AD2 - Managing Risks in Supply Chains Flashcards
What is a risk?
Uncertainty around events and there outcomes which may effect, enhance or inhibit:
- Operational performance
- Achievement or aims or objectives
- Meeting stakeholders expectations
What elements are involved in risk management?
- Hazards
- Uncertainty
- Exposure
- Risk assessment
- Risk mitigation
Define “hazard”
A source of potential harm or damage
Define “uncertainty”
A situation in which an event might happen but there is limited information about the probability of the event occurring
Define “exposure”
The impact on the business of a risk occuring
Define “risk assessment”
The overall process of hazard identification, risk estimation and risk evaluation
Define “risk mitigation”
All actions which can prevent the risk from occurring or reducing the impact, costs or likelihood of such risk. (usually targeted around reducing the impact)
An organisation or persons desire to take risks in order to achieve benefits is often called their risk appetite. What different levels of risk appetite are there?
- Risk Averse - are uncomfortable with uncertainty and seek security and resolutions where faced with risks.
- Risk Tolerant - are comfortable with most uncertainty.
- Risk Seeking - are not afraid to take action and have a casual approach towards threats.
If a risk occurs, what two types of loss can it cause?
Direct Loss - the cost of putting right or sourcing elsewhere
Consequential Loss - the finished products failed as a result of a quality defect causing loss of revenue, warrants claims or damaged reputation.
What different types of loss are there (created by hazards)?
- Financial
- Distributional (loss of customers)
- Environmental
- Reputational
- Safety
What causes of internal risks are there?
- Health & Safety (Unsafe working practices)
- Management Control (Unsuitable supervision)
- Human Resources (Poor recruitment processes)
- Procurement (Low quality supplier selected)
- Project Management (Failure to meet milestones)
- Individual (Fraud / theft)
How can you prioritise risk?
Score each risk using:
Risk Score = Impact * Likelihood
What should you do with high priority risks?
Risk Manager - Assign an owner who is best placed to mitigate the risks
Risk Plan - Create a plan for managing the risk
What categories of risk likelihood can be used to prioritise risks?
1 - Very Unlikely
2 - Improbably
3 - Quite probable
4 - Very probable
What categories of risk impact can be used to prioritise risks?
1 - Insignificant
2 - Minor
3 - Serious
4 - Catastrophic
What should be in a risk plan?
- Risk Minimisation: Anything that can be done to reduce the probability (and what it might cost)
- Risk Mitigation: Anything which can be done to reduce the impact (and what it might cost)
- Risk Prioritisation: How important is it and what benefits will it bring?
- Risk Avoidance: Are there any alternatives and how great is the risk associated with alternatives?
What is a risk register used for?
- Documenting the results of the risk assessment process (identification and mitigation strategy). It captures all assessments and decisions of risks which have been identified.
- Sharing information with stakeholders.
- Seeking and acting on feedback
- Systematically recording risk information in one place
- Provides a resource for risk monitoring, management and review
What headings might be in a risk register table?
Risk title Risk probability Risk Impact Risk score Risk Owner Summary of mitigation actions
What is a RMAP and what is it used for?
A risk management action plan which is used for providing details beyond what can fit into the risk register.
How should an organisation handle risk?
- Create a risk policy identifying ways to reduce risks to levels in line with the organisations risk appetite
- Assign clear responsibility and authority to certain staff to manage risks
- Set up governance rules in the area
Risk management is a continuous process known as the risk cycle. What steps are in the risk cycle?
- Identify risk
- Assess and prioritise
- Plan actions
- Take actions
- Monitor, report and adjust
What 4 methods are there for addressing risk?
- Transfer (dual-sourcing, insurance)
- Terminate (end project)
- Tolerate (not allocating resources to)
- Treat (reduce impact and/or likelihood)
What steps are involved in risk mitigation?
- Identifying the resources required
- Allocate responsibilities for managing the risk
- Develop action plans
- Obtain management / stakeholder approval for the plan
- Implementing the plan
- Monitoring the risk
What is the British standard around risk management? What does it recommend?
ISO 31000: 2009 - Organisations should have a framework that integrates risk management into the organisations overall governance, strategy and planning, management, reporting processes, policies, values and culture.
What steps are in the ISO31000 risk process and what do they entail?
- Establish the context (Objectives, stakeholders, criteria, define key elements)
- Identify the risks (What can happen? How can it happen?)
- Analyse the risks (Review controls, likelihoods, impacts, level of risks)
- Evaluate risks (Evaluate risks, rank risks)
- Treat the risks (Identify options, Select the best responses, develop risk treatment plans)
What key principles are listed as essential qualities for risk management to be effective in ISO 31000?
Risk Management:
- Creates value
- Is an integral part of organisational processes
- Is part of decision-making: helping managers make better decisions
- Explicitly addresses uncertainty
- Is systematic, structured and timely
- Is based on the best available information
- Is tailored to each unique organisation
- Takes human and cultural factors into account
- Is transparent and inclusive
- Is dynamic, iterative and responsive to change
- Facilitates continual improvement
What elements are in the framework that ISO 31000 puts around the risk process?
- Mandate and commitment
- Design of framework to manage risk
- Implementing risk management
- Monitoring and review
- Continual improvement
What is meant by “Mandate and commitment” from the ISO 31000 risk framework?
The risk management process must be mandated from the board and management
What is meant by “Design of framework to manage risk” from the ISO 31000 risk framework?
Implementation needs a framework which formulates a risk management policy, embeds processes into practice, assigns resource, determines responsibilities and planning for periodic communication and reporting to stakeholders
What is meant by “implementing risk management” from the ISO 31000 risk framework?
This involves communicating and training to ensure the risk management process is understood by risk owners; risk assessments to ensure that risk management activities actually take place; and ensuring that decisions and business processes factor in risk thinking.
What is meant by “monitoring and review” from the ISO 31000 risk framework?
This is checking the planned risk management elements are working in line with expectations. If not, identifying and dealing with shortfalls.
What is meant by “continual improvement” from the ISO 31000 risk framework?
Continual fine tuning and improving the process over time.
What should be considered when deciding how to deploy resource on risk management?
- What are the estimated costs of developing and maintaining risk management?
- What are the quantifiable and qualitative benefits of risk management, along with the estimated costs of not implementing risk management systems.
- Management time - how much management time is available?
- Risk management skills - the skills available, potential and existing risk managers?
- Monitoring and control information - the availability of existing monitoring and control information.
What resources are required to deliver effective risk management?
- Human resources - people, management, audit teams
- Technology resources - automatic alarms, automation of dangerous tasks
- Physical resources - safe plant, machinery, vehicles, safety equipment
- Good information
Contracts sometimes fail due to a party failing to meet the expectations of another party when placing the contract. What methods are there for establishing a legally binding contract?
- In Writing
- Orally
- Through Behaviour
What two reasons are there for contractual problems arising?
Contract related (did we agree, what terms were agreed etc)
Performance related (quality issues or late delivery)
A major occurrence of risk is financial risk. How can these be categorised and what examples can be given?
Internal: poor cost control leading to excessive costs, weak financial controls leading to fraud, high prices being paid due to poor research, poor returns on capital investments
External: macro-economic factors such as recession leading to low demand, fluctuating exchange rates, fluctuating commodity prices, supplier cash flow issues, supplier insolvency
One test for financial strength is the Springate model. What is this model?
Four financial ratios:
A: Working capital / Total assets, Working capital is current assets - current liabilities
B: Net profit before interest and tax / Total assets
C: Net profit before tax / Current liabilities
D: Sales / Total assets
These 4 ratios can be used to create an Indicator of financial strength: Z
Z = 1.03A + 3.07B + 0.66C + 0.4D
The higher the financial score the better. Anything below 0.862 is classed as failed and you are advised not to do business with them as financial risk is too high.
Quality failures can result in both reputational damage to your organisation as well as direct financial costs. How can they be categorised?
External failure: poor quality delivery items supplied by your suppliers
Internal failure: problems created within your own organisation
How can you prevent external quality failures?
Work with supplier to improve design (designing quality in)
Working better with suppliers to help them develop better production processes (better quality management)
Ensuring suppliers check every component supplied and reject any non-conforming items.
How can you prevent internal quality failures?
- Putting in place 100% inspection
- Testing in-bound products on a sampling basis
- Re-designing products and processes to make it easier to produce quality
- Developing organisational culture by using - - TQM (Total Quality Management). The organisation wide quality improvement.
What legislation is there around product safety relating to product liability and what is contained within it?
In Europe, the revised directive on general product safety which standardises product liability throughout the EU.
- The directive applies only to consumer products and obliges producers only to sell safe products.
- When the manufacturer is based out of the EU, this obligation applies to the EU representative or the importer.
- Producers must also inform consumers of the risks associated with products they supply.
- Producers must take measures to be informed of the risks posed by products they supply and take appropriate action to prevent the risks.
- They must be able to trace products identified as dangerous.
- Obligations apply to manufacturers and any professional in the supply chain who affects the safety characteristics of a product
Supply Risks are risks arising from suppliers who are unable to supply or supplying goods of inadequate quality. What different ways might supply risks arise?
- Poor Procurement Practices (Allowing weak suppliers to be selected)
- Poor Contract Management (Allowing suppliers to become complacent)
- Disruption to Deliveries (Weather, congestion, political instability, industrial action)
- Unforeseen Increases in Demand (Which suppliers then can’t meet)
- Disasters (Flood, fire, explosion affecting production)
If as part of your contract management you notice a drop in performance or service and this may be because of financial health, you need to develop a contingency plan. What options are there?
- Re-design (So you no longer need to use the supplier)
- Dual-sourcing (Can you quickly transfer some business to another supplier?)
- Alternative sourcing (Can you change supplier at a later date?)
- Acquisition (Can you take on the failing suppliers responsibilities)
Another risk is the risk associated with technology such as losing or stolen hardware. What can be done to prevent theft or loss of hardware?
- Physical locking (Padlock pc’s to desks)
- Security labelling (Non-removable labels making it less saleable)
- Displays warning (notes on the hardware such as “the operating system is encrypted”, “this system contains traceable radio bleeps”, “this computer is registered on a national database”)
How can you prevent cyber crime such as hacking of data stored on technology?
- Always use a firewall
- Use anti-virus software
- Restrict access using different passwords for confidential information
- Keep some computers off the network
- Use a standalone PC for confidential information
- Limit the number of attempts at a password
In the contexts of technology risks, what ISO should organisations consider? What is contained in the ISO?
ISO 27001 which specifies the requirements for establishing, operating and improving a documented information security management system. The ISO is designed for:
- Ensure security risks are cost-effectively managed
- As a process framework to ensure security objectives can be met
- To enable managers to determine the status of information security
- To provide information about Information security
What does outsourcing mean?
Transferring to a third party, under contract, the responsibility for activities which used to be performed internally.
What does offshoring mean?
Outsourcing business processes to a lower cost location, in a different country. Additional risk management must be considered when offshoring.
Outsourcing carries risk. There is a chance that you may be tied into a supplier who starts escalating costs or doesn’t understand your business. What things should be considered before outsourcing?
- What makes the external provider more responsive to needs that an internal department?
- Is the market changing and will the best providers be different?
- Are we doing this to save money? will it definitely be cheaper?
- Can expertise be gained by external providers?
What additional risks are associated with off-shoring?
- Transport and logistics (Further locations to deliver from)
- Reputational and compliance (Arise from cultural, legal or linguistic differences e.g. lower H&S standards)
- Exploitation (Workers may be exposed to exploitation and this will affect reputation)
- Misunderstandings (Language, cultural and time zone difficulties increase the chance)
Define fraud.
An act of deliberate deception, with the intention of gaining benefit
What are the two main types of corporate fraud?
Diversion of assets - into the fraudsters possession
Misrepresentation - of the financial position of a business in order to mislead stakeholders, taxation or regulatory authorities.
What methods might fraudsters use to divert an organisations assets?
- Theft - employees with the opportunity to steal physical property
- Misuse of assets - for example selling information for personal gain
- Invoice scams - fake invoices suggesting payment is due. They may threaten further action or that non payment will affect credit rating.
- Payment fraud - any fraud which involves falsely creating or diverting payments
- Procurement fraud - not following tendering processes or offering higher payments and sharing profits
- Payroll fraud - falsifying timesheet for overtime payments
- Office supply scams - tricked into over ordering equipment by claiming an order hasn’t gone through.
What are the 4 main conditions required for fraud to be committed?
- They must have motive
- There must be something worth stealing
- There must be opportunity for them to remove the assets and derive gain
- There must be a failure of control or fraud risk management
What mechanisms are there for preventing fraud?
- Strong internal controls
- Effective budgeting and monitoring of procurement spend
- Controls over individual financial authority levels
- Authorisation for procurement or expenditure
- Rigour in checking transactions
- Clear audit trails
- Segregation of procurement duties
- Controls over preferred suppliers / single sourcing deals
- Use of e-procurement tools (reduce human involvement)
- Use physical security measures
- Internally audit procurement processes, decisions and controls.
