Mapping an increasingly complex supply chain

Over the last two years, ongoing disruptions from the COVID-19 pandemic to supply chain disruptions caused by the Suez Canal blockage to ransomware attacks on critical infrastructure (as seen in the Colonial Pipeline attack) have disrupted the daily operations of businesses across the globe.

It became apparent that it was no longer a case of “if” the next disruption would occur but rather “when.” 

Most recently, the geopolitical crisis in Ukraine demonstrates the need for agile, resilient businesses that can make data-driven decisions.

The situation in Ukraine displays the multilateral effects of disruption: we have already seen the crisis affect personnel safety, the economy, supply chains, and vendors. As an ongoing crisis, the impact is still evolving, and businesses need to assess the current and potential future effects on their organisation.

Mapping business processes

Fully understanding how your business operates is the first step to ensuring resilience. Mapping business processes allows complete visibility into the inputs, outputs, and dependencies within your organisation.

Business processes do not exist in silos; they often rely on people, technology, facilities, third parties, and other supporting resources. 

Mapping allows you to identify gaps and vulnerabilities in your organisation, applications, or vendors which support critical products or services of your organisation. Once you have identified the weak links, you can mitigate identified risks to strengthen your business, services, and products.

It is critical to look at the big picture. Before speaking to different business functions and departments, it is helpful to identify your organisational services and products that are being delivered to the customer.

Identifying the products and services that you deliver to customers allows you to be able to map the end products first and then work your way down through the organisation to know how each independent process plays a role in delivering the end products or services to customers.

While business process mapping starts within your organisation, it extends to external dependencies, including vendors, supply chain, applications, and physical sites that support your daily business functions.

Supply chain mapping

In today’s highly globalised society, no organisation exists in a vacuum – we rely on vendors and providers to preform business processes. 

Disruptions that affect your vendors can cause a ripple effect down the supply chain and indirectly impact your business, hindering the applications that your internal teams require to fulfil their needed business function.

If you have already determined your critical third-party vendors, see if your organisation has mapped out its fourth- and fifth-party suppliers.

While your business may not engage with these suppliers regularly, any disruption that affects the vendors can have an indirect negative effect on your ability to deliver products and services to customers.

Mapping fourth- or fifth-party suppliers may be slightly more complicated than mapping your third-party vendors, so be sure to engage with your third-party vendors and ask questions. This will enable your organisation to visualise gaps and vulnerabilities throughout your third-party vendors’ supply chains.

How do you diversify?

During the mapping process, there are several key points to look out for. Ask yourself: “Do many of our third parties rely heavily on one fourth-party vendor?” and “Do all of our third parties exist in the same geographic location?” These questions can allow you to select third parties that enable risk diversification. 

While it is good to diversify your vendors to reduce risk, you must also know how to diversify effectively. Location can play a significant role in diversification. Some localities may be more susceptible to natural disasters or political volatility, whereas (in less extreme circumstances) a wide blackout or internet outage can halt services in a specific locality for some time.

It is in your best interest to diversify vendors across wide geographic regions and establish the same expectations for your fourth- and fifth-party vendors. This can ensure that a predictable or unpredictable disruption will not cause an outage to many of your critical vendors, thus inhibiting your ability to deliver services.

No matter how diversified or prepared your third-party supply chain is to handle disruptions, unpredictable situations can happen at a moment’s notice, which is why it is critical to have recovery strategies and business continuity plans for when business as usual halts.

This can come as having an additional provider on retainer or a list of providers who can quickly adapt to meet your business needs if your primary supplier experiences an outage.

Prepare to pivot and adapt

True resilience includes having the data on hand to respond in any situation. No matter what industry or market you operate within, having your business processes and supply chain data points mapped out prepares your business to respond seamlessly.

Gathering the data points and maps proactively before disruption hits your organization allows for planning and preapproval of the necessary precautions if the worst-case scenario occurs.

Once you have identified critical processes and critical vendors, you must proactively plan for when business as usual comes to a halt.

Critical processes require people, applications, sites, and suppliers that enable an organisation to fulfil its brand promise to customers under normal conditions. Unfortunately, normal conditions are not guaranteed, but achieving resilience can eliminate a single point of failure for your business.

Over the last two years, we have experienced wide-ranging crises that have affected almost every organisation in some way.

We should recognise that disruptions are here to stay, and it’s no longer a question of “if” another crisis will occur but rather a matter of “when.” Never has it been more critical for a business to be able to pivot and adapt to any disruption.

With the adequate and accurate data and plans in hand from business process mapping, supply chain mapping, and proactive programs, businesses can improve their operational resilience.

Bogdana Sardak is senior director of Risk and Resiliency at Fusion Risk Management