Managing Supply Chain Risk - L5M2 - 2.4

Managing
Supply Chain
Risk-[L5M2]
2.4 Examine the use of contingency plans to overcome risks in
supply chains
Business continuity & disaster
recovery plans
• Incident response, disaster recovery and business continuity plans are
an essential part of protecting the organisation’s critical processes and
resources in case of a disaster or other unexpected event
• Vital infrastructure must continue to operate even after disastrous
events. Disaster recovery and continuity plans are procedures to enable
this
• The plans must be regularly be reviewed and updated
• The business must have communication system to communicate the
plans to all staff in a timely manner
• Business continuity and disaster recovery plans must be a priority for all
critical business systems/processes
• The business must set a policy and develop and document a consistent
and easy to understand and implement process for responding to
incidents
• The business must also conduct scenario exercises to ensure that staff
members know their roles and responsibilities in the event of an
incidents
Supply • Supply chains have become longer and more complicated and
this has also seen an increase in risks of interruptions
Chain • Supply chain interruptions have the biggest adverse/negative

impact i.e. damage, on the organisation’ s stock price than
interruptio
other business interruptions
• Organisations need to have contingency plans to implement
during disruption incidents
ns • Organisations are under pressure to manage these risks more
effectively and efficiently
• Supply chain interruptions can be due to many incidences/
events/ occurrences
• The interruptions could be due to
• IT / Telecommunications failure
• Adverse weather
• Cyber attacks
• Transport network problems
• Loss of critical employees/talent
• To reduce the effects of supply chain disruptions,
organisations need to have well managed business continuity
plans/arrangements in place
• A contingency plan is a set of actions to deploy
when an organisation faces an incident or needs to
take an alternative course of action
• Every organisation needs to have a contingency plan
to help it to effectively respond to a serious incident
Need such as a
for • Fire
• Supplier failure to deliver
contingen • Cyber attacks
cy • Strikes
plans • Natural disasters such as floods
• Financial failure
• Human error
• Power outages
The three phases of a
contingency plan
• The contingency plan consists of three distinct phases:
1. Incident response – takes place during incident
• Key components: detection and reaction
• Focuses on people’s safety
• Should include identifying the issue and communicating it to key
personnel
A • Reacting quickly and effectively in the right way can help to
minimize damage
Contingenc 2. Disaster recovery plan – takes place hours after the incident
y plan has • Key component: get critical systems operational

• Next step is to identify the damage to the organisation the
three incident has caused

3. Business continuity plan – takes place in the days after the incident
Distinct • Key component: prioritize getting business functions operational
• Should be put into action to get all of the organisation’s critical
phases systems operational
• For effective contingency planning, each of the phases needs careful
preparation, practice and execution.
• It enables resilience or faster recovery following an incident
• It shortens period of disruption and reduces disruption costs
• It saves lives by reducing risk of danger to employees and
Benefits customers by increasing their safety
• It helps minimise financial losses
of • It builds / boosts confidence/moral among employees and stops
staff from panicking in case the business is facing a threat
having • It gives business more flexibility to adapt to changes in the future
business • It builds confidence among customers, shareholders and other
stakeholders
continuit • It preserves brand value and protects reputation
• It gives a business a competitive edge
y • It protects the supply chain in the event of a disruption enabling
the organisation to be confident knowing it will continue to
plans deliver goods or services during and after an incident
• It reduces insurance premiums as the insurer regards the
business as low risk if it has plans to manage risks
• It is a compliance with industry standards or regulatory or legal
requirement/mandates and gives proof to stakeholders that the
organisation is acting in a responsible way
• The business continuity plan requires time and resources, and that requires the
buy-in from and involvement of senior management for successful implementation.
• Other stakeholders such as Security, IT, HR, Operations, and Supply Chain from
Developing a
across the organisation must also be involved. In bigger organisation a business
continuity team that will manage the process is formed.
contingency
• Key stages in setting up a contingency plan are:
plan
1. (Set) Policy – a policy and governance for business continuity programme is
set and agreed, as well as how it will work.
2. Analyse – most critical systems and business functions that should be
prioritised after carrying out a business impact analysis
3. Design – appropriate solutions in the event of an incident are identified to
mitigate risks
4. Implement – a response structure for incident management is created, with
roles and responsibilities. The business continuity plan is developed
5. Test – the plan must be tested and rehearsed to learn and improve. Real- life
drills and paper scenario testing is done.
6. Revisit – the plan is regularly reviewed, updated in light of threat changes and
improved
• When faced with a catastrophic incident, people oscillate (swung back & forth) widely with their
thoughts and decisions.
• Those involved in incident response must have the response procedures well documented so
that they can follow
• The incident documentation must readily be available to those responsible and in a format
accessible, and easy to follow.
• The document must be clear on who is responsible for actions, who needs to be informed and
Managing who needs to have agreed levels of authority
• Full investigation of incidents and the caused damage must be done. This might even include
incidents third-party experienced specialists / experts
• The disaster recovery plan must be put into action to get the critical systems operational
must • Once critical systems are operational, the business continuity plan must bring the prioritized
business functions back online to ensure that the business becomes operational again over time
be • After an incident has occurred, the correct order in which the three phases of the contingency
plan are implanted is
document
 Incident response
 Disaster recovery plan
 Business continuity plan – for resilience
ed • Suppliers must be asked to have their contingency plans in place and regularly reviewed
• The business continuity management systems accreditation is ISO 22301 – requiring
protection against, reduce the likelihood of and ensure recovery from disruptive incidents
• Technology, used in all phases operating a contingency plan, is now used to predict, monitor,
record, measure and report on supply chain disruption an efficient and timely manner.
Summary
End of
2.4
Was a pleasure to do 2.4 with you.
Let us do L03 next

Managing Supply Chain Risk - L5M2 - 2.4

Uploaded by

Copyright:

Available Formats

Managing Supply Chain Risk - L5M2 - 2.4

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Managing Supply Chain Risk - L5M2 - 2.4

Uploaded by

Copyright:

Available Formats

Managing

Chain • Supply chain interruptions have the biggest adverse/negative

y plan has • Key component: get critical systems operational

three incident has caused

Let us do L03 next

You might also like