You can build a solid financial plan, commit to an EBIT target, and present a confident forecast to your board. But how much of that plan depends on a supply chain you cannot fully see, predict, or control?

Supply chain risk is not just an operational problem. It directly threatens financial performance and your credibility as CFO. One supply chain disruption can erase 30-50% of a year’s EBITDA (McKinsey). Often 50-80% of your revenue depends on a supplier network you don’t control.

Here is what is at stake:

EBIT and profit: Expediting fees and emergency freight quietly eat the margin you promised the board. Production stoppages, lost sales, idle capacity, and unexpected sourcing costs turn planned profit into missed targets.

Cash flow and working capital: Disruptions force unplanned spending, tie up cash in precautionary inventory, and delay customer payments. Regulatory failures can trigger penalties, compensation claims, and additional costs.

Forecast accuracy: Every supply chain shock that hits cash flow makes your forecasts look wrong. Every unexpected revenue shortfall puts your financial plan under pressure.

Your credibility & reputation are on the line: This is where the issue becomes personal. When your financial commitments repeatedly miss the mark due to supply chain issues, your credibility is on the line.

What should CFOs do now?

Sit at the table when the risk map is built.

Demand a clear picture of exposure.

Demand a clear picture of exposure.

Insist on prevention, not just crisis response.

Make risk management cross-functional

Build supply chain risk into your financial governance

Supply chain risk is a finance risk. Treat it like one, or keep explaining variances you could have seen coming. Supply chain risk belongs on the CFO agenda. The CFO who owns it walks into the next earnings call with answers.

Now, let’s turn those insights into capability. Build people and organizations who are ready to act. My training/workshop will perfectly prepare you for it.
—-
Hi. I am Jan, your SCRM Builder. Not a consultant who theorizes about risk. A procurement leader and risk practitioner who has built 15 SCRM programs globally, trained 1,200 people, and led procurement and risk organizations through crisis. I share what works and help you build an effective SCRM. I work globally.

The post CFOs: Supply chain risk is a finance risk. appeared first on targetP.

The well-known and widely used 3 Lines of Defense model was developed for institutional risk management in finance. Despite years of criticism, too many risk professionals still treat it as the holy grail and believe they can use it across organizations for all kinds of risk management activities.

My experience: For SCRM, the model is not usable at all. However, even the big four consulting firms still bother their clients with this ineffective approach. Experienced supply chain (risk) experts never work with it. So do I, and based on 18 years of building SCRM systems across 15 companies, I developed and use a dynamic five-level risk model that translates the lines-of-defense principle into something that actually works in practice:

Level 1: SCRM Culture Framework: The foundation everything else rests on. If the culture doesn’t support early flagging, transparency, speaking up, and cross-functional accountability, no process or system will compensate. Culture is not soft. It is the prerequisite.

Level 2: Governance & Competency Framework: Strategy, roles, responsibilities, and the skills to execute them. Here, the CPO and procurement leadership define what SCRM means for the organization and how they operationalize it. And this is where the organization becomes agile and responsive.

Level 3: Category & Supplier Portfolio/Network Management: The analytical core: category and market analysis, supplier portfolio assessment, and a risk-centered sourcing strategy. This is where procurement teams actively manage exposure.

Level 4: Core Process Framework: SCRM embedded into daily procurement operations: supplier qualification and onboarding, sourcing and re-sourcing decisions, and ongoing supplier network management

Level 5: Technology Framework: Digital supply chain monitoring running 24 hours a day, 365 days a year. AI-supported signal detection, automated alerts, pattern recognition, scenario modeling, impact analytics. Technology does not replace human judgment.

The critical principle behind this model: These five levels are not silos. Insights from the process level feed back into portfolio strategy. The technology layer supports all operational levels simultaneously. The culture layer at the top is why it all works under pressure. SCRM is never static. The moment you treat SCRM as a project, you have already fallen behind. Forever!

Now, let’s turn those lessons into capability. Build people and organizations who are ready to act. My training/workshop will perfectly prepare you for it. Hi. I am Jan, your SCRM Builder. Not a consultant who theorizes about risk. A procurement leader and risk practitioner who has built 15 SCRM programs globally, trained 1,200 people, and led procurement and risk organizations through crisis. I share what works and help you build an effective SCRM. I work globally.

The post Multi-Layer-Defense Risk Management appeared first on targetP.

Genau darüber sprechen wir am 21. Oktober um 12:30 Uhr im Live-Webinar zur Digitalisierung des Einkaufs: ein interaktives Interview statt Folienschlacht.

Jan-Henner Theissen und Stefan Wiemers von targetP evolving procurement bringen Erfahrung aus über 30 digitalen Einkaufsprojekten mit und Bettina Fischer von Hivebuy die Perspektive aus dem operativen Alltag der Hivebuy Kunden.

Darum geht es:

< Standortbestimmung: Wie ehrlich ist Ihre Einschätzung des digitalen Reifegrads?

Zielbild statt Toolauswahl: Welche Optionen ergeben sich aus der Strategie?

All-in-One-Suite vs. Best of Breed: Kriterien, Fehlentscheidungen, Erfahrungen

Direkter und indirekter Einkauf: Ein System oder spezialisierte Lösungen?

Wer entscheidet eigentlich? Einkauf, IT oder SAP als Standardantwort

Hebel und Prioritäten: Welche Schritte zuerst, wie der Business Case entsteht<br>

Kosten und Risiko zusammen denken: TCO, Compliance, Risikoabdeckung<br><br>Im Anschluss gibt es eine Checkliste zur Standortbestimmung und Systemauswahl.

21. Oktober 2026, 12:30 Uhr, 45 Minuten inkl. Q&A

Anmeldung hier: https://www.hivebuy.com/webinar-digitaler-einkauf-ohne-blindflug

The post Digitalisierung Einkauf – Webinar appeared first on targetP.

Next episode of our series: Supply Chain Risk Management done right!

Incoterms can do more for you than you think. They are also a powerful risk tool and a risk decision. And that distinction costs companies more than they realize.

When you buy DDP (Delivered Duty Paid), your supplier owns the risk of getting goods to your door. Port congestion, customs delays, a freight rate spike: technically, that is their problem to solve. However, I would never recommend working that way. Solve it jointly, but remind your supplier that he must be an active problem solver!

When you buy EXW (Ex Works), you own all of that risk the moment the goods leave their factory floor. Neither is automatically the right choice. But the selection should be a deliberate risk decision, not a default inherited from a contract template from ten years ago.

Here are the questions every category/supply chain manager and buyer should be asking:

Where in the transport chain are our goods most exposed to disruption?

Which party, us or the supplier, is actually better positioned to manage that specific risk? Does our current Incoterm reflect where risk actually sits, or is it just what we have always done?

In a disruption scenario like a port closure, political instability, or a strike, does our Incoterm help or hurt us?

In high-risk sourcing regions, Incoterm selection can be one of the fastest, lowest-cost risk-mitigation levers available to procurement. It does not require a new supplier. It does not require a capital investment. It requires a conversation and a contract amendment. Yet it is rarely reviewed as part of your risk prevention and mitigation!

Now, let’s turn those lessons into capability. Build people and organizations who are ready to act. My training/workshop will perfectly prepare you for it.

—-

Hi. I am Jan, your SCRM Builder. Not a consultant who theorizes about risk. A procurement leader and risk practitioner who has built 15 SCRM programs globally, trained 1,200 people, and led procurement and risk organizations through crisis. I share what works and help you build an effective SCRM. I work globally.

The post Incoterms: A powerful risk management tool appeared first on targetP.

Next episode of our series: Supply Chain Risk Management done right!

What was the last supply risk your board actually decided on, rather than noted?

You know it: A plant is short on parts. Three customers want the same allocation. Everyone in the room has an opinion. Nobody has facts. As always! The risk register didn’t help, as always! It named the supplier, but it didn’t say which plants would stop, on what day, how much revenue was at stake, or who could spend to fix it.

Again, SCRM is more than predicting risks, listening to signals, or identifying risk.

It is about making educated decisions under pressure and high volatility.

It is about making better decisions faster, at the level where the risk actually lives. Everything else prepares you for that moment.

1⃣ WHICH DECISIONS ARE AT STAKE

Every one of these now rests on exposure the Board cannot currently see. That is why boards must demand it, not delegate it.

Strategy and footprint. Where we produce, source, and commit to markets.

Make or buy. Where we accept dependency and pay for backup.

Capital, inventory, and coverage. Where stock buys resilience, where it is dead money.

Allocation in a crisis. Which plants, customers, and orders get served first.

Commitments we sign. What we promise customers, what we accept from suppliers.

Five board-level decisions. You can’t make any of them well from a simple heat map.

2⃣ WHAT RISK MANAGEMENT MUST DELIVER

Stop producing risk reports. Start producing decision packages. The same five things, every time:

Transparency. Who supplies what, into which plant, at which tier.

Detection and validation. Signals defined, verified, turned into named exposure.

Impact. Revenue, output, customers, cash, compliance.

Scenarios. Best, expected, worst. Days of cover, time to recover.

Options and a recommendation. Two or three costed choices, trade-offs, one owner.

3⃣ WHAT THE BOARD MUST ESTABLISH

Your team cannot deliver the above alone. Only the board can provide guidance, set risk strategy and appetite, and criticality, mandate supplier, part, and plant data as a governed asset, fund the capability as a line item, name who may stop, spend, and commit within how many days, and put decision packages on a standing agenda instead of status slides.

No facts. No scenarios. No options. No decision.

Now, let’s turn those lessons into capability. Build people & organizations who are ready to act. My training/workshop will perfectly prepare you for it.

—-

Hi. I am Jan, your SCRM Builder. Not a consultant who theorizes about risk. A procurement leader & risk practitioner who has built 15 SCRM programs globally, trained 1,200 people, and led procurement and risk organizations through crisis. I share what works and help you build an effective SCRM. I work globally.

The post Risk Management: Make Better Decisions appeared first on targetP.

Next episode: Supply Chain Risk Management done right!

Many companies treat SCRM as an isolated project. They create registers, assess suppliers, and define mitigation plans. But: one critical perspective is often missing: THE CUSTOMER! Effective SCRM must be CUSTOMER-CENTRIC. That perspective works on two levels, and both determine whether it creates value or burns budget!

SCRM aligned with the customer

The ultimate purpose of managing risk is to protect the customer promise. Your customer does not buy your heatmap; he buys certainty. Certainty about delivery, quality, and integrity. And certainty that when something does go wrong, they hear it from you first. That’s why reliability, availability, and the ability to respond to changing customer expectations need to be at the heart of SCRM.

A risk only becomes truly relevant when we understand its potential impact on the customer. What happens to customer experience if a critical component is unavailable? What is the financial impact? And how much resilience is actually required to protect them?

This is where SCRM becomes a business capability. So the honest test for any SCRM setup is simple. Does it protect what the customer actually values? If your risk dashboard cannot be translated into those four things, it is an internal hobby.

Customer-centricity in the Supply Chain

SCRM cannot operate in isolation. All internal stakeholders have different needs and risk perspectives. The interaction across the entire value chain is the real success factor. Suppliers are not the object of the exercise; they are part of it. A supplier who understands why you ask for capacity data, and who gets something back for sharing it, will tell you about a problem weeks earlier.  Sales needs to know what it can promise. Production planning needs to know which components deserve a buffer. Finance needs to know which exposure is worth insuring. The board needs a view it can act on rather than a heat map in fifty shades of orange.

Your opportunity: Supply chain resilience can be monetized.

The cost of resilience can be linked to customer retention, revenue protection, service levels, and market opportunities. Risk insights can become part of Sales and Marketing strategies. It is about protecting the customer promise, enabling the business, and creating trust across the entire value chain. That makes risk management a competitive advantage in the good years and a life insurance policy in the bad ones.

Now, let’s turn those lessons into capability. Build people who are ready to act. Make SCRM work when it matters.

Hi. I am Jan, your SCRM Builder. Not a consultant who theorizes about risk. A procurement leader & risk practitioner who has built 15 SCRM programs globally, trained 1,200 people, and led procurement and risk organizations through crisis. I share what works and help you build an effective SCRM. I work globally.

The post Customer Centric Supply Chain Risk Management appeared first on targetP.

Next episode of our series: Supply Chain Risk Management done right!

Here is the part nobody puts in a framework document. It is also THE part that determines whether everything else works.  I have seen it in multiple organizations across different industries. A buyer spots a worrying signal from a supplier. They are not sure it is serious enough to escalate. They do not want to be seen as alarmist.  They wait:  Three weeks later, it becomes a crisis.

The process existed. The governance existed. The risk register existed. But the culture did not support early escalation. Nor was there any trust (remember my post 2 weeks ago?). And that made all the difference.

Risk culture is not a values poster on the wall. It comes down to one question:  „In your organization, what actually happens when someone flags a risk early?“
If the answer involves extra meetings, justification overhead, or quiet skepticism, you have a culture and trust problem, not a process problem.

Building a genuine risk culture means a few concrete things:
  Leadership visibly rewards early flagging, even when the risk does not materialize
  Leadership walks the talk and integrates managing risk into discussions, decisions, and processes – and they listen whenever they are asked to listen!
  Near-misses are reviewed without blame, not swept under the rug
  Risk is a normal topic in S&OP and supplier reviews, not a special escalation
  Cross-functional teams share ownership, so procurement is not carrying it alone
  Roles, responsibilities, and incentives get adjusted. Protecting the organization, its assets, and earnings becomes everyone’s responsibility by default.

My takeaway after years of building and leading supply chain risk organizations:
Culture is not just an enabler. It is THE enabler for managing supply chain risk organizations effectively.
Yes, culture change is slow. Process change is fast. Most organizations default to the fast option. And then they wonder why the processes never quite stick.
If you ignore building and maintaining a risk culture, you are going nowhere, wasting budget and time, and frustrating your entire organization!

This isn’t from a textbook or study; it is the experience of a practitioner who learned it the hard way.

The post Risk Culture Beats Every Risk Framework appeared first on targetP.