Operational resilience through supply chain and business process mapping

Over the last two years, ongoing disruptions from the COVID-19 pandemic to supply chain disruptions caused by the Suez Canal blockage to ransomware attacks on critical infrastructure (as seen in the Colonial Pipeline attack) have disrupted the daily operations of businesses across the globe. It became apparent that it was no longer a case of “if” the next disruption would occur but rather “when.” As a result, the need for robust operational resilience has never been more critical, writes Bogdana Sardak, Senior Director of Risk & Resiliency, Fusion Risk Management.

Most recently, the geopolitical crisis in Ukraine demonstrates the need for agile, resilient businesses that can make data-driven decisions. The situation in Ukraine displays the multilateral effects of disruption: we have already seen the crisis affect personnel safety, the economy, supply chains, and vendors. As an ongoing crisis, the impact is still evolving, and businesses need to assess the current and potential future effects on their organisation.

Operational resilience is a crucial component of ensuring your business is prepared to respond to disruptions in an instance. True operational resilience gives organisations the tools to understand operational data points and locations, empowering critical decisions at a moment’s notice. This enables businesses to pivot and adapt as needed to minimise or eliminate the effects of disruption on business as usual.

Mapping Business Processes

Fully understanding how your business operates is the first step to ensuring resilience. Mapping business processes allows complete visibility into the inputs, outputs, and dependencies within your organisation. Business processes do not exist in silos; they often rely on people, technology, facilities, third parties, and other supporting resources. Fully understanding, mapping, and compiling data on these intertwined dependencies can help your organisation better comprehend the potential impact of events. Further, it can help make the required decisions to minimise impact and continue business as usual in times of disruption or change. But where should you begin?

Identifying your end goal from the start is vital. You must understand what you want to achieve by mapping business processes – you do not want to simply go through the motions and check a box. Some may wish to map business processes to maximise efficiency, to ensure adequate resource distribution, or as a proactive step for resilience. During the operational resilience journey, mapping allows you to identify gaps and vulnerabilities in your organisation, applications, or vendors which support critical products or services of your organisation. Once you have identified the weak links within your organisation, you can mitigate identified risks to strengthen your business, services, and products.

Once you identify why you want to map business processes, begin gathering data and information to construct your approach roadmap. Mid-size and larger enterprise organisations likely have in-house business continuity or resilience teams tasked with performing a business impact analysis (BIA); a process excellence team; or an IT business partner group which might have solid data to leverage for process identification. Smaller organisations may have part-time personnel who are tasked with performing process mapping. Another good resource to use to start the resilience journey is to ask for an org chart from HR and start looking at team structure as well as performing interviews with functional leaders.

It is also critical to look at the big picture. Before speaking to different business functions and departments, it is helpful to identify your organisational services and products that are being delivered to the customer. In a smaller organisation, this can be a single product. In larger organisations like a bank, there are numerous services and products, including the process of cash withdrawals, wealth management, lending, payments, and more. The size of your business does not matter. Identifying the products and services that you deliver to customers allows you to be able to map the end products first and then work your way down through the organisation to know how each independent process plays a role in delivering the end products or services to customers.

You can start from the top or bottom of your organisation to begin the mapping process. The top-bottom approach would start at C-level executives whereas the bottom-up approach may begin at individual departments/teams. Throughout each level of your business, you will map business processes to the service or product it contributes to. Once you start to map processes, you will also want to map dependencies such as applications. When engaging with teams, ask them what applications or programs are needed to perform their tasks, what teams they interact with, and if there are any cross-organisational dependencies required to fulfil their inputs and outputs. This will enable the mapping of dependencies across vendors, sites, and people that support a specific process and, therefore, support the product or service to customers. Visualising in this manner allows you to see what would occur if a business process broke or an application went down. You can see the escalating effect on the process and how it plays into service delivery to customers.

Mapping business processes in this organised manner can enable swift action when long- or short-term disruptions hit an organisation. A thorough understanding of how your business processes work gives you the tools to put the pieces back together in the event of a disruption. While business process mapping starts within your organisation, it extends to external dependencies, including vendors, supply chain, applications, and physical sites that support your daily business functions.

Supply Chain Mapping

Once you have mapped out your business processes, you can determine exactly which processes are vital to your ability to deliver on your customer promise. You can also identify what vendor dependencies exist for these critical processes to function. These vendor dependencies are the first stage of mapping your supply chain.

In today’s highly globalised society, no organisation exists in a vacuum – we rely on vendors and providers to preform business processes. It does not need to take a disruption directly affecting your organisation for your business to feel the impact. Disruptions that affect your vendors can cause a ripple effect down the supply chain and indirectly impact your business, hindering the applications that your internal teams require to fulfil their needed business function.

When mapping business processes, it is essential to determine the criticality level of each vendor to its associated business process. From there, look to your internal organisation and assess the current maturity level of your supply chain and vendor management program. If you have already determined your critical third-party vendors, see if your organisation has mapped out its fourth- and fifth-party suppliers. While your business may not engage with these suppliers regularly, any disruption that affects the vendors can have an indirect negative effect on your ability to deliver products and services to customers. Mapping fourth- or fifth-party suppliers may be slightly more complicated than mapping your third-party vendors, so be sure to engage with your third-party vendors and ask questions. This will enable your organisation to visualise gaps and vulnerabilities throughout your third-party vendors’ supply chains.

During the mapping process, there are several key points to look out for. Ask yourself: “Do many of our third parties rely heavily on one fourth-party vendor?” and “Do all of our third parties exist in the same geographic location?” These questions can allow you to select third parties that enable risk diversification. If many of your third parties rely on the same fourth-party vendor, a disruption that affects that singular vendor can halt services to your third-party vendor, thus inhibiting your business’s ability to perform critical processes. Diversifying your vendor risk, even if that means using numerous providers, can mitigate the effects of a single pain point that causes the dominos to topple and affect your business.

While it is good to diversify your vendors to reduce risk, you must also know how to diversify effectively. Location can play a significant role in diversification. Some localities may be more susceptible to natural disasters or political volatility, whereas (in less extreme circumstances) a wide blackout or internet outage can halt services in a specific locality for some time. It is in your best interest to diversify vendors across wide geographic regions and establish the same expectations for your fourth- and fifth-party vendors. This can ensure that a predictable or unpredictable disruption will not cause an outage to many of your critical vendors, thus inhibiting your ability to deliver services.

No matter how diversified or prepared your third-party supply chain is to handle disruptions, unpredictable situations can happen at a moment’s notice, which is why it is critical to have recovery strategies and business continuity plans for when business as usual halts. This can come as having an additional provider on retainer or a list of providers who can quickly adapt to meet your business needs if your primary supplier experiences an outage.

Achieving Resilience

True resilience includes having the data on hand to respond in any situation. No matter what industry or market you operate within, having your business processes and supply chain data points mapped out prepares your business to respond seamlessly. Gathering the data points and maps proactively before disruption hits your organisation allows for planning and preapproval of the necessary precautions if the worst-case scenario occurs.

Understanding business processes and supply chain maps is the first step to achieving resilience. Once you have identified critical processes and critical vendors, you must proactively plan for when business as usual comes to a halt. Critical processes require people, applications, sites, and suppliers that enable an organisation to fulfil its brand promise to customers under normal conditions. Unfortunately, normal conditions are not guaranteed, but achieving resilience can eliminate a single point of failure for your business.

Beyond the data, you must also aim to instil a culture of resilience within your organisation. Building a culture of resilience means that everyone understands their role within the organisation and can prioritise resilient decisions in their daily business operations. When working with your coworkers throughout the process of mapping business processes and supply chains, it is an excellent time to begin engaging people across departments and teams on the journey toward resilience.

As you engage with people throughout the process, ask questions and help them understand the more significant role they play in the brand’s ability to deliver products and services. Within your business, people may not be aware of precisely what risks they have control over; therefore, it is critical to explain risk at all levels of the organisation (from the C-suite down to the associates) using the maps you created. This can allow people to see how disruptions caused within their business processes can cascade down and cause an effect in other areas of the business, ultimately creating a business-wide impact. Therefore, data collection is integral to being both a resilience leader, advisor, and educator within your business to ensure resilient operations.

Looking Ahead: Prepare to Pivot and Adapt

Over the last two years, we have experienced wide-ranging crises that have affected almost every organisation in some way. We should recognise that disruptions are here to stay, and it’s no longer a question of “if” another crisis will occur but rather a matter of “when.” Never has it been more critical for a business to be able to pivot and adapt to any disruption.

Mapping business processes and your supply chain as well as educating employees offers your organisation the ability to achieve resilience. When a disruption does occur, there is no need to panic because you took the time to proactively gather data points and plan for future disruption. Creating a culture of resilience can minimise the impact of disruption on your business and give your employees the knowledge they need to make informed decisions in the face of crisis.

As we continue to realise, crises evolve by the minute. The landscape an organisation exists in today may change by tomorrow. Times of crisis elevate the need for operational resilience as businesses must flex and adapt to new developments. Over the last two years, ongoing disruptions have shown that if you have not yet begun your journey toward operational resilience, the best time to start is now. With the adequate and accurate data and plans in hand from business process mapping, supply chain mapping, and proactive programs, businesses can focus on the health and safety of their employees.