Post audit: The auditing evaluation (monitoring and improvement) (9/9)

After completion of the audit, evaluations are essential to detect potential for improvements. In addition to the auditing evaluation, in which the auditing program is checked for its effectiveness, a performance evaluation of individual auditors and the auditing team should be carried out in order to identify potential areas of optimization in the auditing process.

As such, the requisite questions post completion of the SCRM audit are:

Monitoring and Controls:

Documentation Have all documents required by the auditor been prepared or made available?
  Are the audited documents/evidence available in sufficient quantity?
  Has a comprehensive SCRM audit report, including improvement recommendations as well as a description of the current state, been prepared?


Were all important results of the SCRM audit secured in writing?
  Were all important results of the SCRM audit secured electronically?
Evaluation of the SCRM audit program
Was the number of sites to be audited appropriate?
  Was the selection of staff for the face-to-face interviews appropriate?
  Was the number of interviews conducted adequate?
  Were the appropriate SCRM auditing methods selected?
  Were the performances of the auditor and SCRM audit teams evaluated?


Improvement Measures Does the final audit report contain a satisfactory number of quality suggestions for SCRM improvements?
  Have milestones for concrete SCRM improvement measures been set?
  Have the key implementation responsibilities of these concrete improvement measures been defined and assigned?
  Have the key responsibilities for the monitoring and maintenance of these implemented improvements been defined?

Extract from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Series-Editor: Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

How to audit SCRM? Conducting the Audit (7/9) List of questions (part b)

Below is a list of questions that can be used to audit the SCRM, concerning the topicsEvaluation and Prioritization and Governance and Management.

Evaluation and Prioritization Are supply chain risks assessed qualitatively where possible?
  Was an evaluation of the supply chain risks (e.g. top 10) carried out?
  Is the assessment of supply chain risks based on internal company figures/data/facts and not exclusively on gut-feelings and/or experience?
  Is the assessment based on external sources/databases whenever possible?
  Are the consequences of the most important supply chain risks well understood?
  Are supply chain risks assessed quantitatively, where possible?
  Are the risk assessments continually monitored and updated as changes occur?
  Are risk assessments monitored by at least two people (dual control principle)?

Governance and Management

Are there regular internal departmental exchanges when reducing or avoiding supply chain risks?
  Are there regular internal departmental exchanges regarding the measures taken to reduce or avoid supply chain risks?
  Are there clearly defined key supply chain risk thresholds that trigger response actions if exceeded?
  Are these thresholds well-known among all relevant employees?
  Are measures to reduce strategic supply chain risks regularly developed?
  Are efforts made to use alternative and multiple suppliers as much as possible to avoid single-sourcing?
  Are there plans or checklists in place that outline procedures for after a supply chain risk (e.g. supply chain disruption) has occurred?
  Is the internal responsibility and ownership of different supply chain risk scenarios clearly defined?
  Are individual components of SCRM included in target agreements between managers?

Extract from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Series-Editor: Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

MBP 10/16 Measures and Best Practices on “Supply Chain Risk Assessment / Prioritization”

“The creditworthiness of the company, the seriousness, the situation, whether the competition is being supplied should all be checked. Then, the company size, know-how, innovation and investment levels, and, of course, the technical performance were considered. Whenever a delta was found, whenever a comparison between what we wanted and what the supplier had, was made, then a risk was at minimum identified; the risk was then evaluated and remedial action was taken”. (Interview – Senior Director Supply Chain Management, Engineering)

The risk identification is followed by a risk analysis, which focuses on the causes and sources of risks. In addition, the positive and negative extent of the previously identified risks and their probability of occurrence are analyzed. The risk analysis is subsequently followed by the risk assessment phase, in which the order of priority with which the risks must be addressed is determined, based on the results of the risk analysis (Purdy 2010, p. 884).

In the numerous expert interviews and focus groups with company representatives and scientists for the development of the maturation model, the following measures were identified:

  • Do not limit the assessment and prioritization of supply chain risks to the specifications set by management in order to meet their legal requirements. For example, list the top 10 overall risks which include an assessment of the probability of occurrence and extent of damage from each risk.
  • Perform the assessment of operational and strategic supply chain risks at regular intervals.
  • Try to use semi-quantitative (FEMA, fault tree analysis, etc.) and quantitative methods (sensitivity analysis, risk simulation, value at risk) in addition to qualitative methods (surveys, estimates, etc.).
  • Define criteria and thresholds that can be uniformly applied to evaluate risks.
  • Ensure inter-departmental communication regarding supply chain risk assessments so that each department is prepared for an individual risk.
  • Ensure that the supply chain risk assessment can be quickly adjusted to keep it current as the risk situation changes.
  • For long-term evaluation, ensure that the results can be compared with previous quarters.
  • When assessing and prioritizing supply chain risks, try to avoid updating the current risk report at regular intervals so that each year, previous and current year, will be viewed independently. Every assessment should be “started from scratch” at regular intervals.  
  • Create a comprehensive data model for the evaluation of supply chain risks in order to be able to make both qualitative and quantitative assessments.
  • Use algorithms to determine how each product/part affects sales numbers in order to quantify the extent of damage.
  • Develop company-specific risk indices to evaluate and consider various scenarios (for example, using Monte Carlo simulation).
  • If relevant, reconcile the downstream supply chain stages instead of evaluating supply chain risks.
  • Try to derive trends from the overall performance of key indicators using algorithms. These algorithms should recognize patterns in the database of preventive risk assessments and consider the external value creation of given supply chain points. Additionally, the calculation should perform a “predictive analysis” to isolate possible defaulting suppliers.

Extract from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Series Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

Suche in OpenEdition Search

Sie werden weitergeleitet zur OpenEdition Search