Resiliency Track Readout

August 2009

Objective and Scope

• Objective:– To share best practices in supply chain resiliency

• Track Scope:Product, Supplier and Physical Network Resiliency– Planning and Implementation for: Existing and New

Products, Existing and New Suppliers, Existing and New Networks/Network Design

• Out of Scope:– Product Quality Process– S&OP (sales and operations planning)

Resiliency Planning• Understand your supply chain

Resiliency Planning

• Setting Objectives, Targets and Establishing Resiliency Metrics

1. BP firms have a method to determine which elements of the supply chain and the product pose the most risk• BP firms utilize supply chain ‘value stream

mapping’ to understand the node-network• BP firms have the ability to map their locations,

supplier locations, customer locations globally

Resiliency Planning

Item 1 Examples:• CISCO: Leverage the BCP Program to collect Time To Recover

for Partner Manufacturing and Logistics sites and for single/sole sourced components.

• GE Energy Infrastructure: Determine single/sole source suppliers, identify which of those components are critical to the product/customer, identify components with unique/rare raw materials. Launch a Risk Assessment questionnaire for internal suppliers. External suppliers get a BCP questionnaire that ranks their Resiliency. This information is used to identify suppliers both internal and external that are at high risk.

• Genentech:

GENENTECH

Identify Product Contingency Options and Network Risk Inventory3

Identify Supply Chain Current State and Assumptions

Assess Operational Process Risk

Identify Product Contingency

Options

Assess Risk/Benefit and Provide

Recommendations

1 2 3 4

Step 1: Calculate network risk inventory needed per each manufacturing process in the event of an outage at the primary site:

Bulk Outage

Primary Site 18 weeks outage 6 w

Start-UpTime

10 wks

Bulk Cycle Time

7 wks

Fill/PackCycle Time

41 weeks

Fill Outage

Primary Site 15 wks outage 4 w

Start-Up Time

7 wks

Fill/PackCycle Time

26 weeks

Network Risk Inventory for bulk outage: 41 weeks DS or DP

Network Risk Inventory for fill outage: 26 weeks DP

Pack Outage

Primary Site 13 w outage 4 w

Start-Up

2

PackCycle Time

19 weeks

Network Risk Inventory: 19 weeks DP

Definitions:• DS: Drug substance / DP: Drug product (packaged units)• Start-Up: Time needed to change over equipment, modify

schedule, and/or seed train development time

CISCO BCP Program

Resiliency Planning

2. Best Practices firms can identify the consequences of making optimal risk choices and acceptable mitigations for known risks.– Revenue, brand impact, or market value – Proven methodology for choosing what to mitigate– Regular management review and approval of risk

mitigation investments– Budget allocated for risk mitigation and manage a

portfolio of risk mitigation projects and programs to improve resiliency

– Consistent method of measuring resiliency across their organization.

Resiliency Planning

Item 2 Example:• CISCO: Resiliency Index

Implementation and Operation

1. Process and program to drive resiliency projects across Products/Services, Suppliers and the Supply Chain

– Program ownership of risk mitigation projects (both internally and externally)

– Process in place to validate supplier responses (Validate Site Time to Recover, Validate Part Time to Recover)

– Partnerships with customers to ensure demand signals are comprehended into capacity planning

Visibility and influence the Product Lifecycle• Ability to know if past mitigation strategies are changing as part of

the routine Engineering Change Control or a Supplier’s decision

Implementation Example

• FedEx: – Resiliency is enabled through excess

capacity/redundancy to account for operational and non operational issues.

– Capacity Planning to include further levels into the supply chain (mother’s day flower delivery). Partner with the customers shipping to ensure there is resiliency by sharing and having an understanding of the customers demand needs and FedEx’s ability to deliver.

Final Thoughts

• Interdependencies– BCP, Risk Measurement

• Tiered Approach to Implementation– Different sets of minimum requirements depending on

the complexity and size of the business; Example: Tier 1 = Self BCP, Tier 2 = Self BCP and Vendor BCP

• Phased Implementation– Choose which products or elements of the supply

chain apply for certification, i.e. new products