Risk Management is the structured process by which an organization identifies, assesses, and responds to risks that threaten operational continuity. Today, it is no longer the prerogative of specialists: it is a managerial tool that determines an enterprise’s ability to compete even in adverse conditions.
In recent years, companies have learned, often the hard way, that operational continuity can no longer be taken for granted. Shortages of critical materials, unavailability of suppliers, disruptions in supply chains, cyberattacks, market volatility, geopolitical tensions, skills crises: what was once considered an exceptional event is now part of the daily competitive landscape.
The data confirm this. According to our biennial Benchmarking Study | What’s next in Operations? — conducted on over 100 companies in 22 industry sectors, with a sample composed for 85% by C-level executives and for 83% by companies with more than 100 employees, predominantly B2B (87%) — only 55% of the companies have implemented Business Continuity systems. The average Supply Chain Maturity Level stands at 67%, indicating widespread fragility in terms of responsiveness and digitalization, with a strong reliance on manual processes and difficulties in managing demand fluctuations and supply issues.
The real question, then, is not whether an interruption will occur, but how prepared the company is to prevent it, manage it, and overcome it.
One of the most common mistakes in organizations is treating risk as an ancillary variable to be covered with a generic "unforeseen" fund or to be addressed only when it emerges. This is a convenient but dangerous approach. An amorphous economic reserve does not replace a prevention system and, above all, it does not build organizational capacity.
Managing risk effectively means making a cultural shift: recognizing that business continuity does not coincide with simply reacting to an incident, but with the ability to prepare in advance what is needed to continue operating even in adverse conditions.
A reactive approach leads to decisions made under pressure, unforeseen costs, eroded margins, delays, penalties, and reputational damage. The preventive approach, on the other hand, allows for assessing threats in advance, building coherent countermeasures, reducing the likelihood that the event will occur, and limiting its impact if it does. In other words: it is not just about defending against risk; it is about managing it.
If operational continuity is a cross-functional responsibility, it is in procurement that many critical issues become decisive. Procurement is no longer a purely transactional function: it is a strategic lever that directly impacts the company’s ability to ensure service, quality, flexibility, and economic sustainability.
Contemporary supply chains are more extensive, more interconnected and more vulnerable. The outsourcing of non-core activities, the pressure on lead times, increasing customization, the complexity of logistics, dependence on distant markets, and the financial fragility of some suppliers have greatly expanded the scope of the supply risk.
This is added to factors that are difficult to control: price variability, currency fluctuations, regulatory changes, environmental events, geopolitical tensions, and cyber risk. All of this requires a profound review of the way in which the base of suppliers is designed, evaluated, and governed. It is no longer enough to look for the best price: it is necessary to understand which supplies are truly critical, where vulnerabilities are concentrated, and where to balance efficiency and robustness.
Supply chain resilience is now a choice of organizational and strategic design.
A common mistake is to think of supply risk management as a problem limited to the availability of material. In reality, the risks that impact business continuity are multiple and interdependent:
The managerial challenge is to stop reading risk as an isolated event and start reading it as a system.
To make risk management truly useful to Operations, a method is needed. An effective approach does not just focus on capturing risk; it also guides the organization through a structured process in five phases:
🎬 Do you want to see these 5 steps applied in a concrete way?
Watch the Digital Talk on Demand by Bonfiglioli Consulting: Business Continuity System for an Antifragile Supply Chain.
Access the free video →
One of the most important contributions of risk management is introducing priority criteria. Not all risks deserve the same level of attention or the same level of investment.
A qualitative assessment matrix allows for the intersection of two fundamental dimensions: the probability of occurrence and the severity of the impact. It is an essential step that enables the organization to distinguish between risks that can be monitored through routine management, risks that require periodic attention, and risks that require proactive plans and frequent interventions.
But evaluation cannot stop at internal perception. Market information, external sources, historical data, price data, exchange rate movements, sector intelligence, and predictive models are needed. In an unstable context, the quality of decisions also depends on the quality of the signals that the company is able to detect. For this reason, Procurement must evolve towards a Business Intelligence logic: not only managing the order, but interpreting the context.
Not all items and not all suppliers have the same weight in the business. Continuing to manage them with uniform logic means wasting attention where it is not needed and underestimating what is truly critical.
The Kraljic matrix is one of the most effective tools for segmenting purchasing categories based on two variables: impact on the business and complexity of the supply market. Its usefulness is practical: it allows for the assignment of differentiated strategies depending on the nature of the risk.
Where the market risk is high and the impact on the business is high, the relationship should be governed in a strategic way — with supplier development plans, partnerships, and shared visibility. Where the impact is more contained, the logic can be more tactical or transactional. The goal is not to rank things for the sake of it; it is to use segmentation to guide decisions on where to invest, where to watch out for, where to diversify, and where to simplify.
The value of risk management is measured when it translates into concrete action. An effective contingency plan is not a generic document; it is an operational device. It must clarify what to do, who does it, when to activate it, and with what objectives.
The essential elements are:
The decisive point is that the actions must not be improvised: they must be consistent with the nature of the risk and with the level of priority assigned to it.
Among the most useful tools for giving concrete form to prevention is Pro-FMEA (adaptation of the FMEA method — Failure Mode and Effects Analysis — applied to procurement). Its value lies in making risk manageable in a structured way, before it translates into damage.
In the relationship with suppliers, the most frequent failure modes are well known: failure to deliver, delivery late, delivery not in accordance with specifications, increase in direct and indirect costs, compliance issues. The Pro-FMEA approach allows:
The strength of this tool lies in moving the conversation from the generic "there could be a problem“ to the concrete ”this is the fault, these are the causes, this is the effect, this is the priority, this is the action.“ This is where risk management stops being theory and becomes an operational discipline.
No continuity system can function without visibility. And today, visibility extends to digital technology. Dashboards, Business Intelligence tools, KPI monitoring, vendor ratings, real-time segmented portfolios, service and quality indicators: all of this makes risk more readable and response more timely.
Digital solutions do not replace managerial judgment, but enhance its quality. They allow for the early detection of signals, the measurement of the performance of the supply base, the verification of the effectiveness of corrective actions, and the activation of escalation mechanisms. At the same time, technology must be integrated into a coherent organizational model: roles must be assigned with responsibility and regular management rituals — flash meetings, periodic reviews, daily management.
Continuity over time is not achieved only through radical interventions. It is built through a daily management, disciplined and based on facts.
When risk management and business continuity are addressed methodically, the benefits go well beyond reducing threats. The organization gains:
The most evolved companies have understood this: they do not seek a perfect supply chain, because they know that such a thing does not exist. They build a supply chain capable of absorbing shocks, adapting, learning, and starting over. And it is precisely this ability that makes the difference between those who suffer the complexity and those who govern it.
Did it help you? Add it as your preferred source on Google
Supply chain risk management is the structured process by which an organization identifies, assesses, and manages the risks that threaten operational continuity. It includes mapping vulnerabilities, assessing the likelihood and impact of critical events, and defining prevention and response plans. It serves to govern risk rather than to be subjected to it.
The risks of the supply chain are divided into four families: strategic (costs, quality, level of service, sustainability), operational (processes, data security, human capital, compliance), financial (solvency of suppliers and liquidity of the chain) and external risks. These latter are explained using the PESTEL model: political, economic, social, technological, environmental and legal factors.
A Business Continuity System in procurement is built in five phases: Risk Assessment, strategic analysis of the supply base, definition of the Risk Contingency Plan, execution with clear teams and procedures, and continuous improvement. Every event and every weak signal becomes an opportunity for learning, because resilience is a skill that must be trained over time.
Kraljic’s matrix segments the purchasing categories based on their impact on the business and the complexity of the supply market. Where market risk and impact are high, the relationship should be governed strategically, with supplier development, partnerships, and shared visibility. Where the impact is contained, tactical or transactional management is sufficient.
An effective contingency plan contains a business continuity policy, the mapping of critical supply processes, the maximum tolerable interruption time and recovery times, continuity solutions such as dual sourcing or selective stockpiling, operational procedures with defined roles, and escalation and communication plans.
Pro-FMEA is the adaptation to procurement of the FMEA (Failure Mode and Effects Analysis) method. It identifies failure modes with suppliers, such as non-delivery, delay, non-compliance or increased costs, and estimates their severity, probability and detectability, and builds a risk priority index that guides interventions before damage occurs.
ai translated