How to build a structured risk management and business continuity system for the supply chain: from mapping strategic, operational, financial and external risks, to analyzing the supply base using the Kraljic matrix, to defining effective contingency plans and implementing the Pro-FMEA. A practical guide for B2B companies that want to reduce operational disruptions, increase reliability towards customers and stakeholders, and compete with strength even in crisis and geopolitical volatility scenarios.
Risk Management is the structured process by which an organization identifies, assesses, and responds to risks that threaten operational continuity. Today, it is no longer the prerogative of specialists: it is a managerial tool that determines an enterprise’s ability to compete even in adverse conditions.
In recent years, companies have learned, often the hard way, that operational continuity can no longer be taken for granted. Shortages of critical materials, unavailability of suppliers, disruptions in supply chains, cyberattacks, market volatility, geopolitical tensions, skills crises: what was once considered an exceptional event is now part of the daily competitive landscape.
The data confirm this. According to our biennial Benchmarking Study | What’s next in Operations? — conducted on over 100 companies in 22 industry sectors, with a sample composed for 85% by C-level executives and for 83% by companies with more than 100 employees, predominantly B2B (87%) — only 55% of the companies have implemented Business Continuity systems. The average Supply Chain Maturity Level stands at 67%, indicating widespread fragility in terms of responsiveness and digitalization, with a strong dependence on manual processes and difficulties in managing demand fluctuations and supply issues.
The real question, then, is not whether an interruption will occur, but how prepared the company is to prevent it, manage it, and overcome it.
One of the most common mistakes in organizations is treating risk as an ancillary variable to be covered with a generic "unforeseen" fund or to be addressed only when it emerges. This is a convenient but dangerous approach. An amorphous economic reserve does not replace a prevention system and, above all, it does not build organizational capacity.
Managing risk effectively means making a cultural shift: recognizing that business continuity does not coincide with simply reacting to an incident, but with the ability to prepare in advance what is needed to continue operating even in adverse conditions.
A reactive approach leads to decisions made under pressure, unforeseen costs, eroded margins, delays, penalties, and reputational damage. The preventive approach, on the other hand, allows for assessing threats in advance, building coherent countermeasures, reducing the likelihood that the event will occur, and limiting its impact if it does. In other words: it is not just about defending against risk; it is about managing it.
If operational continuity is a cross-functional responsibility, it is in procurement that many critical issues become decisive. Procurement is no longer a purely transactional function: it is a strategic lever that directly impacts the company’s ability to ensure service, quality, flexibility, and economic sustainability.
Contemporary supply chains are more extensive, more interconnected and more vulnerable. The outsourcing of non-core activities, the pressure on lead times, increasing customization, the complexity of logistics, dependence on distant markets, and the financial fragility of some suppliers have greatly expanded the scope of the supply risk.
This is added to factors that are difficult to control: price variability, currency fluctuations, regulatory changes, environmental events, geopolitical tensions, and cyber risk. All of this requires a profound review of the way in which the base of suppliers is designed, evaluated, and governed. It is no longer enough to look for the best price: it is necessary to understand which supplies are truly critical, where vulnerabilities are concentrated, and where to balance efficiency and robustness.
Supply chain resilience is now a choice of organizational and strategic design.
A common mistake is to think of supply risk management as a problem limited to the availability of material. In reality, the risks that impact business continuity are multiple and interdependent:
The managerial challenge is to stop reading risk as an isolated event and start reading it as a system.
To make risk management truly useful to Operations, a method is needed. An effective approach does not just focus on capturing risk; it also guides the organization through a structured process in five phases:
🎬 Do you want to see these 5 steps applied in a concrete way?
Watch the Digital Talk on Demand by Bonfiglioli Consulting: Business Continuity System for an Antifragile Supply Chain.
Access the free video →
One of the most important contributions of risk management is introducing priority criteria. Not all risks deserve the same level of attention or the same level of investment.
A qualitative assessment matrix allows for the intersection of two fundamental dimensions: the probability of occurrence and the severity of the impact. It is an essential step that enables the organization to distinguish between risks that can be monitored through routine management, risks that require periodic attention, and risks that require proactive plans and frequent interventions.
But evaluation cannot stop at internal perception. Market information, external sources, historical data, price data, exchange rate movements, sector intelligence, and predictive models are needed. In an unstable context, the quality of decisions also depends on the quality of the signals that the company is able to detect. For this reason, Procurement must evolve towards a Business Intelligence logic: not only managing the order, but interpreting the context.
Not all items and not all suppliers have the same weight in the business. Continuing to manage them with uniform logic means wasting attention where it is not needed and underestimating what is truly critical.
The Kraljic matrix is one of the most effective tools for segmenting purchasing categories based on two variables: impact on the business and complexity of the supply market. Its usefulness is practical: it allows for the assignment of differentiated strategies depending on the nature of the risk.
Where the market risk is high and the impact on the business is high, the relationship should be governed in a strategic way — with supplier development plans, partnerships, and shared visibility. Where the impact is more contained, the logic can be more tactical or transactional. The goal is not to rank things for the sake of it; it is to use segmentation to guide decisions on where to invest, where to watch out for, where to diversify, and where to simplify.
The value of risk management is measured when it translates into concrete action. An effective contingency plan is not a generic document; it is an operational device. It must clarify what to do, who does it, when to activate it, and with what objectives.
The essential elements are:
The decisive point is that the actions must not be improvised: they must be consistent with the nature of the risk and with the level of priority assigned to it.
Among the most useful tools for giving concrete form to prevention is Pro-FMEA (adaptation of the FMEA method — Failure Mode and Effects Analysis — applied to procurement). Its value lies in making risk manageable in a structured way, before it translates into damage.
In the relationship with suppliers, the most frequent failure modes are well known: failure to deliver, delivery late, delivery not in accordance with specifications, increase in direct and indirect costs, compliance issues. The Pro-FMEA approach allows:
The strength of this tool lies in moving the conversation from the generic "there could be a problem“ to the concrete ”this is the fault, these are the causes, this is the effect, this is the priority, this is the action.“ This is where risk management stops being theory and becomes an operational discipline.
No continuity system can function without visibility. And today, visibility extends to digital technology. Dashboards, Business Intelligence tools, KPI monitoring, vendor ratings, real-time segmented portfolios, service and quality indicators: all of this makes risk more readable and response more timely.
Digital solutions do not replace managerial judgment, but rather enhance it. They allow for the early detection of signals, the measurement of the performance of the supply base, the verification of the effectiveness of corrective actions, and the activation of escalation mechanisms. At the same time, technology must be integrated into a coherent organizational model: roles must be assigned with responsibility and regular management rituals — flash meetings, periodic reviews, daily management.
Continuity over time is not achieved only through radical interventions. It is built through a daily management, disciplined and based on facts.
When risk management and business continuity are addressed methodically, the benefits go well beyond reducing threats. The organization gains:
The most evolved companies have understood this: they do not seek a perfect supply chain, because they know that such a thing does not exist. They build a supply chain capable of absorbing shocks, adapting, learning, and starting over. And it is precisely this ability that makes the difference between those who suffer the complexity and those who govern it.
Supply chain risk management is the structured process by which an organization identifies, assesses, and manages the risks that may threaten operational continuity. It includes mapping vulnerabilities, assessing the probability and impact of critical events, and defining response and prevention plans.
A Business Continuity System is the set of processes, tools, and operational plans that allow an organization to continue operating — or quickly resume operations — following a critical event. It is important because it reduces downtime, limits economic and reputational damage, and increases trust among customers, partners, and stakeholders.
The risks of the supply chain are divided into four main families: strategic risks (costs, quality, sustainability), operational risks (processes, compliance, human capital), financial risks (solvency of suppliers, liquidity of the chain) and external risks (geopolitical, environmental, regulatory and technological factors that can be analyzed using the PESTEL framework).
The Kraljic matrix is a portfolio acquisition segmentation tool that classifies product categories based on their impact on the business and the complexity of the supply market. In risk management, it allows identifying which suppliers and categories require a more intensive monitoring strategy and where it is appropriate to diversify, develop partnerships, or simplify management.
Pro-FMEA is an adaptation of the FMEA (Failure Mode and Effects Analysis) method applied to procurement. It allows identifying potential failure modes in the relationship with suppliers — such as non-delivery, non-compliance, or increased costs — estimating their severity, probability, and detectability, and building a risk priority index to guide corrective actions before the problem occurs.
An effective contingency plan must include: a business continuity policy with objectives and guiding principles, the mapping of critical supply processes, the maximum tolerable interruption time, continuity solutions (dual sourcing, selective replenishment, agreements with alternative suppliers), clear operational procedures with defined roles and responsibilities, and escalation and communication plans.
According to the biennial Benchmarking Study by Bonfiglioli Consulting, conducted on over 100 companies in 22 industrial sectors, only 55% of the companies have implemented Business Continuity systems. The average Supply Chain Maturity Level stands at 67%, highlighting widespread fragility in the ability to respond to operational disruptions.
A reactive approach to risk means intervening only when the critical event has already occurred, with decisions made under pressure and unforeseen costs. A preventive approach, on the other hand, allows for assessing threats in advance, building coherent countermeasures, reducing the likelihood that the event will occur and limiting its impacts. The difference is not only operational: it is cultural and strategic.
Did it help you? Add it as your preferred source on Google
ai translated