RIMS 2014

1. RIMS 2014 Building a Resilient Supply Base in Response to Global Shifts Business Continuity Management April 28, 2014

2. Globalized service and product sourcing increases the need for vendor resiliency management $3.2b Average Fortune 500 loss in market cap as result of a reported disruption** * Source: Business Continuity Institute, 2011-2012 ** Source: World Economic Forum; PwC analysis • 8% • Companies confirming all key suppliers had business continuity programs in place to manage disruptions* • 85% • Companies reporting a supply chain incident or disruption during the year* 40% Companies reporting a supply chain incident or disruption, where the disruption occurred below tier 1 suppliers* 44% US companies who considered supply chain disruption in business continuity programs*

3. What companies are saying? Different operations are focused on their own priorities and I do not have an end-to-end view of our supply chain’s resiliency. We are being regularly hit with disruptions and rarely see them coming. We don’t have a good understanding of our place in the supplier’s customer prioritization stack. We are definitely managing supplier risk, but I don’t think we are managing supply chain risk across all possible dimensions. If we are having difficulty understanding our key suppliers’ resiliency, I can only image how difficult it is for them to do the same with their critical suppliers.

4. Challenges and the Path to Effective Vendor Resiliency Management • Balancing efficiency with resilience in the face of continuing volatility and heightened uncertainty. • Continued growth in operations complexity and economic-induced supply/demand volatility, as well as increasing vulnerability of networks to disruptive events • Limited visibility to vendors, networks and products across the supply chain • Limited internal supply chain risk and resilience resources Map the Vendor Risk Landscape Vendor Resiliency Prioritization Understand Resiliency Integration Needs Validation Respond

5. Map the Vendor Risk Landscape • If your company has a business continuity program, there should exist a current Business Impact Analysis (BIA). The BIA provides a detailed, foundational view of how interruption events (e.g., loss of technology, reduction in personnel, loss of facilities, and loss of third parties) can impact the organization. • These third parties include supply chain participants, service organizations, technology support providers, HR process enablers, financial intermediaries, and a multitude of external organizations critical to your operations. • The BIA answers two important vendor resilience management questions: • Which vendors will have the most impact on my organization if they suffer an interruption, and how quickly will the impact materialize? • How do my potential crisis recovery strategy involve my critical vendors?

6. Vendor Resiliency Prioritization • Not all critical vendors are equally important to the organization, and not all customers are equally important to those vendors. Taking a risk-informed approach, the following selection criteria can help identify the most critical vendors: • Revenue and inventory impact from loss • Proximity of the vendor and logistics • Capacity utilization (performance and capacity of the vendor) • Service level agreements and right to audit • Potential impact on service/product quality during rapid vendor changes • Exposure to labor, country, and geopolitical risks • Level of vendor integration with your technology • Correlated risk (natural and man-made hazards, geographic concentration, availability, and reliability) amongst individual and clustered vendors • Regulatory exposure and cross-border issues

7. Understand Your ResiliencyIntegration Needs • The best comfort comes from assessing the quality of the vendor’s resiliency and recovery capabilities in areas that are integral to your organization’s operational resilience. This information is documented within the organization’s BIA and should include, at a minimum: • A list of the goods and services provided by the vendor • A list of the processes within your organization that consume the vendor’s outputs, or rely on a vendor to complete the service/product delivery cycle • A description of where the vendor’s activities are geographically performed • A determination of the point at which a vendor interruption crosses the threshold of criticality • A description of possible regulatory impacts from a vendor’s lack of resiliency • A description of the vendor’s role during an interruption and business process recovery

8. Validation • Once critical vendors have been risk-ranked and resiliency questions developed, the process of obtaining and validating the vendor’s resiliency and recovery capabilities begins. The following are six best practices that will aid your vendor resiliency interaction and analysis: • Ensure that the majority of your resiliency inquiry communications with the vendor originate from the individual who owns the vendor relationship. • Your point person should speak directly with the individual responsible for maintaining the vendor’s resiliency and continuity program. • Enlist the vendor as a resiliency partner, since interruption events at either end of the relationship continuum will affect both parties. • Obtain relevant portions of the vendor’s BIA and Risk Assessment. • Use a tailored version of international business continuity standards as a basis for vendor inquiries. • Have the vendor describe its response to a prior potential or actual crisis event. Ask for the impact thresholds where they would contact customers in advance of, or immediately after, a crisis event.

9. Respond • The final vendor resiliency management program phase is responding to the vendor’s resiliency. Critical vendor interruption risk reduction strategies can include: • Maintaining higher inventory levels for at-risk items • Collaborating with the vendor to improve its resiliency • Creating limited “backup” vendor relationships that can be activated quickly • Implementing more robust business continuity practices for the affected business processes • Replacing the less resilient vendor to reduce risk. • Conclusion • To achieve comfort around vendor resiliency and recoverability, it’s all about transparency, asking the right questions and pushing the right levers. The more foreknowledge you have — about your own needs, the capabilities of your vendors, and the robustness of your resiliency plans — the more comfort you’ll have. • For detailed information about PwC’s approach to Vendor Resiliency Management, please stop by our RIMs booth for a copy of ‘Business continuity beyond company walls: When a crisis hits, will your vendors’ resiliency match your own?’ by PwC’s Performance GRC practice.

10. About Your Presenters • Phil Samson is a Principal in PwC's Performance Governance, Risk and Compliance practice responsible for leading Business Continuity Management services in the US. • Over 28 years of experience in serving the operational and technology risk management needs of his clients and has 20 years of experience assessing, designing, implementing and testing business continuity and crisis management programs. You can listen to one of Phil's podcasts on business continuity which can be found at http://www.pwc.com/us/en/increasing-it-effectiveness/podcasts/business-continuity-management.jhtmland read about PwC's perspective on business continuity at http://www.pwc.com/us/en/10minutes/business-continuity-management.jhtmlwhich is also available as an iPad or Android app. • Neil Kaufman is a director in PwC’s Performance GRC Business Continuity Management (BCM) practice. • Neil has over 21 years of management consulting, operational and crisis communications experience (business, technology and operations) across multiple industries . He has designed, led and overseen delivery of hundreds of plans and table top exercises across senior leadership teams and business functions for his clients. • Neil is 2013's "Consultant of the Year" in the Awards of Excellence Program from The Disaster Recovery Institute International (DRII). He has published articles on Business Continuity Planning solutions and concepts and their real world applications. Neil is a Certified Business Continuity Professional (CBCP). • Thank you