Driving Value Chain Resiliency Through Analytics
How Cisco’s dedicated SCRM team helps tame large, complex, global supply chain.
By Lance Solomon
The current trend in value chains is toward more lever-aged, nimble networks that typically utilize outsourced business models following lean principles. The end result is value chains that are more global and require effective collaboration with multiple business partners. While providing an excellent method for balancing inventory, capacity and demand, today’s value chains are thus often much more susceptible to disruptions. Global value chains that span a variety of business partners also present a challenge for an organization to effectively manage this increase in risk, which is increasingly becoming a requirement for success in today’s global market.
A single disruption within an organization’s value chain can have a lasting effect on its financial position. According to a 2004 report by professors Kevin B. Hendricks and Vinod R. Singhal of Georgia Institute of Technology’s DuPree College of Management, organizations suffer an average of a 10.5 percent reduction in stock returns in the first year following a supply chain disruption, and an average of 40.7 percent lower returns in the second year compared with similar organizations in similar industries .
Cisco Systems is able to take advantage of a strong business intelligence framework combined with analytical rigor to focus the organization on building a resilient value chain. As Kevin Harrington, Cisco’s VP, Global Business Operations, Customer Value Chain Management, mentioned in a 2010 article on the importance of analytics in managing today’s value chains, “Increasingly, we are going to need hardcore statistical analyses and other advanced analytical techniques to make smart decisions on forecasting, risk management, capacity planning and many other areas across our global operations” . This is apparent when you look at the daunting task of trying to manage value chain risk across a global network of more than 9,000 products enabled by more than 40,000 unique components and nearly 1,000 partners operating at roughly 2,500 locations around the world.
Due to the large, complex and global nature of its value chain, Cisco established a dedicated Supply Chain Risk Management (SCRM) team in 2006 with the primary objective of formalizing the function of risk management relative to business continuity planning. In response, Cisco developed an analytical framework to assess and analyze risk scenarios and then worked directly with its manufacturing and supplier partners to help identify, assess and manage risks. Ultimately, Cisco’s vision is to create the most resilient supply chain in its industry.
Sound Business Intelligent Infrastructure
One of the key challenges organizations face when trying to manage risk is to accurately and efficiently map and assess the entirety of their value chains, which are typically large, complex and global. To do this effectively requires the ability to trace each individual component within a product back through its own particular value chain and assess the resiliency of each node within that value chain using a common framework.
For example, a company may decide to focus on the resiliency of its own factories, but there could be critical components used to produce the same products that are produced in a facility with a much longer recovery time. So, in order to completely assess and build resiliency into its products, a company must be able to identify all of the critical nodes within the value chain for each product. This is accomplished by connecting data from business continuity planning assessments with enterprise data such as shipment transactions, revenue, approved vendor lists, sourcing rules, and bills of materials. Given the large number of components, suppliers and manufacturing partners in today’s supply chain, the only sustainable way to collect and link all this data is through a solid business intelligence framework.
Typically enterprise data is readily available, so the biggest challenge to assessing value chain resiliency is the availability of resiliency assessment data for each of the nodes within the value chain that are critical to transforming components and raw materials into a finish product purchased by the customer. Using a third-party Web portal, Cisco is able to collect business continuity plans (BCP) to determine partner locations within the value chain, evaluate the resiliency of each node within the value chain and estimate how quickly each node can recover from a disruption regardless of the cause.
During the BCP process, Cisco asks its partners (suppliers, contract manufacturers, logistics providers, etc.) to provide key information on primary and alternate locations supporting Cisco products. The partner must also respond to a standard resiliency questionnaire based on a common balanced scorecard methodology that evaluates the resiliency of the supplier and each of its locations that support Cisco products. A key metric collected during the BCP process is the time to recover (TTR) for every node within the value chain. By focusing on TTR, Cisco can define the recovery profile of a product as characterized by the TTR of all component supplier factories, inventory hubs, partner (or internal) production facilities and logistics centers within that product’s value chain (Figures 1 and 2).
Figure 1: Entire value chain assessment is a necessary foundation.
Figure 2: BPC process.
Armed with intelligence on the resiliency and TTR of critical value chain partners, Cisco’s SCRM team can now combine this information with enterprise and location specific vulnerability data such as event types and probabilities. This provides the ability to map critical customer products and the revenue generated by those products to key threats and vulnerabilities throughout that product’s value chain. Thus allowing Cisco to effectively comprehend key risk drivers and concentrations of risk across the value chain and establish a data-driven approach to prioritizing and managing risk within the value chain. There are typically two approaches to mitigating risk within the value chain: sites or locations that represent a high concentration of single sourced operations (component production, internal manufacturing, transportation, etc.) versus focusing on a high revenue product’s entire value chain and the locations that have single sourced operations. We argue that each is a valid strategy and that the team need only choose the approach that resonates best within their organization. The next challenge is to transform the approach and sound business intelligence infrastructure into a more resilient value chain.
Turning Information Into Action
The value chain risk management analytical framework enables Cisco to proactively manage risks before an event disrupts the value chain and impacts shipments to customers. This is accomplished through real-time monitoring of the value chain, creating plans and playbooks on how Cisco responds to a disruption within the value chain, assessing the resiliency of all nodes within the value chain and setting quantitative objectives for proactively building resiliency in the value chain.
The analytical framework enables Cisco to add critical value chain locations to an event monitoring service that sends alerts based on event severity, event type and proximity to the value chain. All of these criteria are determined using an analytical framework, making sure the alert filtering methodology aligns to the risk within Cisco’s value chain. For any event, potentially impacted locations are quickly identified and within minutes data is available on products impacted, recovery times, alternate locations and estimated financial implications. This provides Cisco with the capability to assess and mobilize its value chain within minutes after a disruption. While this might seem like a simple concept, the challenging part is having all of this information immediately available: from supplier and partner locations to the products supported at each of those locations to the shipment history and current bookings for those products. Without Cisco’s integrated business intelligence framework combining supplier and partner data from the Cisco BCP program to enterprise data, this would not be possible.
Figure 3: Analytical framework for risk management.
Another purpose of the analytical framework is to aid Cisco in effectively building resiliency into the value chain by proactively managing risks before a disruption occurs. For products that are currently in the marketplace, Cisco can decompose the value chain for important products and assess the resiliency of each value chain node. We do this by calculating the resiliency index, which is based on a number of factors including BCP rating, sourcing strategies and TTR. The focus then becomes putting action plans together for each of key metrics within the resiliency index based on goals agreed upon jointly by Engineering and Operations. For new products being developed, the same resiliency index methodology can be use to assess the resiliency of these products at key points throughout the development process. It allows the SCRM team to measure resiliency in a consistent manner and work with the business units to establish resiliency goals while making cost and technology decisions. The product development teams can then look at choosing components, suppliers and/or partners that are more resilient. All of this is done prior to shipping the product to customers when the costs of these mitigations are typically more affordable.
To build resiliency into the value chain, the analytical framework is used to identify nodes that have a TTR greater than our stated recovery goals. For those nodes, the data is readily available to map to the approved vendor list or manufacturing partners, which narrows the focus on value chain locations that are a single point failure with long recovery times. For these locations, mitigation plans are developed that typically involve qualifying alternate sources or site(s) or increasing inventory positions to mitigate these risks. A product design team must consider a wide variety of factors when introducing resilience into product design: cost, time to market, technology, environmental issues and more.
The purpose of the resiliency index (Figure 4) is to provide the team with a quantitative method for assessing the resiliency of its products. Cisco can also leverage the information collected during the BCP process to analyze BCP compliance of its suppliers and partners and use this information to objectively integrate resiliency into its business review processes that evaluate supplier performance. Cisco can determine best in class resiliency among its suppliers and partners and incorporate this information into its process of awarding business to suppliers and partners.
Figure 4: The resiliency index.
The analytical framework also allows the organization to integrate resiliency into its supply chain design processes. This provides a methodology to manage risk as new business is awarded into an existing value chain or as locations need to be added or relocated based on the needs of the business. It also provides the necessary data to integrate resiliency into value chain optimization processes.
Cisco evaluates alternative value chain designs based on a risk appetite (revenue * TTR) and the assessment of risk drivers that impact each individual location (Figure 5). Within the value chain network, Cisco identifies high-risk, high-revenue manufacturing supply chain partners and then works with them, including contract manufacturers, logistics and transportation partners, to actively evaluate and test their contingency plans to ensure that designated alternates are both qualified and capable of responding within Cisco’s TTR objective. Recovery activities that extend beyond the defined TTR objectives then become part of SCRM’s mitigation program where the team determines cost effective mitigation solutions. Typical risk drivers include, but are not limited to, natural hazards, geopolitical disruptions, transportation failures, fires and economic threats. While it is tempting to focus on accurately predicting specific threats for a value chain location, SCRM instead uses this information to help guide the team in its value chain design process and focus on building resiliency plans that solve for a wide range of events.
Figure 5: Risk appetite defined as revenue * TTR.
Effectively analyzing and managing value chain risk requires the ability to assess resiliency, vulnerabilities and threats across a large, dynamic and complex value chain. A solid business intelligence infrastructure is a necessary foundational capability that includes business continuity planning as the assessment methodology that connects resiliency, threat and vulnerability assessments. Without this capability, building resiliency into the value chain would not be a sustainable and repeatable process, and Cisco would not be able to comprehend the criticality and resiliency of each node within the value chain. More importantly, the SCRM team would not have analytics available to help assess the impact of value chain disruptions, embed resiliency into its operations and design resilient products prior to releasing them into the marketplace.
Organizations looking to build value chain risk management capabilities should not overlook the importance of establishing a solid analytical framework before mobilizing resources to conquer the resilient value chain.
Lance Solomon (firstname.lastname@example.org) is the manager of Supply Chain Risk Management at Cisco. He leads a small, dedicated team of risk management professionals who are responsible for enabling Cisco’s growth and innovation through industry-leading supply chain risk management practices. This includes business continuity planning, crisis management, supply chain resiliency and design for resiliency. Prior to Cisco, Solomon managed operational decision support initiatives at Intel. He holds a master’s degree in operations research from The University of Texas at Austin and a bachelor of science degree in mathematics from the Pennsylvania State University.
1. Hendricks, K. B., V. R. Singhal, 2004, “An Empirical Analysis of the Effect of Supply Chain Disruptions on Long-run Stock Price Performance and Equity Risk of the Firm,” working paper, College of Management, Georgia Institute of Technology
2. Kevin Harrington, 2010, “Seeing The Future In Value Chain Management,” Analytics, March/April 2010, pp. 4-5.
- 40To understand what analytics in a large organization looks like, I recently paid a visit to Cisco. I had several reasons for choosing Cisco. To work at Cisco is to live with constant organizational change, as the company has acquired and integrated 144 other firms  since 1993, stitching them…