How to audit SCRM? The preparation phase (2/9): roles and responsibilities

In the preparation phase of an audit, decisions must first be made regarding responsibilities. The main responsibility for conducting audits is typically assigned to top management, usually without specifying this in more detail. However, only isolated exceptions refer to the management board at this point. The tasks to be performed vary, based on the individual norms and standards. While some are limited to the establishment of a monitoring process, others refer to the assignment of operational responsibilities and the definition and effective implementation of auditing objectives and policies. The responsibility of communicating the importance of process improvement and efficiency enhancement—the primary responsibilities of an SCRM audit—rests with top management, analogous to a risk management audit.

In addition to these primary responsibilities, the person(s) responsible for auditing must be determined. The selection must be made in compliance with auditing principles such as objectivity and independence. In addition to the auditing principles, the auditor should have certain auditing experience and, above all, methodological and technical knowledge. These strict prerequisites often lead to the formation of an auditing team in order to fully cover all requisite competencies. These prerequisites can also be applied to an SCRM audit.

As such, the questions which must be answered at the beginning of an SCRM audit are:

Was an SCRM auditing goal set?
Has a decision been made as to whether the audit should be ad hoc or part of a continuous audit program?
Were the SCRM auditing goals communicated to all interested parties?
Was it determined who would undertake the primary responsibility for the SCRM Audit?
Who will be the responsible SCRM auditor?
Has an SCRM audit team been assembled to support the auditor?
Is the SCRM audit team composed of employees from different departments?
Did the selection of the SCRM auditor consider the separate auditor qualification requirements?
Is the SCRM auditor’s objectivity ensured with regard to the performance and the review of the SCRM audit?
Is the objectivity of the SCRM audit team ensured with regard to the performance and review of the SCRM audit?
Have all the associated costs of the SCRM audit been considered?       
Are sufficient physical independent premises available to carry out the SCRM audit?      
Are all necessary information and communication technologies available to the SCRM audit team?            

Extract from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Series-Editor: Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

How to audit the SCRM? Preparation of an SCRM Audit (Part 1/9)

Long-term efficiency of the SCRM process can only be achieved if comprehensive monitoring of the SCRM implementation process is performed in all phases. To this end, SCRM-related auditing is a suitable method.

In risk management literature, the additional process monitoring for the risk management process is being actively discussed but has not yet been applied to SCRM. Since there has been no attempt to date to develop SCRM auditing, either within the scientific literature or in practice, this topic has been addressed as part of our research.

Extract from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Series-Editors: Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

How can supply chain risk management be implemented?

When introducing SCRM, organizational, technological, and personnel aspects should be taken into account. At the same time, structural aspects should be aligned with the individual phases of the SCRM process—risk identification, analysis, management, and control (process). Method catalogs were created as a further component

Relevant Aspects  
  • Awareness of SCRM should be raised among employees
  • Heterogeneous team composition is advantageous (i.e. representatives from purchasing, supply chain management, IT, quality management, etc.)
  • Team members must have sufficient capacity (available working hours)
  • Integration of SCRM into existing units (e.g., Purchasing, Global Distribution Fulfillment)
  • Support of the project by management
  • Appointment of a project manager who coordinates the SCRM process, collects necessary data/documents, and consolidates the results
  • Regular supplier evaluation—especially for critical suppliers. Clustering according to cash turnover is recommended
  • Complete documentation (e.g. defective rate, special releases, delays, etc.)
  • Regular exchange of information with suppliers such as forecasts, ERP system information, etc.
  • SCRM process support from an IT system
  • Integration into existing IT systems (e.g. ERP) and access to the same data sources (e.g. sales and purchasing) can be advantageous
  • Conducting audits to identify supplier weaknesses

For the SCRM implementation process, the first step is to raise awareness among employees. Internal company events and attendance at specialist conferences or external training events on this topic are, for example, suitable for this purpose.

In addition, a heterogeneous team composition is ideal. If, for example, employees from purchasing, supply chain management, IT, and quality management work together on the SCRM team, a cross-departmental exchange of information is ensured. Additionally, the hierarchical and functional composition of the SCRM team must be considered.

In general, it must be ensured for the implementation process that the team members are motivated and have available capacity (working hours) so that the employees involved do not see the implementation of an SCRM system as an additional workload.

Furthermore, an SCRM team leader should be appointed to coordinate the SCRM process, collect the necessary data or documents, and consolidate the results so that continuous processing of the SCRM is ensured. The associated shift of decision-making authority to the SCRM team is also critical to performance success. Management support for the SCRM is particularly critical here.

From an organizational perspective, a decision must be made at the start of implementation as to whether the SCRM should be integrated into the existing organization or whether a restructuring should be sought. It should be noted here that, particularly in the case of SMEs , integration into an existing department is seen as advantageous. In addition to an increase in the acceptance of SCRM-related measures by other employees, a better exchange of information from this step can be guaranteed.

Furthermore, regular supplier evaluations, especially for critical suppliers, (e.g. clustering by sales) should be integrated into the implementation process, accompanied by complete documentation on aspects such as error rates, special approvals, delays, etc. A continuous exchange of information with suppliers (e.g., via forecasts or ERP system) helps to identify possible failure risks at an early stage.

In terms of technological implementation, the SCRM process should be supported by an easy-to-use IT system; however, isolated solutions should be avoided here. Access to the same data sources by different departments, such as sales and purchasing, also promotes an exchange of information. Associated reporting is also critical for SCRM success. The frequency of reporting, the volume of reports, and the specified group can promote or hinder the SCRM process.

Excerpt from Kersten, W.; Feser, M.; Schröder, M. (2013): Situationsadäquate Implementierung eines Supply Chain Risk Managements, Bundesvereinigung Logistik e.V. (BVL) – Schlussbericht des geförderten Vorhabens 17234N.

Changes in Risk Management via Big Data

The meaningful and beneficial evaluation of large amounts of unstructured data is the next important step for effective risk management as a whole to take. This challenge, along with several other new, pertinent challenges, will be briefly summarised below (Rogers 2017): 

  • The integration of Big Data into the risk management process will be further expanded in the future. Thus, both the accessibility and validation of the data and the use of corresponding analysis and evaluation tools will play a central role. 
  • Within the scope of risk identification, preliminary considerations should therefore be made to address questions such as “Who feeds the data?”, “How can the timeliness, completeness and compatibility of the data be ensured?”, and “How can data quality be guaranteed? 
  • It may also be necessary to adapt customized procedures in order to use limited resources sparingly: for example, it is advisable to first define the goal of data analysis (e.g. predicting the risk of Ebola infection) instead of trying to draw as many evaluation options as possible from an available data set without a specified goal in mind.
  • For better, more extensive data availability in the future, risk management must be geared more strongly towards interdisciplinary cooperation within companies. At the same time, as shown above, a multitude of departments may benefit from the evaluation of the results. 
  • For data processing, the correct IT tools–Amazon Elastic MapReduce, Microsoft Azure Cortana Analytics Suite–must be used to efficiently identify the required information (e.g., implementing machine learning and artificial intelligence).
  • However, the continuous analysis of unstructured data cannot be mastered by IT tools alone; the support of experts, i.e. data scientists, who perform technical data analysis and provide decision assistance is also necessary. This includes, among other things, a manual cleansing of raw data to increase data quality and the programming of algorithms for the automatic use of real-time data.
  • The increased emphasis on data analysis in risk management will thus lead to a division of responsibilities between data scientists and risk managers.
  • In the future, one of the risk manager’s core tasks will be to consider the results of data analysis as a forecasting aid in management decisions. 
  • The primary tasks will consequently become more data-driven, and, as a result, the demands on the qualifications of risk managers will also change.
  • The automated research and evaluation of real-time information will lead to a reduction in the manual activities of the risk manager. This leaves more time for analytical and strategic tasks, i.e. medium and long-term solutions can be developed based on the results of Big Data Science (Al-Khazrage 2018, p. 58). 

It should be noted that the use of Big Data in risk management is associated with various outcomes. In order to prepare for these outcomes, companies should–depending on their resources–initiate appropriate measures at an early stage. 

Excerpt from Schröder et al. 2019, Neue Anwendungsmöglichkeiten für Risikomanagement durch die Einsatz von Big Data – Zwei Fallbeipspiele, in: Schröder, Meike; Wegner, Kirsten (eds.) Logistik im Wandel der Zeit, Springer: Wiesbaden, pp. 121-136.


MBP 2/16 Measures and Best Practices for “Involving and Persuading the various Management Tiers”

“A decisive factor is the mindset of the executives. They must be open to the subject.” (Interview – Head of Logistics, Food Industry)

The SCRM owners can come from different hierarchical levels. The greater the involvement of higher and top level management in the SCRM, the greater the importance that will be ascribed to the topic within the company. 

In the numerous expert interviews and focus groups with company representatives and scientists for the development of the maturation model, the following measures were identified: 

  • Try to make the SCRM visible in the organizational structure–for example, create employee requirements or integrate the SCRM practices directly and openly into operations.
  • Supply chain risk information should be included in senior management decisions. To do this, ensure a consistent relay of information.
  • Promote risk awareness among management and employees by regularly highlighting positive successes and negative consequences.
  • Proactive supply chain risk measures should be rewarded. Create incentives to proactively take supply chain risk measures.
  • Try to involve management in SCRM as much as possible (e.g. participation in interdepartmental meetings, regular provision of information, distribution of status quo reports, etc).
  • Create binding guidelines or procedural instructions to increase the commitment of handling SCRM and ensure that these are adhered to. Make sure that management is strongly involved in this process.
  • Ensure that SCRM is a regular component of those meetings (planning meetings, strategy meetings, etc.) which involve management; otherwise, ensure management is informed about the respective details discussed therein. Ideally, the entire management team should come to support SCRM. Extensive financial investments should be made to the SCRM framework.
  • Ensure that significant investments are made in the SCRM.

Extract from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Reihen-Hrsg.: Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

MBP 1/16 “Responsibilities and Extent of Subject Processing

“Transparency should be achieved in a coordinated manner, via a very carefully constructed team with clear responsibilities” (Interview – Risk Manager, Aviation)

In addition to the responsibilities for SCRM, decisions must consider the time constraints of employees (Schröder et al. 2013a, p. 5). The required personnel hours vary from a few days a year to a few hours a week and will include a scope of work beyond that of the acute handling of previous supply chain risks. The larger the company, the more time is usually spent on handling SCRM. However, this is only the case if there is strong management interest in the topic.

In numerous expert interviews and focus group discussions with company representatives and scientists, the following measures -which build on each other- were identified during the development of the maturity model: 

  • Identify the core issues in your company. To what extent are these core issues affected by Supply Chain risks? What is your goal? What do you want to achieve? How can you influence these core concerns?
  • Ensure sufficient human resources to support those responsible for SCRM.
  • Define individual persons responsible for each given SCRM category and make sure to include at least one other employee in addition to the head of the department.
  • When integrating the SCRM organization, take into account that the integration depends on a number of context factors, such as the size of the company, the structure and complexity of the SC, and the dynamics of environmental influences.
  • Find out whether best practice examples for SCRM already exist in your company or whether there are examples from elsewhere in the respective field.
  • Try to not hang the topic of SCRM on the shoulders of just one person at your company.
  • Try to integrate individual components of SCRM into your daily tasks.
  • Create a responsibility matrix that shows which departments perform full or limited tasks.
  • In addition to regular staffing, form an SCRM team consisting of employees from different departments, who then regularly meet to exchange information and play through various relevant scenarios.
  • Define a point person responsible for SCRM, who develops and promotes company-wide SCRM strategies.
  • Try to integrate SCRM into both the organizational and operational structure.

Excerpt from Schröder, M. (2019): Structured improvement of supply chain risk management. In: Supply Chain Management – Contributions to Procurement and Logistics, Reihen-Hrsg.: Essig, M.; Stölzle, W., Kersten, W., Springer Gabler: Wiesbaden

Suche in OpenEdition Search

Sie werden weitergeleitet zur OpenEdition Search