DRK Confidential Do not Distribute without Permission 1 Supply Chain Risk Assessment Model Logic and Measures Dr. Kevin McCormack August 2007

DRK Confidential Do not Distribute without Permission 2 Performance CAUSES (Categories of Predictive Measures) Disruption EVENTS CONSEQUENCES (Impacts) Human Resources Supply Chain Disruption Supply Chain Disruption Financial Health Environmental Relationship Quality, Delivery, Service Problems Quality, Delivery, Service Problems Supplier Union Strike, Ownership Change, Workforce Disruption Supplier Union Strike, Ownership Change, Workforce Disruption Supplier Locked Tier II Stoppage Supplier Locked Tier II Stoppage Supplier Bankruptcy (or financial distress) Supplier Bankruptcy (or financial distress) Disasters (Weather, Earthquake, Terrorists) Disasters (Weather, Earthquake, Terrorists) Misalignment of Interests Misalignment of Interests Finished Goods Shipments Stopped Finished Goods Shipments Stopped Locate and Ramp Up Back up Supplier Locate and Ramp Up Back up Supplier Emergency Buy and Shipments Emergency Buy and Shipments Reputation Market Share Loss EFFECTS Revenue Losses and Recovery Expenses OTHER IMPACTS Forgone Income Emergency Rework and Rushed FG Shipments Emergency Rework and Rushed FG Shipments Recall for Quality Issues Recall for Quality Issues Sudden Loss of Supplier Sudden Loss of Supplier Structuring the Relationships of Supply Chain Risk Supplier Attributes Situational Factors

DRK Confidential Do not Distribute without Permission 3 Highest and Average Prob. X Risk Score Supplier Surveys Risk Indicators Risk Events Internal Analysts Environmental Analysts Risk Indicators by event Risk Indicators by entity Internal Analysts and SMEs Risk Event Probability Combine and Calculate Supplier Risk Event Impact By entity Supplier Risk Score Risk Event Impact Supplier Risk Score (probability) Total Impact by Entity Supply Chain Network Diagnostics Risk Management Analyst’s Modifier Overall Data Flow

DRK Confidential Do not Distribute without Permission 4 Supplier 1 Part A Part B Part C Finished Good 1 Revenue - $5 mil Finished Good 3 Revenue - $50 mil Finished Good 2 Revenue - $20 mil Revenue Impact Part A - $75 mil Revenue Impact Part B - $20 mil Revenue Impact Part C - $70 mil Total Supplier Impact - $165 mil Objective: Find the FG revenue impact on a part basis if a supplier disruption occurs Revenue Impact Calculation

DRK Confidential Do not Distribute without Permission 5 Supplier Risk Index

DRK Confidential Do not Distribute without Permission 6 Risk Wheel Diagnostic Analytical

DRK Confidential Do not Distribute without Permission 7 Risk Index (RI) (Diagnostic Mode)

DRK Confidential Do not Distribute without Permission 8 SC Risk Assessment Units of Analysis s s s s s s s SC Network Organizer Commodity Category Interactions and Relationship Supplier Attributes Supplier Environment

DRK Confidential Do not Distribute without Permission 9 Performance CAUSES (Categories of Predictive Measures) Disruption EVENTS CONSEQUENCES (Impacts) Human Resources Supply Chain Disruption Supply Chain Disruption Financial Health Environmental Relationship Quality, Delivery, Service Problems Quality, Delivery, Service Problems Supplier Union Strike, Ownership Change, Workforce Disruption Supplier Union Strike, Ownership Change, Workforce Disruption Supplier Locked Tier II Stoppage Supplier Locked Tier II Stoppage Supplier Bankruptcy (or financial distress) Supplier Bankruptcy (or financial distress) Disasters (Weather, Earthquake, Terrorists) Disasters (Weather, Earthquake, Terrorists) Misalignment of Interests Misalignment of Interests Finished Goods Shipments Stopped Finished Goods Shipments Stopped Locate and Ramp Up Back up Supplier Locate and Ramp Up Back up Supplier Emergency Buy and Shipments Emergency Buy and Shipments Reputation Market Share Loss EFFECTS Revenue Losses and Recovery Expenses OTHER IMPACTS Forgone Income Emergency Rework and Rushed FG Shipments Emergency Rework and Rushed FG Shipments Recall for Quality Issues Recall for Quality Issues Sudden Loss of Supplier Sudden Loss of Supplier Structuring the Relationships of Supply Chain Risk Copyright© 2006 Supply Chain Redesign, LLC Supplier Attributes Situational Factors

DRK Confidential Do not Distribute without Permission 10

DRK Confidential Do not Distribute without Permission 11

DRK Confidential Do not Distribute without Permission 12

DRK Confidential Do not Distribute without Permission 13

DRK Confidential Do not Distribute without Permission 14 Risk Probability Index (RPI) (Analytical Mode)

DRK Confidential Do not Distribute without Permission 15 RelationshipSupply Chain Disruption Human Resources Performance Financial Health Environmental Indicators Supplier Risk Probability Index (RPI) Supply Chain Risk Categories v. Events Misalignment of interest Supplier Bankruptcy Supplier Locked (Regulatory) Supplier Union Strike Tier 2 Stoppage Supplier Ownership Change Quality Problem Delivery Problem DisastersService Problem Categories Events Workforce Disruption

DRK Confidential Do not Distribute without Permission 16

DRK Confidential Do not Distribute without Permission 17

DRK Confidential Do not Distribute without Permission 18

DRK Confidential Do not Distribute without Permission 19 Examples of Risk Management Actions Risk Probability Index Revenue Impact ($) L HL H Profile 1 No Risk Management Profile 2 With Risk Management Equal Revenue Impact and lower risk With Risk Management (Event Probability x Score)

DRK Confidential Do not Distribute without Permission 20 Examples of Risk Management Actions Risk Probability Index Revenue Impact ($) L HL H Supplier 1 No Risk Management Supplier 2 Distributing Spend (and reducing Revenue Impact) to several equal and lower risk suppliers. Overall Revenue / RPI is reduced (Event Probability x Score) Supplier 3 Supplier 2

DRK Confidential Do not Distribute without Permission 21 Examples of Risk Management Actions Risk Probability Index Revenue Impact ($) L HL H Supplier 1 No Risk Management Distributing Spend (and reducing Revenue Impact) to several equal and lower risk suppliers. Overall Revenue / RPI is reduced (Event Probability x Score) Supplier 1 With risk reduction actions Supplier 1 With spend reduction actions Supplier 1 With combination actions

DRK Confidential Do not Distribute without Permission 22 Week 0Week 1-2Week 3-4 Week 5-6 Week 7 Week 8 Data Collection Follow up Preparation Analyze Mitigate Report 4.0 Analyze Survey Data Collection Validate 6.0 Mitigate Supplier Information Set Up Internal Information Set Up Report Note: Cycle Time – 6-8 weeks 1 Category = 30 suppliers - Manual Process - IT Enabled Process - Combination Assessment Team 1.0 Kick off 2.0 Preparation 5.0 Report Kick Off Review Team Provide Set up information Category Manager and Suppliers Set up Survey Internal Data 3.0 Data Collection Survey Review & Event Probability Subject Matter Experts and Suppliers Review/ Validate Preliminary Data Category Manager and Risk Manager ID and Begin Mitigation Category Manager and Risk Manager Supply Chain Risk Assessment Process

DRK Confidential Do not Distribute without Permission 23 Case 1

DRK Confidential Do not Distribute without Permission 24 Case 1

DRK Confidential Do not Distribute without Permission 25 Case 2

DRK Confidential Do not Distribute without Permission 26 Case 2 Mitigation

DRK Confidential Do not Distribute without Permission 27 Case 2

DRK Confidential Do not Distribute without Permission 28 Case 2