Risk analysis and assessment tools

Once the risks have been identified and structured with the help of the classification, the second step is the analysis and assessment. The second phase is, therefore, based on the results of the first, and is composed of a quantitative or semi-quantitative assessment of the identified supply chain risks. Such a list should be as complete and continuous as possible (Ho et al. 2015, p. 5032; Denk et al. 2008, p. 102).

Quantitative methods presuppose risk-relevant information and enable supply chain risks to be “calculated” to the greatest possible extent. Methods used in this context include, for example, cash flow at risk, real options, simulation methods, and decision tree methods (Burger & Buchhart 2002, p. 103; Fiege 2006, p. 167; Wildemann 2006, p. 112; Bergener 2006, p. 295).

Semi-quantitative methods are also based on quantitative data, but unlike quantitative methods, these are obtained via qualitative methods. Here, for example, risk portfolios, scoring procedures, and supplier evaluations are used (Janker 2008; Wildemann 2006, p. 148).

If quantification is not possible due to a lack of available data, a qualitative risk assessment is carried out. The assessment is based on suitable criteria selected by the user (Handfield & McCormack 2008, p. 101; Denk et al. 2008, p. 106). The criteria “intensity of damage” and “probability of occurrence” are frequently used, which lend themselves to visualization in a risk matrix (also called risk map) (Sodhi et al. 2012, p. 35 and Fig. 3-4). The individual risks are entered on the axes of the risk matrix on the basis of the values of the two criteria. Depending on the scaling of the axes (ordinal or cardinal), the individual risks can be represented using qualitative or quantitative criteria. If there is insufficient data for quantitative classification, the supply chain risks are classified in the qualitative assessment using the probability of occurrence categories “low,” “medium,” and „high”, and the extent of damage categories “insignificant,” “moderate,” and “significant.

In addition to portfolio analyses, risk profiles and risk rankings can be cited as further methods within the framework of qualitative procedures (Wildemann 2006, p. 148).