Workshop: Developing a Risk Management Plan

1. Workshop: Developing a Risk Management Plan This workshop was developed by the USAID | DELIVER PROJECT as part of its Risk Management Toolkit, which can be found at http://deliver.jsi.com/dhome/whatwedo/supplychainsys.

2. Activity 1: Workshop Introduction

3. Session Objectives By the end of the session, attendees will have— • learned the basic concepts of supply chain risk management • evaluated and prioritized supply chain risks by frequency of occurrence and degree of impact on operations • developed potential strategies for each risk.

4. Overview • What is supply chain risk management? • Why is supply chain risk management important? • Activity: Evaluate and prioritize risks • Supply chain risk management approaches • Activity: Draft risk management approaches • Debrief: form longer-term risk mgmt. plan.

5. Basic Components of Supply Chain Risk Management • Identify risk events: • Definition: Possible actions or outcomes with a direct negative impact on supply chain objectives • Range: Can completely disrupt the supply chain, or only cause delays in scheduled plans • not just theft or corruption. • Evaluate and prioritize risks • Create a supply chain plan to work through each risk, or group of risks.

6. Risk Management Schematic: Activities and Organizational Structure Participation: Initiating group + technical assistance + stakeholder collaboration Participation Learning • System evaluation • Planning and execution improvement Credit: USAID | DELIVER PROJECT 2013

7. Why Is Supply Chain Risk Management Important? • In private sector, risk management is proving beneficial for complex supply chains: global supply chain, multiple tiers of suppliers, critical components in products. • Success in public health setting—in Côte d’Ivoire, Mozambique, and others. • Enables collaboration and consensus building between stakeholders about supply chain issues and steps to address these issues.

8. Risk Management Case Study • Content from TO5/advocacy materials • Also, see appendix for some presentation material.

9. Activity 2: Risk Evaluation

10. Sources of Public Health Supply Chain Risk Credit: USAID | DELIVER PROJECT 2013

11. Risk Evaluation: Basic Approach Credit: USAID | DELIVER PROJECT 2013

12. Risk Evaluation: Group Instructions • Using a constructed list, group considers each risk. • Assign a group consensus score for frequency and impact of occurrence, including documentation. • Use a 1 to 4 scale for both frequency and impact; 1 is minimal impact or rare event, and 4 is certain occurrence in the next year or a system-wide disruption. • During plenary groups compare responses. • Adopt average or review each risk or select consensus score.

13. Processing Risk Evaluation Scores: Prioritization • Include graphic applications. • Adopt cutoff score. • Review list to ensure participants agree to accept lower priority risks.

14. Activity 3: Introduction to Supply CHain risk Management Approach

15. Risk Management vs. Conventional Management Approach Conventional Management Risk Management “What is our plan for when things go wrong?” Contemplates abnormal, previously unexpected, behavior and occurrences: prepares for these. Appropriate when managers lack sufficient control over operational-affecting factors. “How do we get our operations right?” • Assumes behavior and occurrences, within a specific narrow range, defined as normal: • prepares for these • Reacts to dysfunctions. • Appropriate when managers can sufficiently control operational-affecting factors.

16. Rating Scale Interpretations: Impact and Likelihood • Impact • Based on overall supply chain mission objective • Maximum rating should map to complete breakdown in supply chain mission • Minimum rating should map to mild deviation from mission. • Likelihood • Can be based on frequency in a specific time, e.g., a year or a month • Maximum rating should map to most frequent occurrence of risk events in supply chain • Minimum rating should map to the least frequent occurrence of risk events in the supply chain. • Template available in risk management toolkit to make explicit interpretations and create a reference for everyone working in risk evaluation.

17. Risk Feature Drivers • Risk feature drivers—aspects of health operations that affect the significance of risk event features: impact, likelihood, etc. • Can identify risk drivers for risk events—implies a better understanding of their mechanisms; helps improve consistency of risk-event evaluation. • Risk drivers— • specific to risk event, but different risk events can share the same drivers • help risk monitoring and performance monitoring.

18. Risk Management Schematic: Activities and Organizational Structure Participation: Initiating group + technical assistance + stakeholder collaboration Organizational Structure & Participation Learning • System evaluation • Planning & execution improvement Credit: USAID | DELIVER PROJECT 2013

19. Risk Management Approaches Credit: USAID | DELIVER PROJECT 2013 Accepting risk is the default approach.

20. Risk Management Approaches In particular, three features of the risk event can identify an appropriate risk response: • Is the source of risk controllable? • Is the source of risk operational? • Is the source of risk structural?

21. Risk Monitoring • Two types • Determine if risk features are changing • Confirm if original risk response plan is appropriate • Determine if risk event is impending • Receive advanced notice of events occurring and can respond to mitigate events. • Both types involve monitoring risk feature drivers; come from insights gained during risk evaluation and treatment. • Example: • Comparing the number of units ordered in a procurement cycle to a benchmark could be a leading indicator for whether an emergency order is likely to occur.

22. Options for Risk Performance Monitoring • Supply chain performance management tends to focus on indicative/strategic key performance indicators—How are we generally doing?—not diagnostic outcomes—Why are we performing the way this way? • Indicative/strategic metrics may not capture low likelihood or low impact events; they tend to be affected by a range of risk events. • Additional options for risk performance monitoring: • diagnostic metrics in operational areas • risk drivers • simulated/forecasted performance • changes in risk features • effect of risk event.

23. Examples of Performance Monitoring from TO5 Case Study • Diagnostic metrics • Simulated performance • For risk treatment, planners would estimate the changes in risk features as a result of planned risk response. Credit: USAID | DELIVER PROJECT 2013

24. Activity 4: Drafting Risk Management Approaches

25. Exercise: Draft Risk Management Approaches • Functional groups addressprioritized risks. • Consider available options, draft potential plan. • Use Risk Evaluation and Treatment template from risk management toolkit.

26. Debrief: Form Long-Term Risk Management Plan • Develop timeline for completing management approaches. • Do a periodic review.

27. Appendix

28. Appendix Risk Management Case Study: Procurement Task Order for USAID | Deliver Project

29. Risk Management Case Study • Context • Task order for procuring and distributing essential public health supplies • Objective: Achieve a targeted delivery-to-promise goal of 95%. • Implementation • Workshop exercise at end of 60 days • Risk identification, evaluation, and some risk treatment planning. • Risk treatment plans further developed and implemented after workshop.

30. Drivers for Risk Management Approach • USAID-mandated task order deliverable • Approach was expected to be generally beneficial • Prevent issues from being lost during planning. • Help prioritize resources. • Enable stakeholders to objectively come to agreement about which issues to focus on. • Perception that stakeholders did not agree on what mattered. • Could help develop consensus: bring partners together, harmonize expectations, align partners.

31. Risk Identification and Evaluation • Risk identification: • List of risk events based on experience; validated with other partners. • Risk evaluation: • 10-point scale • severity • occurrence • detection of failures—not considered as applicable to supply chain. • Risk probability number = severity × occurrence × detection: • Threshold of 100 for dealing with risk; some sensitivity analysis around threshold.

32. Risk Treatment Process • Development of plans to address risks: • Workshop produced initial plans • collaborative process. • Small groups returned and refined management approaches • people with relevant experience in risk areas who exceeded threshold. • Circulated to wider team for validation; small teams were implementers. • Plans: • responsibilities and timelines • effect on risks; estimated revision of risk profile number • specific to products.

33. Risk Treatment Example: Product Registration • Risk analysis and evaluation • Objective seriously harmed if product not properly registered and unable to enter country. No single solution works across all countries. • Risk treatment • Preventive actions • product registration requirements in RFPs • due diligence with potential manufacturer prior to contract award • product registration technical assistance. • Strategies on occurrence • formalize core registration team to work on problem. • Impact reduction • transition plans using available products. • Risk communication • ongoing among all stakeholders.