Monitoring risks - Frequency

Last Thursday I was asked how often to update the risk assessment and assessment in a quality management system according to ISO 9001: 2015. I gave an answer around this:

"At least annually, but that is not very effective, the more the risk based approach is embedded in the organization’s management system, the more frequently it should be performed. Every day, I see in newspapers external events that can generate risks and opportunities. For example, will this coronavirus crisis have an impact in your own organization? I try to implement the risk-based thinking in all management meetings, at several levels."

In the meantime, I had the opportunity to read an interesting article on risk and supply chains,"Supply chain risk management is back", and I saw the answer to the question from another perspective:

"A systematic classification of risks, and development of a related response strategy, is essential to improve supply-chain resilience strategically—while keeping required investment to a minimum. A simple framework can help by classifying risks on two axes: the vertical estimates to what extent a risk can be anticipated, while the horizontal quantifies the risk’s expected impact.

• “Manageable surprises” are difficult to anticipate but manageable in terms of impact.

• “Black swans” are hard to anticipate and severe in terms of impact.

• “Brewing storms” can be anticipated and will have a high impact once they materialize.

• “Business challenges” are typically low-impact risks that can be both anticipated and managed quite easily."

Each quadrant deserves a different treatment:

"For each of the quadrants, a specific set of response strategies can be developed. A reactive risk-management approach should be taken for risks that are difficult to predict, and a more proactive approach for those with higher predictability.

• Low-impact risks that are hard to anticipate, such as the bankruptcy of an individual supplier or a localized conflict in a country without major operations, can be accepted or avoided to a certain extent by diversifying operations. Systematically implementing a dual-sourcing strategy, through nominating new suppliers or negotiating a second source of supply from the same supplier, help mitigate this risk category.

• High-impact risks that are hard to anticipate, including natural disasters, terrorist attacks, or cyberattacks, can be managed by building strong crisis-management capabilities and resilience throughout the system. A supply-chain risk-management team can introduce a systemic risk-monitoring process which can be enhanced by regular scenario-planning exercises. Through keeping healthy reserves for parts with long recovery times, companies can prevent some supply-chain disruptions. Another way to mitigate risks which are difficult to anticipate is transferring risk to other parties: taking out insurance and introducing risk-related contract language are possible answers.

• Low-impact risks that are relatively easy to anticipate, such as labor disputes, regulatory changes, or changes in customer preferences (for minimal plastic usage or increased product sustainability, for example) can be managed proactively by increasing the robustness of the supply-chain system. The most important single measure, though, is solid training of the workforce to handle everyday risks. Encouraging employees to voice concerns about possible defects and disruptions helps create a general risk awareness as a first step to managing disruptions. IT systems and tools can then help to continuously monitor disruptive trends and events.

• High-impact risks that are relatively easy to anticipate, including Brexit, US–China trade regulations, or decarbonization targets, need the most attention. A systematic review of the supply-chain setup may be advisable. Possible response strategies include redefining the sourcing strategy by, say, raising the share of local suppliers, or revisiting the manufacturing footprint by moving some manufacturing operations out of certain areas. Establishing CKD operations in countries with high import taxes on finished products can be another option. The review of the inventory build-up strategy helps optimize service levels by increasing safety-stock levels for critical components which cannot be sourced from alternative locations. In some cases, preparing for changes in demand can be an appropriate answer."

An idea to improve risk management efficiency is to give different attention depending on the greater or lesser capacity for anticipation and the greater or lesser impact of the risk.

Now, I'm remembering an example from Tom Peters in the book "Re-Imagine" about Dell answer to problems in the supply chain... managing risks wasn't managing risks, it was doing normal business.