Hidden supply chain risks: six ways to identify dependencies and improve business resilience

This is a tale of where business resilience, data management and supply chain management meet.

I have experience in each, and in a world that increasingly relies on global partners, all three are essential.

Supply chain risks: the cloud

Businesses are becoming increasingly dependent on a small number of large cloud providers. We may buy online services and applications from thousands of different suppliers, but behind those brands, many of the services we rely on lead back to the same few technology companies.

Amazon Web Services, Microsoft Azure and Google Cloud provide the computing, storage and other building blocks on which many suppliers build their products. Those suppliers may then support other providers, adding further layers between the business using a service and the infrastructure delivering it.

There is nothing inherently wrong with this model. It allows suppliers to develop useful products without building and operating their own data centres. But too often, they sell us their capabilities without being sufficiently open about the dependencies behind them - the choice we see when we are buying services does not always reflect the concentration underneath and is not always obvious when we sign up.

Back in the day, I wasn’t comfortable with cloud computing. I had an old-fashioned belief that I should be able to see - and preferably touch - the systems I was responsible for running. There was something reassuring about knowing where the equipment was and who was looking after it.

Over time, the arguments for moving to the cloud became too compelling to ignore. Faster deployment, greater efficiency, stronger backup and failover capabilities, and the ability to access systems and information from almost anywhere offered real advantages. Over roughly ten years, we moved from running all our systems in-house to a cloud-first approach to choosing tools, and ultimately to cloud becoming our default way of operating.

I still recognise those benefits.

But increasingly I question whether some of the strategic promises we bought into remain as convincing today. Resilience, flexibility and reduced dependency become harder to assess when there are layers of suppliers between us and the infrastructure supporting our business.

We may believe we have spread our risk across several suppliers, only to discover during an outage that they share a critical dependency. Our booking system, customer portal and reporting tool might come from separate companies, yet a failure in one underlying service could affect all three. The systems appear unconnected until they stop working together.

As we increasingly see in the news, one single point of failure can have far-reaching consequences and serious knock-on costs.

Applying data management principles to supply and value chain management

This brings us back to some basic principles of data management. To understand whether we can rely on the information we use, we need to understand where the “source” of where underlying data originates from, who owns it, how it changes and how it is combined and aggregated into the information we use.

A figure in a dashboard is the end of a journey. Without understanding that journey, it is difficult to judge its reliability or investigate when anything goes wrong. This is an integral component of business resilience.

The same discipline should apply to our suppliers. Knowing the company we pay is only the starting point. We also need to understand the important dependencies behind its service so that we can understand our own risk.

Supply chain management and value chain management operate in this fashion.

• Supply chain management asks who and what we depend on to deliver.

• Value chain management considers how those activities contribute to the value our customers receive.

Following both through helps us connect a customer outcome to the processes, information, applications and suppliers that make it possible.

Supplier provenance therefore matters. Who actually delivers the service? What do they subcontract? Which infrastructure supports them? Where does responsibility sit when something fails? A supplier’s name and a reassuring statement about resilience are not enough to answer those questions.

In the event of service failure, good supply chain management helps explain why it has failed. Good data management helps establish what information we’ve lost access to or has become corrupted – and whether we can retrieve it or rely on it. Business resilience determines how we keep serving customers until those services return.

Six ways to reduce supply chain risk and improve business resilience

1. Start with the activities your business cannot afford to lose.
   Identify the systems and information supporting them, then ask your suppliers about their underlying dependencies. See if you can trace this all the way back to the source. Look for places where several important and “independent” services ultimately rely on the same provider or infrastructure.

2. Establish how long you could operate without those services.
   Some disruption may be manageable for a day. Other failures could stop customer delivery or payments within minutes. That distinction should guide how much you invest in recovery and alternative arrangements.

3. Ask suppliers what their recovery plans actually cover.
   Can they withstand the loss of a data centre or a wider regional outage? How quickly can they restore service, and when did they last test it? Backup, failover and recovery describe different capabilities; none should be accepted as a blanket assurance that the service will always be available.

4. Keep essential information and recovery instructions accessible during the failure you are planning for.
   A continuity plan stored only in the system that has become unavailable will be of limited help. Equally, having a backup of your data does not automatically give you a working replacement application. Test that you have a recoverable and usable back-up capability.

5. Prepare practical ways to continue essential work.
   That might mean recording orders temporarily, accessing a controlled export of key information or contacting customers through another channel. Decide who can activate those arrangements and how information will be checked and brought back into the main systems afterwards.

6. Finally, test a scenario in which several suppliers become unavailable at once.
   Can you still communicate, find your emergency contacts and deliver your most important services? That exercise will tell you more than reviewing each supplier’s continuity statement in isolation.
   
   For some businesses, using different cloud providers may be justified. For others, the cost and complexity would outweigh the benefit. The right response depends on the impact of failure and the alternatives available.

We cannot remove every dependency. We can make those dependencies visible, understand their consequences and prepare for disruption.

If we expect to trace a number in a management report back to its source, we should apply the same curiosity to the services keeping our businesses running. You may know your suppliers – but do you know what your suppliers are depending on?