Supply chain risk (SCR) is a discipline that has experienced substantial growth, and it provides supply chain managers new techniques and methods of analysis and evaluation for several sectors [1]. The SCR concept has been widely discussed by many authors [2], [3], [4], [5], [6], and it is defined as the potential losses in an SC in terms of its target values of efficiency and effectiveness caused by uncertain developments in the supply chain characteristics whose changes were caused by the occurrence of triggering events [2].

Moreover, risk categories have been proposed based on key performance indicators and by their uncertainty source. Singhal [3] proposed five risk categories according to the uncertainty source: operational, market, business or strategic, product, and miscellaneous risks. We focus on operational risk because companies have more control and management capacity over these features. Operational risk is defined as the operational features of the SC that either mismatch demand and supply or even disrupt the functioning of the SC by interrupting the flow of materials, products or information [7], [8].

According to the review made in [9], a risk management system is composed of four main steps (see figure 1). Additionally, Elmsalmi and Hachicha [10] conclude that the first two steps are critical for performing successful risk management.

Figure 1 Figure 1 Risk management system steps Source: Manotas et al. [9]

Concerning risk assessment and prioritization, as these risks cannot be completely eliminated, their assessment and measurement is essential for effective risk management. According to [11], risk measurement can be classified into two categories: quantitative or probabilistic (based on statistics) and subjective (based on expert knowledge) approaches.

Regarding risk identification, [3], [11], [12] agree on that this is a fundamental phase and the starting point for risk management implementation. Moreover, [13] indicates that risk identification should be exhaustive because any non-identified risk will not be included in posterior risk assessment. Figure 2 shows the main risk identification techniques proposed in the literature. The most used techniques are qualitative ones, especially checklists, interviews and questionnaires.

Figure 2 Figure 2 Main risk identification techniques Source: adapted from Marhavilas et al. [12]

Borghesi and Gaudenzi [13] conclude that qualitative risk measurement is preferable when risk levels are relatively low and when obtaining the information required for a quantitative analysis is expensive. Furthermore, they recommend a quantitative analysis when sufficient information about risk is available and suitable for defining probabilities and consequences, and when this information is shared between many people with different organizational functions, which means that diversity over risk perception and knowledge exists. However, firms frequently do not maintain sufficient information to develop a reliable analysis [7], [14]. Figure 3 shows the main techniques used for risk assessment and prioritization identified by [9] and [12].

In this paper, we study operational risk because it is directly related to SC features that affect its performance. Here, we propose an identification and prioritization methodology that takes the KPIs from version V11.0 of the supply chain operational reference model (SCORM o SCOR) as the starting point to lead risk identification and to define relationships between the KPIs and the SC risk factors for each SC echelon. Afterwards, these relationships are quantified, and the risk factors are arranged according to their influence level over the SC.

The proposed methodology, according to the literature review, is novel in this area of study. The main contributions of the research to the field are twofold: the first contribution is the risk identification by means of the KPIs of the standard SCOR model, which is widely accepted in the industry; the second contribution is the measurement of the influence levels of the risk factors over the SC, which are useful to assess and prioritize.

In the literature, we found different focuses in SC risk studies. The first focus was on risk management systems, which are defined conceptual approximations for SC risk management, mitigation strategies, risk management models and their adoption. The second focus regards the study of the relationships between uncertainty, risk and SC performance. The third focuses on risk analysis and assessment using subjective and quantitative and qualitative methods. These methods use the frequency and severity to estimate the measurement of a risk and lead the analysis and assessment process with the activities in the SC and the scorecards of the SC under study rather than leading the analysis and assessment process with the performance indicators of some standard model [2], [3], [6], [15], [16], [17], [18].

The SCOR model, proposed by the Supply Chain Council is a reference framework widely accepted in the industry that is useful for diagnosing and designing SCs. The SCORM hierarchically defines the processes and activities of SCs and is organized around six primary processes: plan (sP); source (sS); make (sM); delivery (sD); return (sR) and enable (sE). Additionally, the model defines for each process the best practices and standards or KPIs of the SC [19].

Figure 3 Figure 3 Risk assessment tools Source: adapted from Marhavilas et al. [12]

Hence, the SCORM incorporated the risk concept in its processes starting from its 9.0 version in 2008, and few applications of the SCORM related to supply chain risk management are found in the literature [20]. In its applications, the SCORM has been integrated with other tools to develop risk management methodologies, which drives risk identification around activities in the SC [21] and uses KPIs to evaluate the SC performance in scenarios with uncertainty [22].

The proposed methodology consists of six steps (see figure 4). By definition, supply chain risk (SCR) comprises events or uncertain situations that cause supply chain objectives to be unfulfilled. In this sense, the first step of the methodology is to select the SCOR indicators that will lead to risk identification; these indicators are selected according to their relevance for business strategies and to the sourcing, manufacturing and delivery environments where SC activities are developed, i. e., make to order, make to stock or engineer to order.

The SCORM arranges its metrics of the SC on three hierarchical levels and groups them with one of five performance attributes: reliability (RL), responsiveness (RS), agility (AG), cost (CO) and asset management efficiency (AM). The relationships between the levels of the metrics are diagnostic; for example, the second-level metrics serve as diagnostics for the first-level metrics. The second-level metrics help to identify the causes of a performance failure [19]. Thus, the second-level metrics of SCORM are considered suitable for leading risk identification; nevertheless, the SCORM metrics may be used at any desired disaggregation level.

Figure 4 Figure 4 Risk identification and prioritization methodology Source: author’s own elaboration

Table 1 shows the second-level SCORM indicators used in this study, the first-level indicators that contain the second-level indicators for each performance attribute, and their codification. The indicators related to the performance attribute agility (AG), measurement flexibility, adaptability and value at risk of the SC are related to the capacity planning of elements on different processes. Overall, the information used to calculate these indicators is the result of metrics of other performance attributes; therefore, they are not taken into account for the operational risk identification in this study. However, they could be considered in other planning level analyses.

The second step of the proposed methodology is the identification of situations and risk factors that cause an undesired result on SC metrics. For this identification, as shown in [5], several tools are already validated and implemented, such as interviews, data analyses, expert consultations, checklists, SC mapping, and fault tree analysis, may be used.

Once the risk factors are identified, a scenario analysis is performed. Through this analysis, the causes and activities where the risk factors originate are determined. This process facilitates the comprehension and identification of the causal relationships between the identified risk factors and performance metrics of the echelon where they originate and other affected echelons.

Table 1 Table 1 First -and second- level SCORM metrics

Later, direct and indirect influence relationships of the risk factors, which affect any performance indicator inside and outside of the SC echelon, are established. These relationships are quantified using the scale shown in table 2.

This scale assigns a higher score to external influence relationships, i. e., relationships with other SC echelons.

On the one hand, the risk factor has a direct influence over the indicator result when its occurrence does not need another event to affect the indicator. On the other hand, the risk factor has an indirect influence over the indicator when its occurrence needs other events within a chain reaction to affect the indicator.

Table 2 Table 2 Score influence relationships Source: author’s own elaboration

Figure 5 shows an example where the influence relationships of the identified risk factors are established and quantified. The risk factors error in delivery schedule, inputs not available and improper storage affect the results of the indicators percentage of orders delivered in full (RL.2.1) and source cycle time (RS.2.1) at two echelons of an SC.

At the supplier, the risk factor errors in delivery schedule has a direct relationship with the indicator percentage of orders delivered in full; hence, the materialization of errors in delivery schedule will always affect the result of percentage of orders delivered in full. However, the materialization of errors in delivery schedule does not always generate a higher source cycle time than the time desired at customer. Nevertheless, if the percentage of orders delivered in full is not fulfilled, the source cycle time will likely be affected, which will generate an indirect external relationship between errors in delivery schedule and source cycle time.

Figure 5 Figure 5 Outline of the definition and valuation of influence relationships Source: author’s own elaboration

The influence level is equal to the sum of the influence relationship scores exerted by the risk factor. This measure allows the arrangement of risk factors according to their influence on the SC, thereby complementing traditional definitions of risk factor impact measures, which are usually performed in the assessment phases of risk management methodologies and are therefore useful for decision-making and risk prioritization.

In this example, the risk factor errors in delivery schedule has an external indirect influence on the indicator source cycle time at the customer, an internal direct influence over the result of orders delivered in full, and an internal indirect influence over the perfect conditions indicator, which are valued at 3, 2 and 1 points, respectively; therefore, total influence level of errors in delivery schedule is 6 points.

The proposed methodology was implemented on the SC of a company that provides clinical diagnostic services. The SC in this study comprises the reagent provider (RP) for the elaboration of laboratory tests, the focus company (FC) and the customer (CT) that requests diagnostic services (see figure 6). They operate in a make-to-order production environment.

Figure 6 Figure 6 Studied supply chain Source: author’s own elaboration

The operational risk factors that affect the performance and results of the SC and their impact on the results of the metrics for each echelon were identified through interviews and data analyses from documented cases. Table 3, table 4 and table 5 show the operational risk identified at each echelon of the reagent provider, the focus company and the customer, respectively.

Table 3 shows that the risk factors delay in export procedures and lack of raw material and inputs directly affect the result of the indicator percentage of orders delivered in full. An unsuitable performance related to full delivery of orders forces the focus company to wait for backorders, which indirectly affects the result of the indicator source cycle time. Additionally, the delay in export procedures may cause product damage, which indirectly affects the indicator perfect conditions.

Moreover, note that some risk factors may generate the same risk or effect. For example, the risk factors reprocessing order pickup and delivery and frequent changes on customer orders both generate customer dissatisfaction.

The results presented from table 3 through table 5 show the indicators indirectly affected by each identified risk factor. These tables present the SCORM indicator code and the acronym for the impacted echelon. For the cases where the impacted echelon is not indicated, the indirect influence relationship is presented internally and does not transcend to another echelon.

Figure 7 presents five of the identified risk factors that affect the results of the indicators selected within the methodology and their influence relationships. The risk factor improper storage conditions at the reagent provider has an internal direct influence on the indicator perfect conditions, which is valued at two (2) points, an internal indirect influence on the indicator reprocessing and return cost, which is valued at one (1) point, and an external indirect influence on the indicator make cycle time at the focus company, which is valued at three (3) points. Adding the influence level scores obtained for this risk factor, a total influence level of six (6) points is obtained. In the same fashion, the influence level score of all the identified risk factors is determined.

Table 3 Table 3 Identified operational risks for the reagent provider Source: author’s own elaboration

Table 4 Table 4 Identified operational risks for the focus company (diagnostic service laboratory) Source: author’s own elaboration

Table 5 Table 5 Identified operational risks for the customer Source: author’s own elaboration

Figure 7 Figure 7 Influence relationships diagram for the identified risk factors Source: author’s own elaboration

Twenty (20) operational risk factors were identified that directly or indirectly affect thirteen (13) second-level indicators of the studied SC. Following the presented methodology, the risk factors' influences over the supply chain performance indicators were identified and quantified according to the proposed scale. The scores obtained by every influence relationship of every risk factor were summed to define the total influence level of each risk factor. Table 6 shows the results for each risk factor arranged from the highest to lowest total influence level and the echelon in which they were found.

Table 6 Table 6 Influence level score for the identified risk factors Source: author’s own elaboration

Regarding the SC under study, most of the risk factors were identified in the focus company and reagent provider, and the risk factors with higher levels of influence are presented on upstream SC echelons. According to these results, the risk factors with the highest level of influence are reprocessing order pickup and delivery orders to be delivered to the laboratory, which is performed by the reagent provider, and purchase of inputs of medium quality (generic references), which is performed by the laboratory.

A methodology for supply chain (SC) risk identification and prioritization was proposed. The methodology uses the SC standard performance metrics of version V11.0 of the SCOR model to lead risk factor identification. Moreover, the methodology permits clear identification of the risk factors with the highest level of influence in SC operations and the ones that may transcend to others SC echelons.

The implemented methodology is easy to apply, and hence, it is based on a standard model for SC assessment (the SCOR model). The methodology facilitates risk identification for the complete supply chain and for the appropriation and understanding of its members. Therefore, this methodology enables collaborative and joint risk management plans.

Hence, the performance metrics proposed by the SCOR model and used by the proposed methodology are related to all planning levels: strategic, tactical and operational. Furthermore, the proposed methodology could also be applied without focusing on the operational planning levels and instead accounting for the planning, enable and return processes proposed by the SCOR Model.

The arrangement of risk factors according to their influence level complements the traditional definition of risk impact used in the assessment phase of management risk systems and supports the decision-making process in risk prioritization.