Keywords

1 Introduction

As risks at different levels of the supply chain, crises and organizational weaknesses and the complexity of interactions are increasing [1]. Risk Management has become, in recent years, a fundamental and a better control factor of the supply chain as well as a necessity to ensure the sustainability and the survival of organizations and businesses [1–4]. This term “Supply Chain Risk” is used in a variety of contexts and domains. References to notions like “risk identification”, “risk evaluation”, “risk treatment”, “risk management”, “risk discovery” and so forth have been found. Extensive research over the past 30 years by academics, practitioners and others, has greatly attempted to improve the understanding of Supply Chain Risk (SCR) profiles and Supply Chain Risk Management (SCRM) approaches and actions.

Numerous conceptual and analytical frameworks and mitigation techniques, tools and standards are now available to help managers and supply chain organizations to manage risk and to assure robustness and resilience of their networks. [5] state that managers seek to create an effective and efficient supply chain to ensure a competitive advantage. For this reason, they need to find a balance between costs, efficiency, effectiveness, resource use and therefore, risk management has become a reality for businesses to succeed. Thus, the SCRM is a support to the SCM in order to maintain the creation of value through the supply chain [6, 7]. This highlighted the link between risk management and supply chains in order to ensure the sustainability and survival of organizations and businesses, in a dynamic and unstable environment.

Therefore, more proactive and predictive risk management approach and strategy are needed [8]. This explains why supply chain risk management and resilience – robustness approaches have become such an attractive and powerful scientific and empirical discipline [9].

There is a common consensus amongst researchers in this field about the needs to develop a better understanding of risk and how it affects supply chain continuity. Every type of risk introduces different mechanisms of disruption, exposure level, impacts severity and poses different challenges for supply chain adaptability and recovery [10]. This creates the need for broader studies on supply chain risk decomposition and conceptualization within the context of dynamic supply chain networks [11].

Informed by the above critical aspects of the field and stressing the need for a better understanding of the concept of SCR, this article proposes a conceptual integrated model (SCRIM model) that helps in understanding, evaluating, measuring and managing these disruptions. In order to achieve this objective, the organization of the paper is as follows. After the introduction, Sect. 2 presents an overview of the most common conceptualization and decomposition of SCR and identifies SCRM implied methodologies. Then, an integrated conceptual model “SCRIM model” associated with SCRM domain and enriched with appropriate supply chain metrics is suggested in Sect. 3. The SCRIM model does not attempt to describe yet another model of Supply Chain Risk, but rather to offer a concrete structure incorporating the characteristics of the supply chain in the risk management process. In Sect. 4 experiments and results of model application are reviewed. Finally, Sect. 5 details the conclusions, limitations, and future directions regarding our conceptual model.

2 Supply Chain Risk Methodologies

SCRM has received during the last decade a considerable interest from researchers, practitioners and organizations. This led to the development of a plethora of different models and methods under the label of supply chain risk management and mitigation.

Drawing from the literature review, this section presents an analysis of the most common SCRM frameworks. Only methodologies and tools that define decompose and conceptualize risks or their constructs are selected. These latter has been investigated from a variety of aspects, summarized in the Table 1.

Table 1. SCRM Methodologies.
Full size table

Several common themes emerge from reviewing these methodologies. First, different kinds of methods, processes, models and approaches are identified in order, either to avoid future risks, or to mitigate the impact of identified risks. The extent to which the various approaches differ or complement each other is often unclear. The problem partly relies in the absence of common conceptual framework of supply chain risks. Many researchers viewed risk as a product of the probability of occurrence and severity of impact [12, 13]. According to this point of view, they establish that risk could be measured through the following formula:

$$ {\text{Supply Chain Risk }} = {\text{ Probability }}*{\text{ Impact}}. $$
(1)

This method of risk measurement has a well-established place in the supply chain risk management domain. 67 % scientific articles follow this formula [9, 14]. However, Williams [15] and Levi [7] demonstrated that “calculating risk as a probability-impact matrix to quantify and prioritize risks is misleading” [15]. Reference [16] affirm that risk analysis need not to use probabilities because these latter may be irrelevant. Dani et al. [8] have suggested that this simple calculation of supply chain risk need to be re-considered. Furthermore, they suggested also that companies need to use more appropriate measures for supply chain risks and to develop programs to manage the critical risks [5].

A second commonality among these methodologies is that they propose a guide for managing supply chain risks, including the following procedures: identifying sources of risk, evaluating and estimating the severity of consequences and damages, and providing the approaches to mitigating and managing these risks.

However, few methodologies or studies explore the key elements, dimensions or constructs for managing supply chain risks.

The ability to identify which dimension of a Supply Chain Disruption often significantly impacts the supply chain is a critical factor in managing this disruption [19–21] highlights the lack of a common tool to identify SCR and their interrelations within supply chain networks. They affirm that understanding dynamic development of risks and their causal factors are essentials for effective SCRM strategies, helping managers making the right decisions. According to their work, each SCR is not an isolated event. Moreover, these prior frameworks focus on formalized and sophisticated tools for SCRM [1]. Such frameworks are difficult to implement without mathematical expertise or specialized tools, focus on quantifying networks vulnerabilities, provide little insight into underlying risk mechanisms and do not facilitate including supply chain factors in risk ratings. [22] stated: “supply chain risk has been explored from one perspective, neglecting the sequences of various dimensions and constructs. Even methods that have taken into account the source-event relationship have failed to reflect the possible interactions among separated risk scenarios. Authors discussed the importance of studying the combination of diverse risks in the form of possible cause effects scenarios and made encouraging efforts”. Reference [23] highlighted the importance of a framework developed in the field of vulnerability studies and risk modeling. But he stressed the need for a common research structure that combines these two themes. According to [24], there are two main shortcomings related to the SCRM research, which are the missing of an integrated model that address the interactions between SCR factors and how this model can be integrated in the process of SCRM. Authors such as [21, 25–27] highlight the importance for gaining a more complete picture of SCR [17, 18] drawing the key variables, relationships, interactions and dynamic development of the SCR [28], down to revealing its impacts on the structure of the supply chain [19, 25, 29].

The study of these different methodologies highlights the need for specific model to address the main shortcomings identified, such as:

  1. 1.

    The need to capture the causal factors and the dynamic development of the Supply Chain Risk.

  2. 2.

    The impacts of mentioned risks on SC networks.

  3. 3.

    The need for a holistic and generic methodology for managing risks in the supply chain.

In order to address the issues identified, the SCRIM model is developed in Sect. 3.

3 Supply Chain Risk Integrated Model

The analysis of different methodologies is helpful in presenting several research explorations and orientations that have been used to provide a basis for our SCRIM model and depicted in Fig. 1. This model is mainly focused on the relationship between SC characteristics [30, 33] and risk dimensions and constructs [31, 32, 34]. In this section, the approach followed (see Fig. 1) in order to develop the SCRIM model is described. This approach improves the classical process of SCR model, with the appropriate SC metrics and Risks dimensions. Firstly, we started by investigating how risk is described, analyzed and modeled in the previous frameworks, in order to identify the main causal factors and to shed light over the development path of SCR. This analysis is incomplete without highlighting the SC networks vulnerability [21, 25]. So, a step is added regarding the modeling of the vulnerability factors. This step considered as a preparedness step that supply chain managers can apply in order to accelerate the risk analysis phase. These two previous steps “vulnerability and risk analysis” are combined and integrated into an alignment phase. The objective here is to present or measure the “Key Risk Indicators” (KRI).

Fig. 1.
figure 1

Approach for SCRIM model

Full size image

Another salient feature is the incorporation of “Integration step” into the traditional process of SCRM. During this phase, the characteristics of supply chain are integrated into the results of the previous step (response design and conception) and a suitable strategy is selected. As mentioned earlier, a variety of tools, approaches and strategies exist to mitigate or to prevent SCR [19, 35]. The choice inside this amount of frameworks is not easy and could present an important issue for managers [21].

In some cases, a wrong decision can aggravate the level of risk instead of mitigate it. References [34, 41, 42] highlight through their framework the impacts of SC design characteristics on the severity of SCR. However not only the structural characteristics of SC networks could affect risk management approach and strategy selection. References [38–40], have proved through their studies, that relationship dimensions between SC actors could influence the decision process and even the risk level and SCRM efficiency [45]. According to [5], the success of any SCRM strategy relies on the “SCRM culture” shared between SC entities. This could be achieved only through sharing knowledge and information about SCR. These two sharing mechanisms are concerned with three main SCM principles, which are collaboration [44, 45], trust [46, 47] and visibility [43, 48] within SC networks [49, 50].

As a result, when selecting one or more methods or actions for a given set of risks, one should also take into the account the capabilities. Any choice of SCRM method should not be made before verifying if the SC structure is compatible with the implementation requirements of the selected tool.

The SCRIM model is proposed as an enriched and integrated SCRM approach. Risk identification is the first and the crucial step in the risk management process. However, the nature and the complexity of the SC network make risk identification becoming a challenging task. Therefore, there is a need for a tool to assist organizations in identifying risk in their SC network. Given that, we suggest an interface for additional analysis of the SCR based on the alignment of two known steps: risk and vulnerability analysis. The interaction between these two phases allows to estimate and to calculate the Key Risk Indicators (KRI). New metrics and dimensions have been established to capture the complexities of SCR and to overview the classical description of risk as probability multiplied by impacts. Basing on the value of KRI, a panel of strategies and decisions could be opposed to the identified risks. In order to assess the decision process, an integration step was incorporated in the Risk Management process. This step helps to identify and prioritize the actions needed based on SCRM implementation capabilities.

The enriched and integrated SCRM approach can be decomposed into the following steps:

All these steps are supported by a class model detailing the parameters identified through the literature and depicted in Fig. 2.

Fig. 2.
figure 2

SCRIM class model

Full size image

The concepts presented, in the SCRIM class model, are considered as the most common key factors reoccurring amongst different SCRM frameworks and could be classified into three main subcategories:

  1. i.

    Concepts related to SCR: include the dimensions, metrics and the main attributes that are relevant to SCR analysis and could be used when defining and assessing risks:

    • Event: is defined as a negative change or outcome that causes deviation or disruption and triggers risks. It is characterized by the probability of occurrence.

    • Risk cause: is a description of how risk can be generated and propagated. It could be viewed as an associative entity between risk event and vulnerability.

    • Risk: is defined as one or more unforeseen events, with a probability of occurrence varies between o and 1, that have a financial, human, legal, managerial consequences (positive or negative), on logistics networks, ranging from, a probability of gain, to a failure of logistics organizations.

    • Key Risk Indicators (RKI): is a set of measures or indicators (NR: Negative Result, RPN: Risk Priority Number, TTR: Time To Recovery, EI: Exposure Index, TRI: Total Risk Impact, TTD: Time To Detection, DIU: Losses Impacts, DI: Detection Impacts) that could be used to evaluate the SCR and thus to define the appropriate risk mitigation strategies.

  2. ii.

    Concepts related to Supply Chain: It can be characterized by two elements: Elements used or exploited, leading to one or more risks, and elements which enable or contribute to risk treatment:

    • The vulnerability: is a characteristic of an entity or a system within the supply chain, which measure the sensitivity level to external or internal disruptive events. It can be assessed in terms of three attributes: Exposure (the extent to which an asset is exposed to risk), Sensitivity (degree to which the asset is affected) and adaptive capabilities (The ability of an asset to react or to adapt to unexpected event).

    • SCRM Capabilities: to manage risks in terms of objectives, requirements and constraints.

    • SC asset: could be viewed as the risk object. It can be a process, or a function, or an enterprise or a network within the supply chain.

  3. iii.

    Concepts related to mitigation and treatment process: describe the strategies, measures, actions and plans which have to be defined, studied and implemented in order to manage the identified SCRs.

4 Case Studies

This section describes one of the known SCR cases studies, used to test the usability of the SCRIM model in a real case study. The considered case study is the battery recall of Nokia India, one of the leader’s mobile phone manufacturers (see Fig. 3). Because overheating problems affecting battery during charging, Nokia announced the recall of batteries for its handsets from India markets. A total of 46 million batteries were recalled [36, 37].

Fig. 3.
figure 3

Nokia supply chain

Full size image

We followed the process described in Fig. 3 in order to identify the severity of situation that Nokia had to deal with it. From the first investigation, Nokia have detected the risk after two years of the first occurrence sign. Unfortunately, no prevention measures were applied. As result, Nokia has recalled 46 million handsets [37]. The first estimation of possible impacts was around 180 million dollars. Measuring the severity of this incident on the company’s performance, the classical formula (probability multiplied by impacts) was applied. But, the given results do not represent the critical situation that Nokia managers have to face. With the low value of the involved risk, the severity was high. So, another calculation logic was needed to: firstly represent the real severity of risk and secondly, to help managers to make the mitigation decisions. As result, we adopt the logic of “Key Risk Indicators” to overcome this shortcoming. Basing on the value of Key Risk Indicators, managers ought to mitigate the supply risk for two main reasons: risk is critical, and the affected asset is crucial for Nokia supply chain (following vulnerability analysis). But, what Nokia managers haven’t taken into account when they did apply their mitigation strategy is their implementation capabilities. This has led to decelerate the response time, from 15 days to 4 months [37]. Moreover in this case, Nokia was finally constrained to recall 46 million batteries leading to in depth modifications of schedules.

Based on the collected data from this case study and application of SCRIM model, the summary of the key results can be found in Table 2.

Table 2. Summary of the key results presented in Nokia case study.
Full size table

Table 2 illustrates the application results of SCRIM methodology to the Nokia’s case. With limited data, the analysis is reduced to few risk dimensions and supply chain metrics. The result was supported by a class diagram, with the objective of giving a simple, complete and holistic picture of supply risk within the Nokia supply chain. The class diagram representation is depicted in Fig. 4.

Fig. 4.
figure 4

Class diagram of supply risk within Nokia network

Full size image

5 Conclusion

SCRM is a critical process for the business continuity within supply chain. Nevertheless, most of the existing frameworks deal with this research as a two separated area. Another concern is the classical view of supply chain risk. There is a shortage of calculation and interpretation of risk. Most of the developed frameworks were typically structured around the probability of risk and the possible impacts of its occurrence. However, no indication for using this formula in order to assess SCR is given. To overcome these gaps, we have proposed the SCRIM model as an enriched and integrated risk management approach within supply chain networks. In order to achieve our objective, several steps, each associated with an intermediate objective, were adopted. This model is used in order to align supply chain risk dimension with supply chain characteristics required for a better understanding and managing of SCR.

Considering the risk dimensions, a set of measures or indicators (NR: Negative Result, RPN: Risk Priority Number, TTR: Time To Recovery, EI: Exposure Index, TRI: Total Risk Impact, TTD: Time To Detection, DIU: Losses Impacts, DI: Detection Impacts) is built and create a Key Risk Indicators (KRI) which encompass the usual measure: Probability * Impact. The SC side is fully part of the SCRIM as each asset has an impact on the Risk Profile. Particularly, the supply chain characteristics have a strong influence on the selection process for the mitigation strategies. Such a choice relies on the intrinsic risk management capabilities of the SC as a whole. Thus, the level of collaboration, information sharing and trust within such a supply chain has been pointed out as an improvement issue for the SCRM capabilities.

The usability of the SCRIM model is investigated referring to Nokia [36] as an application case study. The application of the proposed model on the Nokia case showed that the model could be used in order to identify and to evaluate the supply chain risks and for giving an overall picture of the risk exposure situation. In this case, the supplier risk was underestimated by Nokia and led to the use of a mitigation strategy and a reactive strategy of avoidance instead of a proactive one. An improvement of the SCRM capabilities may have reduced the final impact. In that sense, a better sharing of information and knowledge about the SC could have led to a new evaluation of the vulnerability in which the exposure was graded as low.

Unfortunately, this study is still very limited. First of all, it is only focused on the few factors of both risk and supply chain on purpose of simplicity. Other metrics may contribute to further development of the SCRIM model. Secondly, the main difficulty encountered in this study was the limited amount of data available in the literature regarding the case Nokia. This statement could be identified as a common point between other case studies we identified in the literature.

Thus, future studies and more empirical investigations may allow the SCRIM model to be deeply improved.