Operational Resilience Through Supply Chain and Business Process Mapping

Over the last two years, ongoing disruptions from the COVID-19 pandemic to the Suez Canal blockage’s effect on supply chains to ransomware attacks on critical infrastructure (as seen in the Colonial Pipeline breach) have impacted the daily operations of businesses across the globe. It became no longer a question of “if” the next disruption would occur, but rather “when.” As a result, the need for robust operational resilience has never been more critical.

The geopolitical crisis in Ukraine demonstrates the need for agile, resilient businesses that can make data-driven decisions. It displays the multilateral effects of disruption: We have already seen the Ukraine crisis affect personnel safety, the economy, supply chains and vendors. The impact is still evolving, and businesses need to assess the current and potential future effects on their organization.

Operational resilience is a crucial component of ensuring that a business is prepared to respond to disruptions in an instant. True operational resilience gives organizations the tools to understand operational data points and locations, empowering critical decisions at a moment’s notice. This enables businesses to pivot and adapt as needed to minimize or eliminate the effects of disruption on business as usual.

Business Process Mapping

Fully understanding how a business operates is the first step to ensuring resilience. Mapping business processes allows complete visibility into the inputs, outputs and dependencies within your organization.

Business processes do not exist in silos; they often rely on people, technology, facilities, third parties and other supporting resources. Fully understanding, mapping and compiling data on these intertwined dependencies can help your organization better comprehend the potential impact of events. Further, it can help make the required decisions to minimize impact and continue business as usual in times of disruption or change.

But where to begin?

Identifying the end goal from the start is vital. You must understand what you want to achieve by mapping business processes – you do not want to simply go through the motions and check a box. Some may wish to map business processes to maximize efficiency, to ensure adequate resource distribution, or as a proactive step for resilience.

Process mapping begins internally and extends to external dependencies, Bogdana Sardak writes.

For the operational resilience journey, mapping allows you to identify gaps and vulnerabilities in your organization, applications, or vendors which support critical products or services. Once you have identified the weak links within the organization, you can mitigate identified risks to strengthen the business, services and products.

Once you identify why you want to map business processes, begin gathering data and information to construct your approach roadmap. Mid-size and larger enterprise organizations likely have in-house business continuity or resilience teams tasked with performing a business impact analysis (BIA); a process excellence team; or an IT business partner group which might have solid data to leverage for process identification.

Smaller organizations may have part-time personnel who are tasked with process mapping. Another good resource for starting the resilience journey is an org chart from HR, and to start looking at team structure as well as performing interviews with functional leaders.

Top-Down or Bottom-Up

It is also critical to look at the big picture. Before speaking to different business functions and departments, it is helpful to identify your organizational services and products that are being delivered to the customer. In a smaller organization, this can be a single product. In larger organizations like banks, there are numerous services and products, including the processes of cash withdrawals, wealth management, lending, payments and more.

The size of the business does not matter. Identifying the products and services that you deliver to customers allows you to be able to map the end products first and then work your way down through the organization to know the role each independent process plays in delivering the end products or services.

You can start from the top or bottom of the organization to begin the mapping process. The top-to-bottom approach would start with C-level executives, whereas bottom-up may begin at individual departments/teams. Throughout each level of your business, you will map business processes to the service or product they contribute to.

Once you start to map processes, you will also want to map dependencies such as applications. When engaging with teams, ask what applications or programs are needed to perform their tasks, what teams they interact with, and if there are any cross-organizational dependencies required to fulfill their inputs and outputs. This will enable the mapping of dependencies across vendors, sites and people that support a specific process and, therefore, support the product or service to customers.

Visualizing in this manner allows you to see what would occur if a business process broke or an application went down. You can see the escalating effect on the process and how it plays into service delivery to customers.

Mapping business processes in this organized manner can enable swift action when long- or short-term disruptions hit. A thorough understanding of how your business processes work gives you the tools to put the pieces back together in the event of a disruption. While business process mapping starts within your organization, it extends to external dependencies, including vendors, supply chain, applications and physical sites that support daily business functions.

Supply Chains

Once you have mapped out your business processes, you can determine exactly which processes are vital to your ability to deliver on your customer promise. You can also identify what vendor dependencies exist for these critical processes to function. These dependencies are the first stage of mapping your supply chain.

In today’s highly globalized society, no organization exists in a vacuum. We rely on vendors and providers to perform business processes. It does not need to take a disruption directly affecting your organization for your business to feel the impact. Disruptions that affect vendors can cause a ripple effect down the supply chain and indirectly impact your business, hindering the applications that your internal teams require to fulfill their needed business functions.

When mapping business processes, it is essential to determine the criticality level of each vendor to its associated business process. From there, look to your internal organization and assess the current maturity level of your supply chain and vendor management program.

If you have already determined your critical third-party vendors, see if your organization has mapped out its fourth- and fifth-party suppliers. While your business may not engage with these suppliers regularly, any disruption that affects the vendors can have an indirect, negative effect on your ability to deliver products and services to customers. Mapping fourth- or fifth-party suppliers may be slightly more complicated than mapping third-party vendors, so be sure to engage with and ask questions of the third parties to visualize gaps and vulnerabilities throughout their supply chains.

During the mapping process, there are several key points to look out for. Ask yourself: “Do many of our third parties rely heavily on one fourth-party vendor?” “Do all of our third parties exist in the same geographic location?” These questions can allow you to select third parties that enable risk diversification.

Fourth-Party Pain Point

If many of the third parties rely on the same fourth-party vendor, a disruption that affects that singular vendor can thus inhibit your own ability to perform critical processes. Diversifying vendor risk, even if that means using numerous providers, can mitigate the effects of a single pain point that causes the dominos to topple.

While it is good to diversify your vendors to reduce risk, you must also know how to diversify effectively. Location can play a significant role in diversification. Some localities may be more susceptible to natural disasters or political volatility, whereas (in less extreme circumstances) a wide blackout or internet outage can halt services in a specific locality for some time.

It is in your best interest to diversify vendors across wide geographic regions and establish the same expectations for fourth- and fifth-party vendors. This can ensure that a predictable or unpredictable disruption will not cause an outage to many of your critical vendors and inhibit your ability to deliver services.

No matter how diversified or prepared your third-party supply chain is to handle disruptions, unpredictable situations can happen at a moment’s notice, which is why it is critical to have recovery strategies and business continuity plans for when business as usual halts. This can come as having an additional provider on retainer or a list of providers who can quickly adapt to meet your business needs if a primary supplier experiences an outage.

Achieving Resilience

True resilience includes having the data on hand to respond in any situation. No matter what industry or market you operate within, having business processes and supply chain data points mapped out prepares you to respond seamlessly. Gathering the data points and maps proactively, before disruption hits, allows for planning and pre-approval of the necessary precautions if the worst-case scenario occurs.

One you understand critical processes and identify critical vendors, you must proactively plan for when business as usual comes to a halt. Critical processes require people, applications, sites, and suppliers that enable an organization to fulfill its brand promise to customers under normal conditions. Unfortunately, normal conditions are not guaranteed, but achieving resilience can eliminate a single point of failure.

Beyond the data, you must also aim to instill a culture of resilience. That means everyone understands their role within the organization and can prioritize resilient decisions in their operations. When working with co-workers throughout the process of mapping processes and supply chains, it is an excellent time to be engaging people across departments and teams on the journey toward resilience.

Ask questions and help them understand the more significant role they play in the brand’s ability to deliver products and services. People within a business may not be aware of precisely what risks they have control over; therefore, it is critical to explain risk at all levels of the organization (from the C-suite down to associates) using the created maps. This can allow people to see how disruptions caused within their business processes can cascade down and have effects on other areas of the business. Therefore, data collection is integral to being both a resilience leader, advisor and educator within your business to ensure resilient operations.

Prepare to Pivot and Adapt

Over the last two years, wide-ranging crises have affected almost every organization in some way. We should recognize that disruptions are here to stay. Never has it been more critical for a business to be able to pivot and adapt to any disruption.

Mapping business processes and supply chains as well as educating employees offers the ability to achieve resilience. When a disruption does occur, there is no need to panic, because you took the time to proactively gather data points and plan for future disruption. Creating a culture of resilience can minimize the impact of disruption on a business and give employees the knowledge they need to make informed decisions in the face of crisis.

We have come to realize that crises evolve by the minute. The landscape an organization exists in today may change by tomorrow. Times of crisis elevate the need for operational resilience, as businesses must flex and adapt to new developments. Over the last two years, ongoing disruptions have shown that if you have not yet begun your journey toward operational resilience, the best time to start is now. With adequate and accurate data and plans in hand from business process mapping, supply chain mapping and proactive programs, businesses can focus on the health and safety of their employees.

Bogdana Sardak is senior director of risk and resiliency at Fusion Risk Management, leading the company’s operational resilience program. She has worked in the risk and resilience field for the past seven years, gaining experience in business continuity, crisis management, disaster recovery, emergency response and third-party risk management. She is an associate member of BCI (AMBCI) and a Certified Information Privacy Professional/US.