Procurement maturity and business resilience Part 2: The role of risk

In Part One of this two-part series on the Procurement Maturity Curve, we looked at the continued (but changing) role of savings as a measure of procurement performance. That blog, and the companion ebook, delved into the expanding role of P2P technology solutions and integrated data for procurement teams. It also covered how a “negotiate more” approach to supplier management is shifting how procurement achieves savings, and a number of other goals. Chief among those is procurement’s leading role in business resilience.

In Part Two, we consider supply chain risk in the context of procurement’s maturity, a topic that has been in the headlines since the global pandemic first surfaced as a major disruptive force. We’ll look at supplier risk and the available methods to monitor and mitigate it, along with internal vs. external sources of risk.

What puts procurement on the front lines of risk management

Two disruptive events – one global, one local – that provide a stark reminder of the true fragility of supply chains, and the world’s economies as a whole:

1. 1. Global pandemic
   2. Megaship stuck in the Suez Canal

These are also two great examples of how risk management belongs in the top criteria of every procurement and sourcing planning strategy. Companies, industries, and procurement teams can be very good at strategizing for disruptive events, generally of the meteorological, political, and social variety, in differing degrees.

But a worldwide health crisis is almost too large for procurement to plan for, and a single ship halting traffic on the busiest trade route for a week is almost too specific to plan for. Ports get backed up and schedules thrown off for various reasons, for which contingency plans can be made. But how do you plan for the risk of one ship in one spot at a particular time?

During the weeklong Evergreen-as-cork in the Suez, economists estimate that the cost in trade was $10 billion per day. The true cost may be considerably higher, especially since the supply chain traffic flow disruption will have repercussions lasting months.

Procurement teams immediately started putting contingency plans into place for alternative sourcing needs, but they will be sorting through the lasting wreckage and finding workaround solutions for a long time. The front lines of risk.

How procurement sources risk mitigation

In Part One we showed how procurement deals with primary internal spend management needs to achieve savings generation and improve compliance. Externally speaking, even though not all conditions have negative consequences, their unpredictability leads us to think of them collectively as “risk”. Even when risks never materialize, we still expend energy and resources identifying them, monitoring them, and coming up with mitigation plans.

As seen above, not all risks can effectively be “pre-managed.” But when it comes to suppliers, procurement needs a deep understanding of those we source from, as well as the geographies and markets we (and they) are involved in. As a condition of business resilience, that understanding of suppliers and the strength of the relationships can prove critical.

For that reason, procurement risk management can seem like a potential set of dominoes set on an unstable surface; you can’t always know where the cascade is going to start. Some risks affect us directly and some of them are embedded in multiple layers deep in the supply chain. This added distance makes risks hard to see and even harder to manage. Visibility challenges notwithstanding, if procurement is to play a lead role in addressing supply chain risk, we have to significantly expand our perspective and approach.

Spend management IS risk management

In a needs-driven procurement process, we would traditionally optimize supply arrangements solely according to internal requirements and constraints, focusing primarily on savings and compliance. While this is a straightforward approach that pays huge short-term dividends for the enterprise, it under-represents the full and immediate impact that risk can have on our business through the supply chain. Like we mentioned above, in a global economy it’s not just your own enterprise risk you have to worry about anymore, it’s every step in the supply chain.

Having an exclusively internal focus during the strategic sourcing process assumes the enterprise is at the center of the market, which it almost certainly is not. Only a very few companies have the demand to “make” markets, and even then in just a limited number of categories. During periods of major business disruption, all bets are off, and those “market makers” will be facing the same hurdles as everyone else.

External market conditions have to be factored into sourcing and supplier evaluation requirements before bids are solicited so that risk is addressed directly from the outset. Building risk management into the entire sourcing-purchasing-settlement continuum will put procurement on much better footing if a negative event should unfold. If you know ahead of time where and how you’ll likely need to pivot, that agility will provide strong returns.

Procurement needs to bring two things to light in each category of spend managed:

1. 1. What are the relevant risks?
   2. What is each supplier doing to manage them today?

Not always a simple task, to be sure, but doing so provides better visibility into the true dynamics of a category and the capabilities of each supplier to meet a range of contingencies. It may even shed a new light on total cost. If two suppliers provide a comparable product or service, but one is more expensive than the other, it would be natural for procurement to recommend the “savings” option. But if the more expensive supplier takes unique and meaningful risk mitigation steps, it would add a significant factor in determining the choice of suppliers.

You can’t have a reactive risk management strategy

There’s a saying: the time to mend the roof is when the sun is shining. As a front line risk manager, it’s up to procurement to actively monitor all the sources of risk that it can, and take every step possible to be prepared. Granted, many risk mitigation steps procurement can take to prevent or minimize the impact of disruption fall outside of the typical role. One of our more key preparatory roles may include the identification and comparison of alternate sources of supply, doing research and first round qualifications that we can then proactively share with the business.

Risk awareness must be part of the strategic sourcing process, but it is also not a “task” that gets check off. Risk is continuous, and once the award is made, managing it needs to remain a high priority activity. Depending on the size, industry, and location of the supplier, monitoring risk factors could be a daily or weekly activity. If procurement revisits the risks and apparent impact only on a monthly or quarterly basis rather than in response to real-time changing conditions, we cannot assume that putting a relatively low-risk supplier in place covers the enterprise for the term of the contract.

Putting savings and risk on parallel paths

A savings-driven approach to spend management generally assumes that internal constraints supersede external ones. During good/stable times, this is not necessarily a bad thing. But when an expanded viewpoint can take into account the variability of supplier influence on the supply chain, savings looks like a parallel objective to risk management. A more labor-intensive, but overall better approach.

Rather than focusing on the needs and wants of the enterprise and then finding the best-qualified solution in the market to meet them, procurement should take a more proactive approach, one that balances internal needs with external realities.

Not only does this set an organization up from a business resiliency standpoint, it reinforces procurement’s reputation as adders of value. An expanded perspective enables procurement to help decision makers evaluate a wider range of available options based on a more informed set of criteria. And do it independent from, yet inclusive of, their current requirements.

This gives the ultimate solution put in place the benefit of being optimized for immediate and longer-term advantages. Internal requirements can be appropriately (and rapidly) changed in response to the best solutions available on the market.

Despite best intentions and best efforts, companies sometimes create risk from within. Often this results from establishing specifications so narrow that it effectively eliminates backup sources of supply. Alternately, if our suppliers regard the company as “high maintenance” they are less likely to give advance warning or additional assistance in the face of disruption. This goes back to supplier relationship management and transparency, where a culture of “negotiate more” and shared success as an outcome work very heavily in your favor during business disruption.

It may be hard for companies to look in the mirror when it comes to managing risk. Benchmarking requirements against the market as a whole does not mean unique or custom specifications won’t be supported, they just have to have an acceptable ROI. As long as there are multiple suppliers competing in a category, there will always be a range of options available for evaluation. The point is to make sure each offering is as strong as it can be by considering all price vs. risk constraints, internal and external.

The biggest risk is no risk management plan

As we’ve all experienced in the most brutal fashion, risk most often materializes in the form of supply chain disruptions. Between a rock and hard place, the result is usually that supplies are temporarily unavailable, or costs are driven prohibitively through the roof. Neither is acceptable, but the situation is made worse when there is no alternative plan in place or end in sight to the disruption.

Procurement is uniquely positioned to monitor external sources of risk and quantify their likely internal effects. We can take steps to establish mitigation plans and lead the company in executing those plans should conditions change. Internal risk control should be more straightforward, but it’s often a case of how much truth senior management or business units are willing to admit.

It is critical that procurement not think of risk mitigation activities as separate from spend management responsibilities. Sourcing, spend analysis, supplier management, and contract management should all reflect a keen awareness of risk, especially once procurement has demonstrated the ability to carry these processes out to good effect under internally driven objectives.

Each category of spend should be evaluated for the risk profile it bears both inside and outside of the company. When procurement recognizes that the enterprise is part of a much larger system of players and forces, and accepts the role we can play in managing those dynamics, our work becomes far more complex.

Fortunately, this complexity comes with a corresponding increase in potential for value creation, competitive advantage, and keeping business flowing with a positive impact on the bottom line.