in fourth place in the cause of disruption followed by product
The severity of the 2011 earthquakes and
Middle East cluster. quality incidents and transport.
Japanese tsunami made these events the
Disruption can originate deep in the supply chain
Tier 1 Supplier
New to 2011’s survey was a question
which asked respondents to detail
the level within the supply chain Earthquakes & Tsunami
where the disruption originated.
72 responding organizations cited that they were affected
265 respondents were able to
identify the tier in which the by an earthquake or tsunami in 2011, this covers the
disruption originated across 327 earthquake in New Zealand and the tsunami-earthquake in
incidents. 81 reported they do not Japan. Manufacturing sector respondents numbered the
analyse the full supply chain to largest affected group (17%), however, financial services
identify the original source of 61%
(14%) and professional services (14%) sector were not far
disruption, which could imply they
are missing the opportunity to learn behind. Affected organizations were headquartered in 18
from incidents and apply the lessons different countries including Australia, Barbados, Belgium,
to mitigate future disruption. Bulgaria, Bahrain, China, Germany, France, Japan, Mexico,
New Zealand, Philippines, Pakistan, Singapore, Switzerland,
The results of this analysis shows
Taiwan and the USA. 40% of these organizations reported a
that 61% of disruption originated
with tier one suppliers, with 30% at forceThe
majeure
source invocation by a supplier.
of the disruption
tier two and 9% at tier three or was with our immediate, Tier
1, supplier
lower.
“The earthquake in Japan caused many
The source of the disruption
The clear implication of these results
is that there are sufficient levels of 30% Tier 2 Supplier problems
was with ourinsupplier's
the primary supply chains, and
supplier, i.e. at Tier 2
disruption originating below the first
tier supply chain partner to justify
the downstream impacts to other supply
further analysis with key suppliers. The source
chains had of the disruption
a tremendous ripple effect.”
was much lower down the
supply chain i.e.Survey respondent.
Tier 3, Tier 4
9% etc
Tier 3+ Supplier
Short and longer term consequences of disruption
Loss of productivity remains in
pole position when it comes to the 49%
primary consequences of supply

38%
chain disruption. Increased cost
of working, loss of revenue and 32%
customer complaints follow close
behind. 32%
New entrants this year were

32%
“share price fall” and “expected
increase in regulatory scrutiny”, 19%
Loss of productivity
which scored at 2.5% and 11%
Increased cost of working
respectively. 18%
Loss of revenue
Damage to brand and reputation
17% Customer complaints received
recorded 17%. Respondents who Service outcome impaired
marked this consequence had 17% Stakeholder/shareholder concern
supply chains with much weaker Delayed cash flows
levels of BCM adoption than the 11%
Product release delay
average. They also reported Damage to brand reputation/image
5%
higher levels of force majeure Expected increase in regulatory scrutiny
invocations (30%). Product recall/withdrawal
4%
The overall message is that Fine by regulator for non-compliance
ignoring supply chain resilience 3% Share price fall
issues can cause longer term Payment of service credits
1%
consequences to reputation and
stakeholder action. What were the consequences of the disruptions experienced of the last 12 months. Base:323
The financial cost
17% of organizations stated that the cost of the most significant single disruption was more than €1million
Looking at the most significant incident of the 12 month period

covered by the survey, 83% of respondents stated that the financial 1%
cost was less than €1 million. However, for 14% the cost was 2%
between €1M and €10M, while for 2% the cost was between €51M
14%
and €100M and 1% reported costs in excess of €100M.
Those reporting reputational damage as a consequence of disruption
Less than €1M
also reported much higher levels of financial cost, with 32% reporting
costs greater than €1 million— almost double the survey average.
€1 Million to €10 Million
€11 Million to €50 Million
We lost over a billion in inventory and lost €51 Million to €100 Million
opportunity plus new model delays. Greater than €100 Million
Survey respondent.
83%
Primarily continued employment expenses relating

to persons not working due to office shutdown.
Survey respondent
Question: Considering the single most significant incident in the last 12 months, what was the approximate finan-
cial cost (loss of revenue, increased cost of working). Base 276
Balancing supply chain continuity risk with corporate cost saving initiatives
The widespread supply chain disruption in many
sectors arising from the tragic earthquake and Low cost options are always considered with business continuity in mind.
tsunami in Japan in March 2011 ignited the Survey respondent.
debate about the pursuit of “just in time” supply
chains.
The survey response supports the assertion that A shift to low cost suppliers (e.g.
Manufacturing
A shift to low cost suppliers (e.g. toto
lowChina)
manufacturing
A shift tohas
China)(e.g.
cost suppliers has manufacturing to China) has
decisions made within organizations can create increased our vulnerability to increased
supply chain
ourdisruption.
48
vulnerability to supply chain disruption.
80 48 41 80 29 41
increased our vulnerability to
vulnerabilities that are exposed by any number of supply chain disruption
events listed earlier in the report.
JIT/lean and outsourcing in particular are seen to Our approach to Just-In-Time /
increase vulnerability with 74% of respondents, Our approach to Just-In-Time / lean
Our
lean production
approach
production techniques/has
to Just-In-Time
techniques made
lean
has production techniques has made
69 10669 45 106 16 45
us more vulnerable to supply us chain
moredisruption
vulnerable to supply chain disruption
who hold an opinion, either strongly agreeing or made us more vulnerable to
somewhat agreeing with the proposition (see supply chain disruption.
adjacent chart).
However, comments by respondents did highlight Our supplier consolidation
Our supplier consolidation strategies haveconsolidation
increased ourstrategies
Our supplier
strategies have increasedvulnerability
our have increased
66
our vulnerability
129 66 75129 16 75
advantages of supplier consolidation such as to supply chain disruption to supply chain disruption
vulnerability to supply chain
fewer suppliers making engagement on BCM disruption.
more substantive and that outsourcing can
provide additional options for BCM strategies.
Our outsourcing strategies have
Our outsourcing strategies increased
have ourour
Ourincreased vulnerability
outsourcing vulnerability
strategies have toincreased
to supply our vulnerability to supply
So, in addition to being “lean” and “six sigma”, chain disruption chain disruption
82 14782 57 147 23 57
supply chain disruption.
“green” and “sustainable”, key supply chains also
need to be designed for resilience objectives, if
the cost gains are not to be lost through 0% 10% 20% 30% 0%
40% 10%
50% 20%
60% 30%
70% 40%
80% 50% 100%
90% 60% 70% 80% 90
disruptions. Strongly agree Base: 352 Strongly

Somewhat agree agreeSomewhat
Somewhat agree Strongly
disagree Somewhat disagree
disgree Strongly disgree
Part 2: Identifying and assuring key supply chains
Key supplier identification
We have identified all of our key suppliers (Base: 325)
52% 29% 11% 6% 2%
Strongly agree Somewhat agree Somewhat disagree Strongly disagree We do not identify key suppliers
This next section of the survey considers nominal attention is required. Key suppliers or good grasp of who their key suppliers are with
questions about key suppliers and how they supply chains can therefore be defined as 52% fully confident and a further 29% not far
are identified. The working assumption is that those that support or provide key resources, behind in confidence terms. Techniques used
not all suppliers and supply chains need the processes, activities or products and services to identify key suppliers and supply chains
same level of analysis and attention, i.e. as identified in BCM's Business Impact Analy- included BCM’s Business Impact Analysis,
where they are quickly and easily replaced sis or those identified in supply chain manage- which 28% of respondents favoured; while
and the consequences of non-availability of ment techniques as strategic or bottleneck 22% used supply chain evaluation techniques
their product or service can be managed with suppliers. such as identifying bottle neck and strategic
no impact on the buying organization, then suppliers. 36% used a combination of these
Respondents to the survey seem to have a
techniques.
How many key suppliers do you have? (Base: 315)
When asked in a follow up question
how many key suppliers their
1% 15% 18% 19% 20% 10% 8% 5% 4%
organization had, there was a very
wide range, however it is noteworthy
that very few have zero key suppliers
and the majority of organizations are
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% choosing in the 6-50 range (refer to
0 1 2-5 6-10 11-20 21-50 51-100 101-500 501-1000 Greater than 1,000 pp.27-28 for respondent profiles).
Criteria for identifying key supply chains
Going into more detail, the survey
sought to understand the criteria that Please indicate whether any of the following criteria are applied to identify key suppliers (Base: 326)
are used in supplier criticality Spend

assessment. 60%
Interdependencies with other Financial impact of non-supply over a
The chart opposite shows the relative suppliers 50% period of time
49%
prominence of criteria. “Reputational 40% 54%
impact” was the leading indicator with
30%
57% of respondents choosing this, Key people/knowledge involved 28% Reputational impact
57%
followed by “financial impact of non- 20%
supply over a period of time”. 41%

10%
Of the emerging criteria, perhaps the 0%
key ones not on many radars are Bespoke nature of product/service 37% 50%
Regulatory compliance impact
supplied
“interdependencies with other 21%
suppliers” (28%) and the “maturity of 43%

50%
the industry” (22%). 35%
Additional comments received included Location of suppliers Availability of other suppliers

mention of “single points of failure”,
“Corporate Social Responsibility” and
Speed that can change to alternative
Maturity of the industry
“data security”. supplier
Primarily by spend and criticality, but not in a Never considered but interesting: Speed
structured auditable manner or using BCM that can change to an alternative supplier.
techniques. Survey respondent. Survey respondent.
How many key suppliers have BCM in place for their own needs?
Having identified key suppliers and supply More detailed sector research is required, but The responses to these questions show that
chains, the survey asked how many of these it might be fair to conclude that key suppliers you shouldn’t make assumptions that
suppliers already had business continuity in the financial services sector will often be suppliers have BCM and that there is still a
management (BCM) programmes in place. larger IT services companies, which are likely long way to go before we have widespread
to be required to have BCM programmes in resilient supply chains.
84% of respondents were able to feed in their
place, whereas other sectors may have more
analysis to this question, while 16% confessed The good news is that the required analysis
smaller and medium sized organizations
to not knowing, primarily due to not having has been completed in many organizations, so
among their key suppliers, which are less
started down this road yet. their own BCM strategies can be reviewed in
likely to have BCM in place, according to BCI the context of the underlying fragility, or
Only 7% could confidently state that all of and third party research into BCM adoption. otherwise, of their supply chain.
their key suppliers have business continuity
All of them!
arrangements in place.
48% of respondents stated that 76% to 99% 8%
Considering your key suppliers, what
less than half of their key percentage of them would you say have
suppliers had BCM with 52% business continuity programmes in place
to address their own needs? Base: 280. 50% to 75%% 21%
stating that more than 50% had Excludes “Don’t knows” (+55).
BCM in place.
26% to 50% 24%
When comparing sectors, some
significant variations emerge. In
financial services, many more 15%
11% to 25%
firms have key suppliers with
BCM in place, while for 19%
Less than 10%
manufacturing, transport and
storage and energy the figures
14%
are much lower.
Assessing and validating BCM in the supply chain
The next part of the survey considered the  Checking that the BCM programme is Moving on to discuss approaches taken to
approaches being used to understand BCM relevant to the product/service understand how effective a key supplier’s
capability among key supply chains. Detailed purchased nudged up from 28% to 31% BCM is likely to be, and how to get a better
charts follow on the next four pages. understanding of their likely behaviour in an
In terms of “questions to ask” and information Our Supplier BCM evaluation incident, it is very disappointing to see that
49% still do not take this essential step in
that should be retrieved to help build a process is progressive, and depends
some form.
picture of capability, some eleven different
upon our dependency upon
techniques were identified in the survey. The As BCM programmes are reviewed in-house,
most popular approach was to request copies them...We check that we are far so there needs to be a process for engaging
of supplier documentation (48%), followed enough up their "Key Customer" list with key suppliers around changes at either
closely by sending a supplier a self-assessment end. While 18% “never review” and 37% wait
to be sure that we do figure as one
questionnaire (44%). until contract renewal, many are more
to whom service must be structured and proactive by linking reviews to
The weaknesses of pursuing these approaches
in isolation have been well documented in maintained rather than one to be changes, and scheduling regular sessions.
terms of the ability to secure access to what abandoned until their recovery has Finally, in this section, we asked about
might be seen as confidential information approaches to key suppliers who either do
been completed.
(e.g. Business Impact Analysis) or interpreting not, cannot or will not meet the purchasing
information received through self-assessment Survey respondent. organization’s BCM requirements. Where
questionnaire in a meaningful way. possible the most favoured approach is to
However, it is still rare that the buying work with the supplier to improve their
Compared with the survey in 2010 some organization will check the credentials of capability. However, 39% are prepared to
techniques have gained in prominence: those who are actually running the BCM accept the situation, i.e. an increased level of
 Auditing suppliers has increased from programme, e.g. professional certification, risk, while 26% would change their strategy.
28% to 37% with independent audits up with just 9% doing this. This is a clear 12% would look at financial risk transfer
to 12% from under 4% in 2010. omission in assessing BCM capability.
through insurance.
Assessing a supply chain partner’s BCM arrangements
48%
44%
37%
31%
29% We ask for copies of supplier documentation
We provide them with a self-assessment questionnaire

28%
We audit them
27% We check whether their programme is relevant to the product or service we

are buying
We check whether the scope of their BCM programme is appropriate
26%
We check that they have a BCM programme not just a business continuity
plan
23% We ask for compliance with recognised good practice (e.g. BCI's Good
Practice Guidelines, BS25999-1)
We look for certification to a recognised standard (e.g. BS25999-2)
16%
We check where responsibility for BCM is held in the organization (and
involvement of senior management)
12% We don't ask for any information
We request an independent audit

9%
We ask for the credentials of those who run the BCM programme e.g. are
Base: 330. Numbers greater than 100% due to multiple responses allowed. they certified?
Validating that a supplier’s BCM is likely to be effective
49%
34%
17%
We have not checked/validated their plans
16%
We have asked to see documented outcome reports and action plans
following recent exercises
We have run joint exercises based around likely scenarios
14%
We have run a desk-top exercise
We have held workshops

11%
We have observed exercises conducted by suppliers
8% We approve pre-test scope and sign-off all post-test reports
Base: 322 Numbers greater than 100% due to multiple responses allowed.
How often are supplier BCM requirements and capability reviewed?
Whenever there's a major change event at their end
Never
Whenever there's a major change event at our end

37%
Whenever a new, significant external risk/threat is identified
Ad hoc/when we get the opportunity 31%
We have scheduled review meetings with key suppliers at appropriate time intervals as part of existing
governance processes
At contract renewal 24%
21%
18% 18%
13%
Base: 326. Numbers greater than 100% due to multiple responses allowed.
What if your key suppliers do not, cannot or will not meet your requirements?
Agreed an appropriate BCM improvement plan with the supplier. Accepted the situation (i.e. increased risk).
Brought an additional supplier on-board. Changed supplier.
Changed approach/strategy (e.g. insource a key process) Transfer all or part of the risk to insurers.
45%
39%
31% 31%
26%
12%
Base: 319. Numbers greater than 100% due to multiple responses allowed.
Part 3: Winning business with BCM
BCM is becoming a factor in winning business
Does BCM feature as part of your supplier contractual discussions? Base: 328
47% 30% 24%
Yes, an integral part of the procurement process from the start Yes, but after the decisions have essentially been taken No
Here we consider both sides of the coin, we asked respondents whether

BCM is part of the contractual discussions with suppliers, and equally,
where respondents are on the selling side, the extent to which they need
to provide assurance of their own BCM programmes. 13%
18%
On the buying side, BCM does not feature as part of the supplier
contractual discussions for 24% , while it is an integral part of the
procurement process from the start for 47%. Every tender/proposal
6% 15%
On the selling side, 28% of respondents are seeing this as a frequent if not Majority
constant requirement in tenders, and many respondents felt that this was Sometimes
an upward trend, particularly when tendering for business in sectors where Rarely
BCM is a regulatory requirement. Not at all

10%
Don't know
Among those saying “no” are retailers and local authorities, the emergency
Not applicable
services and regulated monopoly service providers, who either do not seek
to win business or whose customers don’t have the buyer power to ask for
evidence of BCM programmes (consumers). 24%
14%
BC information is becoming a standard inclusion in

most of our legal business pitches. Survey respondent.
When tendering for new business clients over the past 12 months, how often have you had to
Supply Chain Resilience 2011. Copyright © 2011 The Business Continuity Institute. Al Rights Reserved. provide assurance to clients that your BCM arrangements are sufficient? Base: 331. 24
Contract ‘force majeure’ invocations are more common than you might think
24% of respondents stated their suppliers invoked force majeure in the past 12 months
As in 2009 and 2010, the survey looked at purchasing organizations are able to place  There were no reasonable steps that could
levels of force majeure invocations and greater onus on the supplier to mitigate the have been taken to avoid or mitigate the
whether BCM was being used to achieve impact of such sources of disruption. There event or its consequences.
greater specificity in terms of events that are four key dimensions to a valid force The results from the survey show that 40%
could allow invocation of force majeure majeure invocation2: use BCM to some extent to negotiate greater
clauses in supply contracts. specificity in force majeure clauses.
 One of the events referenced in the force
Force majeure events are often described as majeure clause has occurred; This is clearly an area where BCM
“Acts of God”, implying that they are beyond  The force majeure event was beyond the practitioners, contract managers and legal can
the control of the affected party, and they control of either party, it was “unexpected” work more closely together for the benefit of
therefore relieve them from performing their and “beyond reasonable foresight and their organization: Being the organization with
responsibilities under the contract. This is skill”; the more specific terms of invocation may
important in the BCM context as the type of  The event prevented, hindered, or delayed mean you enjoy higher priority in the affected
events generally envisaged in such clauses are the party seeking to rely upon the clause party’s recovery strategy.
precisely those that BCM is traditionally from performing its contractual obligations; Note 2: Supreme Court of Canada in Atlantic Paper Stock Ltd v. Anne-
associated with—high impact, low probability and... Nackawic Pulp & Paper Company Limited (Atlantic Paper). Cited in
Blakes article 21.4.2009
ones. Hence with the application of BCM,
Is business continuity used as a means to negotiate greater specificity in “force majeure contract clauses*? (Base: 324)
3% 37% 60%
Yes Yes, to some extent No

* Specifically include or exclude event types or establish recovery times for suppliers
Conclusions & Recommendations
Conclusions to be wiped out through disruption or
Recommendations
unacceptable risk exposure, especially in the
As in previous years, there are many sources context of the longer term reputational  Resilience considerations need to be brought
of disruption to supply chains, and while the damage more prominently into the equation when
probability of being affected by any specific considering operational efficiency in supply
one naturally varies by business, sector and The survey reveals that disruption originates
chain decision making.
geography, the probability of your supply below the immediate, tier one supplier, this
provides a stark warning that if your  For the BCM practitioner, it is worth
chain being affected by at least one of them is
immediate supplier has not got a handle on leveraging the discipline and vigour of supply
high—at least according to the sample of
their suppliers, then you might suffer from a chain management when it comes to engag-
organizations that responded to this survey -
disruptive incident. ing suppliers, especially to establish review
with 85% reporting at least one disruptive
meetings and audit processes.
event in the preceding 12 months. Fortunately, supply chain and business
continuity management techniques are being  At a practical level, it is important to analyse
A disruption in the supply chain can be as
brought together to better under the risk and supply chain incidents and learn from them,
equally devastating on your own firm’s brand
provide methods for managing continuity of updating planning assumptions as a result.
and reputation as the organization facing the
key supply chains. Be particularly alert to disruption below the
actual incident.
immediate supplier.
Effectively managing supply chain continuity is For the first time the survey sought to
understand the extent to which BCM is  However good the risk mitigation approach
critical not just because of the immediate
becoming a factor in winning business. The achieved through applying BCM in the
costs of disruption but as a result of the
response is encouraging with 28% already supply chain, organizations cannot
longer term consequences to stakeholder
seeing a demand for BCM information in the “outsource” their responsibility for resilience
confidence and reputation that arise.
tender process. and BCM programmes need to assume that
While just-in-time and outsourcing are here to disruption will happen and be prepared to
stay in some form, this survey shows it is deal with the consequences to ensure
more critical than ever to strike a sensible continuity of supply.
balance between the need to drive down
costs and the need for these cost savings not
Respondent profile
Geographical location of the respondent Primary activity of the responding organization (Standard Industrial
uk – United Kingdomus – United States
Classification 2007) Financial Services
au – Australia in – India
Government (e.g. lo
1%
2% 1% 2% 1% 2%
2% services)
2% 2% 3%
14% 3%
ca – Canada 3% Africa
za – South
Professional Servic
3% 3%
14% 3%
4% 4% IT & Communcation
1% 1% 4% 28% 28%
1% cn – China nz – New Zealand 28%
1% 1% 4% 4% Manufacturing
4%
1%
1% sg – Singapore ch – Switzerland Health & Social Car
1% 5%
1% 42% 5%
1% 42% 5%
1% Energy
2% nl – Netherlands de – Germany
2% 1%2% Transport & Storag
2% 2% 9% 9%
2% 2% it – Italy 9% ng – Nigeria Education
2% 2%
2% 2% 16% Retail/Wholesale
pk – Pakistan ae – United16%
Arab Emirates
2% 10% 10%
4% 16% Engineering/Constr
4% 10%
be – Belgium ie – Ireland 13%
7% 13% Agriculture, Forestr
7% 12%
12% 13%
jp – Japan ke – Kenya Support Services
Base: 328 Media & Entertainm

Base: 559
Other
Financial Financial Services Government (e.g. local/municipal, Government (e.g. local/municipal,

uk – United Kingdom us – United States au – Services
Australia central, emergency services)
in – India ca – Canada Professional Services
za – South Africa Professional Services IT & Communcations IT & Communcations
cn – China nz – New Zealand Manufacturing
sg – Singapore Manufacturing Health & Social Care Health & Social Care
ch – Switzerland nl – Netherlands de – Germany
Energy Energy Transport & Storage Transport & Storage
it – Italy ng – Nigeria pk – Pakistan
Education Education Retail/Wholesale Retail/Wholesale
ae – United Arab Emirates be – Belgium ie – Ireland
Engineering/Construction Engineering/Construction Agriculture, Forestry & Fishing Agriculture, Forestry & Fishing
jp – Japan ke – Kenya Other
Support Services Support Services Media & Entertainment Media & Entertainment
Respondent profile
Size of organization by number of employees Size of organization by revenues or budget (public sector)
5% 0% 3%
3% 13% 7% 14%
15% 0 13%
8%
1-50 Less than €1 Million per annum
51-250 €1 Million- €10 Million
15%
251-500 €11 Million - €100 Million
501-1,000 6% €101 Million - €500M Million
1,001-5,000 €501 Million - €1 Billion
5,001-10,000 10% €1 Billion - €10 Billion
10% 10,001-50,000 €11 Billion - €50 Billion
50,001-100,000 Greater than €50 Billion
11%
Greater than 100,000
21%
17%
29%
Base: 322 Base: 259
Respondent profile
Profile of respondents by job function:

Supply Chain Practitioners
1%
1% 6% Business Continuity Management (incl. incident/crisis
1%  94% experienced at least one
management) disruptive event.
1% Supply chain/Procurement/Purchasing
2%  Product quality, adverse weather and failure of service provision
Risk Management
3% 1% 1% by outsourcers are given as the leading causes of disruption.
1% 1%6% 6%
1% 1% Consultant
1% 1%  Customer complaints, loss of productivity, increased cost of
7%
2% 2% working
IT Disaster Recovery and loss
/ IT Service of revenue are given as the leading impacts or
Continuity
3% 3%
consequences of disruption.
46% Emergency Planning
7% 7%
 Spend, availability of other suppliers, and financial impact of
9% Quality / Business Improvement
46% 46%
non-supply comprise the top three criteria to identify key
9% 9% suppliers.
Internal/External audit
Security  Will typically

(physical/virtual)look to bring an additional supplier on board,
10% when faced with intransigence (47%).
Health & Safety management
10% 10%
 Significance preference for auditing key suppliers (63%) and
Line of Business /Service Directorate
13% 13% 13%
seeking certification (39%) compared with the survey average.
Other
 Much more likely to hold workshops with key suppliers (21%).
Base: 552  Much more likely to have scheduled review meetings(44%).

Business Continuity
Business Management
Continuity (incl.(incl.
Management incident/crisis management)
incident/crisis management) Supply chain/Procurement/Purchasing
Supply chain/Procurement/Purchasing  68% state that BCM does feature as part of supplier contractual
Risk Risk
Management
Management Consultant
Consultant discussions.
IT Disaster
IT Disaster Recovery
Recovery / IT Service
/ IT Service Continuity
Continuity Emergency
Emergency Planning
Planning
Quality
Quality / Business
/ Business Improvement
Improvement Internal/External
Internal/External auditaudit  48% have experienced a force majeure event in past 12 months.
Security
Security (physical/virtual)
(physical/virtual) Health
Health & Safety
& Safety management
management
Line Line of Business
of Business /Service
/Service Directorate
Directorate Other
Other
Survey response, methodology and acknowledgements
The online survey response in 2011 was 80% higher than in 2010 with 559 organizations responding. This reflects much
higher numbers of supply chain professionals responding along with much increased participation from the USA and the
almost doubling of countries participating overall. All members of the Business Continuity Institute received an individual
email invitation to complete the survey. This was complimented by the Chartered Institute of Purchasing & Supply inviting its
members to contribute through their existing communication methods. In addition, support is acknowledged from DRJ and
Buyers Meeting Point for bringing the survey to the attention of their subscribers and members respectively. The survey was
conducted between June 30th and September 5th 2011. Respondents came from 62 countries and were active across 14
industry sectors (SIC 2007).
We would like to thank Zurich for sponsoring this research for third successive year and DHL Supply Chain for joining them.
We would also like to thank the BCI Partnership Working Party on Supply Chain Continuity, and the BCI Partnership Steering
Group for their support in the development of the survey.
Author: Lee Glendon CBCI, Head of Campaigns, The Business Continuity Institute
Chief Reviewer: Lyndon Bird FBCI, Technical Director, The Business Continuity Institute
About
The Business Continuity Institute Business Continuity Management

Based in Caversham, United Kingdom, the Business Continuity Institute (BCI) was Business Continuity Management (BCM) identifies
established in 1994 to promote the art and science of business continuity potential threats to an organization and the impacts
management and to assist organizations in preparing for and surviving minor and to business operations that those threats, if realized,
large-scale man-made and natural disasters. The Institute enables members to might cause. It provides a framework for building
obtain guidance and support from their fellow practitioners, as well as offers organizational resilience with the capability for an
professional training and certification programmes to disseminate and validate effective response that safeguards the interests of key
the highest standards of competence and ethics. It has over 6,000 members in stakeholders, reputation, brand and value-creating
more than 100 countries, active in an estimated 2,500 organizations in private, activities.
public and third sectors. For more information go to: www.thebci.org
The BCI Partnership, established in 2007, offers corporate membership of the BCI Contacting the BCI
with 80 member organizations including Aon, BAE Systems, BP, BSI Group, BT,
ContinuitySA, Continuity Shop, Deloitte, DHL Supply Chain, DNV, Cassidian, Lee Glendon CBCI, Head of Campaigns
The Business Continuity Institute
Garrison Continuity, IBM, HP, Link Associates, Lloyds Banking Group, Lockheed
10-11 Southview Park, Marsack Street
Martin, Marsh, Milton Keynes Council, Prudential, PwC, Royal Mail, Savant, Statoil,
Caversham, RG4 5AF, UK.
Steelhenge Consulting, VocaLink and Zurich. To join as a corporate member, Phone: +44 (0) 118 947 8215
go to: www.bcipartnership.com E-mail: lee.glendon@thebci.org
About
The Chartered Institute of Purchasing & Supply

The Chartered Institute of Purchasing & Supply (CIPS) is the leading international body representing
purchasing and supply management professionals. It is the worldwide centre of excellence on
purchasing and supply management issues. CIPS has over 65,000 members in 150 different countries,
including senior business people, high-ranking civil servants and leading academics. The activities of
purchasing and supply chain professionals have a major impact on the profitability and efficiency of all
types of organisation and CIPS offers corporate solutions packages to improve business
profitability. www.cips.org
 Strategic partners include the United Nations and the UK Government
 Support donor-funded capacity and capability training all over the developing world and beyond to
build effective, sustainable supply chains
 Offices in South Africa, Australia, the Middle East, the UK
 20% increase in membership in 2010
 Supports over 47,000 studying members across the globe
 Over 6,000 members a year attend our events including our annual conference
 1.2 million unique visitors to the CIPS website each year
About
Zurich
Zurich Financial Services Group (Zurich) is a leading multi-line insurance provider with a global network
of subsidiaries and offices in Europe, North America, Latin America, Asia-Pacific and the Middle East as
well as other markets. It offers a wide range of general insurance and life insurance products and
services for individuals, small businesses, mid-sized and large companies as well as multinational
corporations. Zurich employs about 60,000 people serving customers in more than 170 countries.
Founded in 1872, the Group is headquartered in Zurich, Switzerland. Zurich Financial Services Ltd
(ZURN) is listed on the SIX Swiss Exchange and has a level I American Depositary Receipt program
(ZFSVY) which is traded over-the-counter on OTCQX. Further information about Zurich is available at
www.zurich.com.
Zurich is a thought leader in supply chain risk management. It has developed supply chain risk
assessment tools and an innovative and award winning insurance product. The company has extensive
experience of working with clients to help them make their supply chains more resilient.
Zurich Contact Details

Nick Wildgoose: Global Supply Chain Product Manager
Phone +44 (0) 7764282065
Email nick.wildgoose@uk.zurich.com
About
DHL
DHL is the global market leader in the logistics industry and “The Logistics Company for the world”. DHL
commits its expertise in international express, air and ocean freight, road and rail transportation,
contract logistics and international mail services to its customers.
A global network composed of more than 220 countries and territories and about 275,000 employees’
worldwide offers customers superior service quality and local knowledge to satisfy their supply chain
requirements. DHL accepts its social responsibility by supporting climate protection, disaster
management and education.
DHL Supply Chain Service Capability

DHL Supply Chain provides solutions for all industry sectors including retail and fashion. By understand-
ing your business needs, DHL delivers cost effective supply chain solutions that improve efficiency.
From consulting and design, sourcing and transportation through to warehousing, order assembly,
distribution and returns, we manage the full supply chain operation.
DHL is part of Deutsche Post DHL. The Group generated revenue of more than 51 billion Euros in 2010.
DHL Supply Chain Contact Details

Ruth Robottom: Supply Chain Development Manager
Phone +44 (0) 7880 980436
Email ruth.robottom@dhl.com

BCI Supply Chain Resilience 2011 Public Version

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BCI Supply Chain Resilience 2011 Public Version

Uploaded by

Copyright:

Available Formats

Supported by: Sponsored by:

Supply Chain Resilience 2011

3rd Annual Survey

14 Part 2: Identifying and assuring key supply chains

23 Part 3: Winning business with Business Continuity Management

26 Conclusions & recommendations

disruptive supply chain incident. 85%

almost a third reported more that six.

Looking at some of the movers from

Sustainability issues such as

most sensitive to unplanned Adverse weather

primary consequences of supply

New entrants this year were

Looking at the most significant incident of the 12 month period

€11 Million to €50 Million

opportunity plus new model delays. Greater than €100 Million

Primarily continued employment expenses relating

disruptions. Strongly agree Base: 352 Strongly

52% 29% 11% 6% 2%

are used in supplier criticality Spend

supply over a period of time”. 41%

Of the emerging criteria, perhaps the 0%

suppliers” (28%) and the “maturity of 43%

Additional comments received included Location of suppliers Availability of other suppliers

29% We ask for copies of supplier documentation

We provide them with a self-assessment questionnaire

27% We check whether their programme is relevant to the product or service we

We request an independent audit

We have not checked/validated their plans

We have held workshops

We have observed exercises conducted by suppliers

8% We approve pre-test scope and sign-off all post-test reports

Whenever there's a major change event at their end

Whenever there's a major change event at our end

Ad hoc/when we get the opportunity 31%

47% 30% 24%

Here we consider both sides of the coin, we asked respondents whether

BCM is a regulatory requirement. Not at all

BC information is becoming a standard inclusion in

Yes Yes, to some extent No

Base: 328 Media & Entertainm

Financial Financial Services Government (e.g. local/municipal, Government (e.g. local/municipal,

Base: 322 Base: 259

Profile of respondents by job function:

Security  Will typically

Base: 552  Much more likely to have scheduled review meetings(44%).

The Business Continuity Institute Business Continuity Management

The Chartered Institute of Purchasing & Supply

Zurich Contact Details

DHL Supply Chain Service Capability

DHL Supply Chain Contact Details

You might also like