1. Resiliency Track Readout August 2009

2. Objective and Scope Objective: –To share best practices in supply chain resiliency Track Scope: Product, Supplier and Physical Network Resiliency –Planning and Implementation for: Existing and New Products, Existing and New Suppliers, Existing and New Networks/Network Design Out of Scope: –Product Quality Process –S&OP (sales and operations planning)

3. Resiliency Planning Understand your supply chain

4. Resiliency Planning Setting Objectives, Targets and Establishing Resiliency Metrics 1.BP firms have a method to determine which elements of the supply chain and the product pose the most risk BP firms utilize supply chain ‘value stream mapping’ to understand the node-network BP firms have the ability to map their locations, supplier locations, customer locations globally

5. Resiliency Planning Item 1 Examples: CISCO: Leverage the BCP Program to collect Time To Recover for Partner Manufacturing and Logistics sites and for single/sole sourced components. GE Energy Infrastructure: Determine single/sole source suppliers, identify which of those components are critical to the product/customer, identify components with unique/rare raw materials. Launch a Risk Assessment questionnaire for internal suppliers. External suppliers get a BCP questionnaire that ranks their Resiliency. This information is used to identify suppliers both internal and external that are at high risk. Genentech:

6. GENENTECH Identify Product Contingency Options and Network Risk Inventory 3 Step 1: Calculate network risk inventory needed per each manufacturing process in the event of an outage at the primary site: Bulk Outage Primary Site 18 weeks outage6 w Start-Up Time 10 wks Bulk Cycle Time 7 wks Fill/Pack Cycle Time 41 weeks Fill Outage Primary Site 15 wks outage4 w Start-Up Time 7 wks Fill/Pack Cycle Time 26 weeks Network Risk Inventory for bulk outage: 41 weeks DS or DP Network Risk Inventory for fill outage: 26 weeks DP Pack Outage Primary Site 13 w outage4 w Start-Up 2 Pack Cycle Time 19 weeks Network Risk Inventory: 19 weeks DP Definitions: DS: Drug substance / DP: Drug product (packaged units) Start-Up: Time needed to change over equipment, modify schedule, and/or seed train development time

7. CISCO BCP Program

8. Resiliency Planning 2.Best Practices firms can identify the consequences of making optimal risk choices and acceptable mitigations for known risks. –Revenue, brand impact, or market value –Proven methodology for choosing what to mitigate –Regular management review and approval of risk mitigation investments –Budget allocated for risk mitigation and manage a portfolio of risk mitigation projects and programs to improve resiliency –Consistent method of measuring resiliency across their organization.

9. Resiliency Planning Item 2 Example: CISCO: Resiliency Index

10. Implementation and Operation 1.Process and program to drive resiliency projects across Products/Services, Suppliers and the Supply Chain –Program ownership of risk mitigation projects (both internally and externally) –Process in place to validate supplier responses (Validate Site Time to Recover, Validate Part Time to Recover) –Partnerships with customers to ensure demand signals are comprehended into capacity planning  Visibility and influence the Product Lifecycle Ability to know if past mitigation strategies are changing as part of the routine Engineering Change Control or a Supplier’s decision

11. Implementation Example FedEx: –Resiliency is enabled through excess capacity/redundancy to account for operational and non operational issues. –Capacity Planning to include further levels into the supply chain (mother’s day flower delivery). Partner with the customers shipping to ensure there is resiliency by sharing and having an understanding of the customers demand needs and FedEx’s ability to deliver.

12. Final Thoughts Interdependencies –BCP, Risk Measurement Tiered Approach to Implementation –Different sets of minimum requirements depending on the complexity and size of the business; Example: Tier 1 = Self BCP, Tier 2 = Self BCP and Vendor BCP Phased Implementation –Choose which products or elements of the supply chain apply for certification, i.e. new products