Category Archives: Risk Management

Breaking Down the Risks: Natural/Man-Made Disasters

Disasters are on the rise. Why? Well, as per our last installment on talent, we are going to be expounding the pounding and giving you tips on reducing the risk.

Expounding the Pounding

As climate change has intensified, the number of natural disasters has risen sharply. Between 1980 and 1999, we experienced roughly 4,200 disaster events. Between 2000 and 2019, we experienced roughly 7,300 for an increase of roughly 75%.

Many of these were quite significant. According to the NOAA National Centers for Environmental Information, between 1980 and 2024, the US alone sustained 403 weather and climate disasters where overall costs and damages exceeded $1 Billion dollars (when CPI was adjusted to 2024) (Source: NCEI). The total cost of these events for the US has exceeded $2.9 Trillion dollars and resulted in 16,941 deaths.

Moreover, while the overall average frequency of Billion dollar weather/climate disasters over the last 45 years is 9, the average over the last 5 years is 23! In other words, natural weather/climate disasters are coming harder and faster than ever before (and the pace is still increasing).

If we turn our attention to the United Nations Office for Disaster Risk Reduction and review their 2025 Global Assessment Report on Disaster Risk Reduction (GAR), they found that while the direct costs of disasters averaged $70 Billion to
$80 Billion a year between 1970 and 2000, between 2001 and 2020 the costs ballooned to between $180 and $200 Billion a year and that disaster costs now exceed $2.3 Trillion ANNUALLY. Let that sink in. The global cost of natural disasters is now so great that only seven (7) countries have a GDP that exceeds that cost. In other words, the cost of these disasters, of which we now experience almost 400 a year (as the Emergency Events Database recorded 393 natural hazard related disasters in 2024, see ReliefWeb) exceeds the GDP of Russia, Canada, and Italy!

You’re going to be impacted by a natural disaster in the very near future to some extent. In most first world countries where a survey has been done the results are consistent: Four (4) out of Five (5) corporations agree that natural and climate disasters hurt because they were impacted in the last 5 years. Moreover, with the rapid rise in disasters your chance of not being impacted by a natural or climate disaster in the next 5 years is trending down to 10%. In other words, your chance of being impacted is 90%. It’s beyond the point that you have any chance of being one of the lucky ones. As per a 2023 Forbes article based on an Allianz Global Corporate & Specialty (AGCS) report, natural catastrophes are the largest driver of corporate insurance losses in the US because luck can’t save you now!

And we haven’t even started to talk about man-made disasters due to bad design, bad construction, bad maintenance, or just bad negligence that can result in entire skyrises being lost, manufacturing districts going up in smoke, ports exploding, entire swaths of land becoming unavailable due to nuclear meltdowns, global pandemics due to bacterial and viral leaks from research labs, and so on.

Reducing the Risk

Insurance

Do not, we repeat, do not forego the insurance! You will need it. However, unless you can prove you are employing best practices across the board this could be expensive. So you also need to employ a number of other best practices to make the insurance companies happy. (Although their Ren & Stimpy days are over. No more happy, happy, joy, joy because gone are the days when they only take in and never pay out.)

Third Party Vetting

Think those third party risk management / third party compliance management (TPRM/TPCM) solutions are a nice-to-have that you can wait on? Think again. You need to vet every supplier, every carrier, and every partner involved in the delivery of your goods from the factory to the store (and every warehouse, port, and transfer point in between). You need to prove you did your best to ensure only legitimate actors were in your supply chain so that you have some recourse (with insurance) when the shipment gets damaged or disappears (and to make sure you can afford your insurance premiums).

Overall Risk Vetting in Source Selection

Before you select a supplier as your chosen source of supply, you need to understand the 360-degree risks which are not just the supplier risks of financial stability, compliance, quality, human rights, and so on, but the risks related to its geolocation(s). Are there tensions between the country you are operating in and the country the supplier is operating/producing in that could lead to sanctions? Is there unrest that could lead to border closings due to uprisings? Is the area prone to natural or climate disasters that have been increasing in frequency in recent years? Etc. If the overall risk is high, and there is another supplier of comparable (which could mean slightly higher) cost that is considerably less risky, then you should be choosing the alternate, slightly higher, cost supplier.

Shipment Tracking / T(I)MS

You need to be tracking all of your shipments, and, preferably, have a Transportation (Information) Management System (T(I)MS) that integrates with your carriers. At the very least, you need to know when a shipment reaches each stop and then sets out for the next stop in the chain and know where it should be at all time. If the cargo is very high value or the carrier is a common target of criminal organizations because of what they typically carry (and that includes items like cell phones, laptops, and gold bars), then you need to ensure that the shipment is tagged and the truck, container, etc. is sending real time cellular signals at all time, that the carrier is monitoring their systems 24/7/365, and if a shipment ever goes dark for more than a few minutes or too far off course, and the driver cannot be immediately reached, law enforcement is immediately engaged. Unless, of course, you can afford to have 40 Million disappear! (A 40 foot shipping container can hold 44,000 iPhones. High end i-Phones are all 1K (or more) a pop. Do the math.)

Breaking Down the Risks: Loss of critical talent/limited talent availability

In our first series inspired by the latest and greatest CPO Survey that was just published by Deloitte, with the help of Spend Matters, which was designed to highlight, among other things, the latest and greatest “observations, challenges, and trends” in Procurement (and which included many survey results across enterprise priorities, focus, barriers to success, strategies, technologies, risks and competency gaps) we narrowed in on the top barriers to success that were common across all of the surveys and studies done by the big consultancies over the last five years. We presented you with a brief history, defined the core problem, and presented you with one more necessary realizations you need to make if you wish to make progress against the barriers.

In this series we will be tackling the risks, where we will be expounding on the pounding you are taking as a result of the risk as well as giving you some tips to reduce the risks. However, like the last series, in this series we will not be diving deep into the process upgrades or technological underpinnings you will need to adequately address them for the reasons discussed in the last series. Our goal is to give you the understanding you need to understand why the risks never change (and what realizations you first need to make if you want any hope of progress against them.)

Expounding the Pounding

As per one of our barriers to success on the talent gap in our first series, there is a talent gap which grows every year. This makes the loss of critical talent a major risk for many corporations who may only have one or two senior specialists capable of doing a specific, sophisticated, task that is vital to the organization. Especially when all of their organizational peers are in the same boat and there is a lack of replacement talent in the market.

This is especially true in sectors like manufacturing. As a result of decades of outsourcing and offshoring, and a lack of focus in the American (manufacturing) economy for decades, the number of senior, experienced resources in factory design and shop floor management is at an all time low and about to rapidly decrease in the next five years with the average manufacturing shop owner in the US being at least 62 years old. Let that sink in. A study by Crain’s Grand Rapids in 2021 found the average age four years ago was 62 and 70% of manufacturing business owners were over 59. (And America wants to bring manufacturing back? We applaud the vision, but we’re not sure how!)

Reducing the Risk

Unfortunately, in some industries, there is no way to reduce the risk. The talent is aging (rapidly) and the replacement pool is shrinking. (And with immigration being tightened in most countries, and forced deportations of all non-citizens in others, you can’t import the talent either.) The risk is only going to increase no matter what you do.

Therefore, you need to take steps to prepare for the inevitability and prepare your own critical talent (and ensure you have compensation programs and advancement opportunities in place that will make them want to stay once you embue them with the skills and knowledge they need).

In order to mitigate the risk to the extent possible, you need to do the following:

  1. install proper Knowledge Management Systems (KMS) and capture as much knowledge as you can from senior employees, document and institutionalize their processes, and capture their decisions and recommendations over time in the context of real world situations
  2. hire recent graduates or trainees with promise (and, preferably, not from business or procurement or operations backgrounds but from appropriate STEM (or Legal for contract negotiations) and have them mentored by a senior employee for at least a subset of the employee’s current role
  3. create, or (co-)sponsor, your own training programs (either internally or with partner educational programs) to ensure your next generation of talent is properly trained

That’s where you start. In our next post we will move onto the next major risk.

The Major Procurement Risks with High or Moderate Impact

In our last series, which kicked off with our post where we told you that you don’t need to read another state of procurement study for the next 5 years, we noted that Deloitte recently released their annual latest and greatest CPO Survey with the help of Spend Matters, that was designed to highlight, among other things, the latest and greatest “observations, challenges, and trends” in Procurement, but that, in reality, just highlights the same problems, priorities, and barriers it found in the past 9 editions, just like every other annual survey in Procurement.

There’s no embellishment here. We mean every other study that has come before for years because:

  1. the doctor has been reading them.
  2. the doctor went back through 15 studies in detail that were released in the past five years and a few other related papers published in the same timeframe.

As part of this in-depth review, the doctor pulled out, for each of these 20 papers (which included papers from the usual suspects like Kearney, CapGemini, E&Y, PWC, and Everest), the

  • Top Barriers/Roadblocks to Success/Challenges
  • Major Procurement Risks with High or Moderate Impact
  • Primary Concerns/Strategic Priorities for Procurement Leaders
  • Significant Skill Competency Gaps/Support Needs

After doing so, the results were that, for the Deloitte study, analyzing the:

  • top barriers, of the 10 quoted in 2 or more of the papers, 7 are in the Deloitte study,
  • major procurement risks, of the 7 quoted in 2 or more of the papers, 5 are in the Deloitte study, and
  • primary concerns, of the 13 quoted in 2 or more of the papers, 8 are in the Deloitte study.

Moreover, if we were to abstract the barriers, risks, and concerns one level and start looking at the underlying systems or processes that would need to be addressed, the similarities would be even more significant.

More importantly, they aren’t changing much year to year, and aren’t going to change much for the next decade at least.

A year ago I penned a post where I pointed out that before you get all excited to learn about trends for fall conference season, with the exception of:

  • Gen-AI being the new fluffy magic cloud
  • Fake-take (sorry, intake) being the new dangerous and dysfunctional dashboard

the majority of trends that have been discussed for the past year are the same trends that were discussed ten years ago (and SI has the blog history to prove it, especially since it doesn’t purge over half of the blog history on a site upgrade and/or migration).

This is because the core purpose, and thus the core priorities, challenges, and risks, of Procurement haven’t changed in decades. The systems have evolved, the processes have become more complicated, and the global supply challenges haven’t been this bad since the nineties, but the core HAS NOT changed (and, to be fair, has NOT changed since the first manual was published in 1887 and has NOT changed much since cross-continental trade began thousands [and thousands] of years ago).

Which means we don’t need any more annual surveys on these issues (every 5 years would be more than enough, and even then you might find that the only movement is related to the hot tech of today vs. the hot tech 5 years ago, as SI did when it did its trend analysis last year).

In our last series, we also noted that we weren’t going to bore you by digging up two decades of studies and showing the same issue lists again and again, because that’s not the problem. The real problem is that these core issues still aren’t adequately addressed after decades of these “studies” being published, even though it’s the same issues again and again that come back year after year after year, sometimes with a vengeance when an unexpected natural disaster or pandemic strikes, a war breaks out, or a fan of the Gilded Age believes that tariffs are the cure-all and starts global trade wars.

However, before you can solve these problems, or anyone can put forth a solution, you need to understand what these issues are, why they keep coming back, and acquire some insight into how you might deal with them once and for all and finally move the needle forward.

In our last series, we focussed on the barriers to success. In this series we are going to address the risks. The seven risks that keep coming up over and over again, where five of them are top risks in the Deloitte study, from most referenced to least referenced, were:

  • Loss of critical talent/limited talent availability. ([00], [04], [05], [12], [19])
  • Natural/Man-Made Disasters ([04], [12], [14], [19])
  • IP/cyber attacks ([00], [03], [10], [12])
  • Rising cost/ spend pressures/inflation ([00], [04], [19])
  • Supply shortages/constraints / Competitive Alternatives ([00], [04], [12])
  • Regulatory compliance issues ([00], [04], [12])
  • Corruption/Fraud ([02], [04])

It is hoped that you enjoy the coverage!

Finally, remember to review our article on why You Don’t Need To Read Another State of Procurement Study for the Next 5 Years! if you want to dig up the referenced papers.

You Don’t Need To Read Another State of Procurement Study for the Next 5 Years!

Earlier this year, Deloitte released their annual Global CPO Survey which was again done in collaboration with Pierre Mitchell of Spend Matters which included, among other things:

  • Top Barriers/Roadblocks to Success/Challenges
  • Major Procurement Risks with High or Moderate Impact
  • Primary Concerns/Strategic Priorities for Procurement Leaders
  • Significant Skill Competency Gaps/Support Needs

just like every Deloitte CPO Study that came before and, moreover, every Hackett (which now owns Spend Matters), Kearney, CapGemini, E&Y, PwC, Everest, etc. study that has come before for at least the past five years. I know, because:

  1. I’ve been reading them.
  2. I went back through 15 of them in detail and a few other related papers published in the same timeframe and pulled out each of these for all of them.

Now guess what? They’re all more-or-less the same with only about 20% to 30% divergence. With respect to the 20 papers I went back through in detail, for the Deloitte

  • top barriers, of the 10 quoted in 2 or more of the papers, 7 are in the Deloitte study,
  • major procurement risks, of the 7 quoted in 2 or more of the papers, 5 are in the Deloitte study, and
  • primary concerns, of the 13 quoted in 2 or more of the papers, 8 are in the Deloitte study.

Moreover, if we were to abstract the barriers, risks, and concerns one level and start looking at the underlying systems or processes that would need to be addressed, the similarities would be even more significant.

More importantly, they aren’t changing much year to year, and aren’t going to change much for the next decade at least.

A year ago I penned a post where I pointed out that before you get all excited to learn about trends for fall conference season, with the exception of:

  • Gen-AI being the new fluffy magic cloud
  • Fake-take (sorry, intake) being the new dangerous and dysfunctional dashboards

the majority of trends that have been discussed for the past year are the same trends that were discussed ten years ago (and I have the blog history to prove it, especially since I didn’t purge over half of my blog on a site upgrade and migration 2 years ago).

This is because the core purpose, and thus the core priorities, challenges, and risks, of Procurement haven’t changed in decades. The systems have evolved, the processes have become more complicated, and the global supply challenges haven’t been this bad since the nineties, but the core HAS NOT changed (and, to be fair, has NOT changed since the first manual was published in 1887 and has NOT changed much since cross-continental trade began thousands [and thousands] of years ago).

Which means we don’t need any more annual surveys on these issues (every 5 years would be more than enough, and even then you might find that the only movement is related to the hot tech of today vs. the hot tech 5 years ago, as I did when I did the exercise last year).

However, to make abundantly clear why these barriers, risks, priorities, and skillsets, are not going to change, we’re going to explore them in the months ahead so you never have to read the exact same report all over again (at least for five years).

We hope you enjoy.

P.S. These are the 21 papers that I reviewed and may be referenced in this ongoing series. There are many more examples over the last 5 years if you look, but it’s really hard to keep reading essentially the same content, especially after you’ve done so 21 times!

Financial Business Risk Prioritizes Supply Chain Vulnerabilities …

… but it does not identify those vulnerabilities, although it can tell you where to start looking. So while an article in the SCMR last year provided a good overview on how to evaluate, and quantify, supplier risk, the title was misleading when it said they were calculating business risk to identify supply chain vulnerabilities.

The article, which described an approach by the authors to find a way to improve the evaluation of risk impact on a business, culminated in four main findings. The approach, which looked at the total financial impact a supplier failure would have, yielded two findings that we’ve known for over a decade, ever since Resilinc pioneered the approach of assessing the financial risk associated with a supplier failure (based on mapping where all of their parts are used and which of those are single source)

  • procurement spend with a supplier is NOT correlated with the financial risk of a supplier
  • part standardization can increase business risk impact

As well as two insights that are rather new:

  • procurement spend is not correlated with the revenue of the company (the Resilinc model could have shown this, but they did not focus on this or collect those metrics last time SI was made aware of their methodology)
  • true high-risk impact suppliers are a substantially smaller amount of spend than an organization might think; in the authors’ study, they represented only 28% of total spend (whereas most companies will highlight the high spend suppliers as high risk and identify the suppliers that represent almost 3 quarters of spend, or 73% in this study)

The reason for this is that they linked all of the organization’s data sources that contained information related to the BoM for each SKU, the revenue for each SKU, and the suppliers for each BOM. By creating a network of connections between components, products, and suppliers, and identifying single source parts, the link between the criticality of a supplier and the revenue became clear. Consider the supplier who supplies that custom control chip for the fuel injection management, cruise control, or even for the monitoring of the tire pressure. If they were to fail, the absence of a single, $10, custom control chip can bring down a multi-million dollar production line, and close down an entire production plant, as the recent semiconductor shortage did to many plants during COVID. Given that these were being put into $10,000 to $100,000 cars, these suppliers would never have blipped on a spend-based risk assessment. And this is just one example.

But it is an example that demonstrates the blind spots companies have with respect to small and specialized suppliers that aren’t in the top 80% of spend but yet supply sole-sourced and/or custom parts or products. This means that when doing a risk assessment, it’s not just risky suppliers or risky supply chains that need to be assessed, it’s any supplier that supplies something that isn’t easily replaced by another source should something happen to the current supplier. The risk could be low that they will fail, and lower still that you couldn’t quickly modify a design to use an alternative, but you don’t know until you assess. And that assessment must be revenue and criticality based, not spend based. Spending $100M with a steel supplier to acquire the raw material for a frame assembly makes the supplier strategic, but doesn’t make using that supplier super risky when all their competitors offer the same grades of steel. But if you need a custom chip for that car, power transformer, etc., and you currently only have one supplier to supply it, then that supplier, no matter how stable and how low-risk its profile looks, is a risk even if it only gets one hundredth of the spend. And you need to determine if it has any vulnerabilities and, if so, monitor them so you won’t be surprised by a sudden failure.