Proposed Supply Chain Risk Management Process Flow Supply Chain Risk Leadership Council 20 April 2009 DRAFT

P A G E 2 We can build on similar risk management processes to create a SCRLC risk management process. SCC ProcessRAND Process Proposed SCRLC Process Build the Program Define the Supply Chain Define Risk Objectives Assess Supply Chain Risk Mitigate Risk Implement and Monitor Recognize Existence Identify Estimate Likelihood of Occurrence Prioritize Develop, assess, and execute management strategies Develop Contingency plans Assess probable consequence/ duration Monitor Capture lessons learned and improve Establish a SCRM Program and Apply Resources Define the Supply Chain and Risk Objectives Identify Supply Chain Risks Quantify and Prioritize Risks Develop and Execute Risk Management Actions Monitor Supply Chain Environment for Risks Note: The RAND process is a draft process under development and should not be released beyond the SCRLC Process team without permission from Nancy Moore.

P A G E 3 The risk management process must be iterative to be effective. Establish a SCRM Program and Apply Resources Define the Supply Chain and Risk Objectives Identify Supply Chain Risks Quantify and Prioritize Risks Develop and Execute Risk Management Actions Monitor Supply Chain Environment for Risks Proposed SCRLC Process Continuous Risk Monitoring Reassessment of management actions Reassessment of risk exposure Reassessment of risk sources Reassessment of supply chain Reassessment of risk program The timing of each iteration should be dictated by the corporate risk strategy

P A G E 4 The proposed SCRLC process should cover all elements of a comprehensive risk management program Establish a SCRM Program and Apply Resources Define the Supply Chain and Risk Objectives Identify Supply Chain Risks Quantify and Prioritize Risks Develop and Execute Risk Management Actions Monitor Supply Chain Environment for Risks Proposed SCRLC Process Recognize risk management as a priority Secure executive support for risk management program Secure resources necessary to execute risk management program Define the supply chain scope Map the supply chain Define the objectives of managing risk in the subject supply chain Comprehensively review the supply chain to identify risks Document identified risks to the extent possible Quantify each risk in terms of probability of occurrence and potential impact Use the quantification of the risks to prioritize the risks according to defined objectives Develop risk management actions consistent with each risk’s priority Define each action’s value in terms of reducing the probability and impact of the risk Develop and execute an implementation plan for the identified actions Define monitoring requirements and action thresholds Continuously monitor the supply chain environment for risk events or precursors. When thresholds are triggered, execute applicable mitigation actions Document results for after action review and program improvement

P A G E 5 The proposed SCRLC process can map to the defined working groups Establish a SCRM Program and Apply Resources Define the Supply Chain and Risk Objectives Identify Supply Chain Risks Quantify and Prioritize Risks Develop and Execute Risk Management Actions Monitor Supply Chain Environment for Risks Proposed SCRLC Process Manufacturing, Transportation and Logistics Resiliency Preparedness, Business Continuity, and Recovery Planning Product and Materials Resiliency Regulatory Compliance Supply Chain Monitoring & Crisis Management Supply Chain Risk Quantification & Measurement SCRLC Working Groups Supply Chain Security

P A G E 6 ACQUISITION FACILITIES & ASSET MANAGEMENT FINANCIAL MANAGEMENT INFORMATION & TECHNOLOGY LOGISTICS ORGANIZATIONS & HUMAN CAPITAL THE OPPORTUNITY TO MAKE A DIFFERENCE HAS NEVER BEEN GREATER