The company in question was UK-headquartered but had significant operations in North America, Western Europe and the Asia Pacific region. Cultural aspects of the implementation were therefore particularly important, especially as the company had recently been de-merged from a major global corporation.
Business continuity and overall risk management objectives
Having worked as a loose federation of operating companies within a larger group, the company's executives were keen to develop a culture for the new organisation focused on a greater element of consistency and sharing of best practice. They inherited relatively few processes from their previous parent and had recently appointed a risk manager with a strong quality and health and safety management background to drive improvement. However, they felt the need for support in developing an approach to corporate risk management.
Executive directors had a vision for putting in place a simple and practical approach to corporate governance, focused on addressing the key risks facing the group. The development of a group risk register and risk management strategy were important precursors to addressing tangible and significant operational risk issues.
A risk management strategy was defined, capturing a practical framework for implementation with clearly defined roles and responsibilities for risk management at all levels. Action plans were agreed to ensure key risks identified were appropriately addressed and accountabilities taken for improvement plans. Key risks identified and presented to executive management included global supply chain exposures. A consistent business continuity management approach was therefore identified as a key element of a strong enterprise risk management implementation.
Adopting a consistent approach to business continuity
The need for effective business continuity management was identified, particularly as the group had inherited a series of onerous risk improvement actions from property insurers that did not directly relate to the key business exposures. The company sought to put in place a framework for managing supply chain exposures, and there were a number of drivers for needing to adopt such an approach across all sites within the business including:
- implementation of a Lean Six Sigma programme with significant pressure to reduce working capital and improve cash generation
- drive for procurement efficiencies by rationalisation of raw material sourcing
- increasing business interruption insurance programme costs
- increasing formal requests from customers to demonstrate resilience of supply arrangements as part of customer service expectations.
It was important to put in place a robust and consistent framework for evaluating the implications of inventory-reduction and sourcing rationalisation projects on business risk and efficiency. The project needed to engage with procurement, quality, manufacturing and risk management personnel to ensure a successful enterprise-wide solution. The aim was to provide practical actions to support these initiatives by ensuring business continuity arrangements were sufficiently robust to allow this to proceed without impacting customer service.
Establishing clear priorities
The framework adopted for business continuity for the group emphasised the need to prioritise limited resources. The company had a large global product range, consisting of over 500 individual product specifications. This portfolio was considered to be too large to manage in a crisis situation. Therefore senior executives were asked to prioritise products based on three simple criteria:
(a) consolidated gross margin contribution to the group
(b) criticality of the product to key global customers
(c) strategic importance of a particular product to the viability of the total product range.
Products were classified into three categories:
category 1 Strategic products: must be recovered
category 2 Important products: recovery should be attempted
category 3 Non-strategic product: no recovery should be considered.
It was found that over 95% of gross margin was associated with category 1 and 2 products, despite their representing less than 40% of the product portfolio. This simple approach allowed senior management to focus on what was important, and allowed resources to be marshalled effectively.
Understanding interdependencies
The level of interdependency and common sourcing of raw materials across the group was not entirely understood. Analysing it reinforced the need for a consistent approach across the group. A key step in implementing a business continuity framework was to identify key accumulations of risk within supply chains. The example in Figure 1 above illustrates that a key dependency on the manufacture of a precursor existed. The precursor was only manufactured in one in-house facility. In this example, internal manufacturing capability is shown in blue and third party manufacturing in green. Many of the intermediates were manufactured in shared facilities, and this highlighted the need to identify alternative manufacturing capabilities, within or outside the group, in the event of a crisis.
Recovery time objectives
Engagement with senior management through the development of a group risk strategy clearly defined a group risk appetite in terms of financial loss and reputational impact. This, however, needed to be translated into practical terms to achieve a cost-benefit balance structure between levels of inventory and risk within supply chains.
A recovery time objective (RTO) was defined for each key product. This was set generally to match the group's aspiration in terms of overall stock inventories for key products. From Figure 2, it can be seen that the objective is to ensure that the business continuity plan delivers a robust recovery option before the 'crunch point' is reached; in this case failing to supply customer due to stock depletion. For example, where the group wished to hold no more than four weeks of finished stock, business continuity arrangements needed to deliver alternative manufacturing capability within this time.
Where recovery time objectives could not initially be met, a range of innovative solutions was identified to enable them to be achieved over time. The process was piloted at one international manufacturing site prior to roll out across the group. Learning was therefore shared between sites, and the process refined to better fit the organisation's culture.
Business continuity and margin
Figure 3 shows in some detail the benefits of business continuity as a strategy for preserving gross margin and contrasts it with insurance. The diagram shows the impact of a catastrophic incident on a business or product range with growing gross margin. Without a continuity plan, a production plant would be shut down for a protracted period to allow the incident to be addressed. Once inventories are depleted, the company will be out of the market unless a business continuity plan can be implemented. The lost gross margin will equate to the area under the line, allowing for eventual start up. There will be permanent loss of market, which will only be insured to the extent that any business interruption insurance policy covers post-start up market share loss. This cover will expire at the end of the policy indemnity period.
Contrast this large gross margin loss with the much reduced impact above the blue business continuity curve given an effective recovery strategy.
Stakeholder expectations
One of the original drivers of the project was to increase the visibility of key risk exposures to senior executives and to provide them with clear information on which to base risk decisions. The project was able to identify exposures to key assets and provide management with a range of potential options, with varying impacts on inventory and risk levels as well as on capital expenditure.
Preparedness for a pandemic was integrated into the scope of the business continuity project as the issue became more critical. Plans were adapted to consider this specific scenario and actions plans put in place, particularly in the Asian operations most closely exposed to avian flu. Learning from the SARS epidemic was built into response plans accordingly.
Part of the way through the exercise, the company underwent a client audit of business continuity arrangements on one key site. The business was able to articulate not only its site continuity plan but also its overall strategy for managing continuity risk. The outcome was extremely positive, with strong commendations for a well-structured and embedded programme.
In a similar manner, insurers were kept informed of developments on the project. It was possible to address their needs and expectations without having to implement the onerous risk improvement actions initially put forward.
Insurance programme synergies
For the company in the case study, the main driver for this work was to ensure the resilience of the business to external threats. However, an additional benefit was the ability to review their insurance arrangements and generate significant potential savings. As Figure 3 shows, by implementing a business continuity strategy consistently across their global business, they were able to reduce their overall business exposures to the level where traditional gross margin insurance protection was no longer seen as valuable. It was also recognised, as described schematically in Figure 4, that as investment in business continuity was increased, there should be a commensurate potential saving on insurance, based on an increased awareness of business exposures.
Recovery plans reduced the need for gross margin protection for key products. The increased internal confidence in risk management capabilities allowed the client to consider accepting higher levels of self-insurance and reducing insurance limits and indemnity periods purchased. Additionally, there was a ten-fold reduction in business interruption exposures to key sites. This is anticipated to move the company over time towards a position where it can insure on an increased-cost of working (ICOW) basis.
The exercise, however, created a realisation that more effort needed to be placed on key customer and supplier exposures. They drove the need for ever closer working between manufacturing, procurement and risk management functions within the company, encouraging the ultimate aim of managing risks across the enterprise.
Benefits
The overall benefits of this approach to this particular company included:
- establishing a process for the reporting and management of risk within the group
- explicitly linking business continuity plans to the key risks within the corporate risk register
- putting in place a consistent and thorough approach to risk management and business continuity across the organisation
- putting in place measures that have the potential to lower the cost of risk with a potential pay back on external risk financing costs
- providing assurance to internal stakeholders that supply chain resilience and security of supply exposures are being addressed in a structured manner
- meeting the expectations of external stakeholders such as customers and insurers.
Food for thought
This case study highlights some interesting issues.
1. How well is our organisation's approach to business continuity integrated with enterprise risk management and delivery of business objectives?
2. Is there a consistent framework for balancing risk and working capital when determining appropriate inventory levels?
3. Are approaches to risk financing and business continuity management sufficiently integrated?
4. Is the organisation paying too much to mitigate the supply chain cost of risk through business interruption insurance?
Alex Hindson is associate director of enterprise risk management and Simon Allen is risk analyst at IRMG, the risk management and financing consultancy arm of Aon Limited, Tel: 0207 882 0639, E-mail: alex.hindson@irmg.aon.co.uk; simon.allen@irmg.aon.co.uk
