The structures, roles, policies, and decision rights that define who owns supply chain risks, how they are escalated, and how trade-offs are made.

Key Risk Indicator (KRI)

A metric that provides early warning about increasing exposure to risk, such as single-source dependency or concentration in a high-risk region.

Key Performance Indicator (KPI)

A metric that measures performance outcomes, including resilience outcomes like on-time in-full (OTIF) during disruptions or cost of supply interruptions.

The system of roles, responsibilities, policies, and decision processes through which an organization directs and controls activities like SCRM.

What is Risk Appetite?

The level and types of risk an organization is prepared to take to achieve its goals.

What is On-time In-full (OTIF)?

A common logistics KPI measuring the percentage of orders delivered both on time and in the correct quantity.

What is Key Risk Indicator (KRI)?

A forward-looking metric that signals rising exposure to a specific risk.

Governance, Metrics, and Embedding SCRM in the Organization — Supply Chain Risk Management: From Vulnerabilities to Resilience

Step 1: Why Governance and Metrics Matter for SCRM

From Projects to Embedded SCRM

Earlier modules covered data and crisis response. This module explains how to embed supply chain risk management (SCRM) into everyday governance, metrics, and strategy so it is routine, not a one-off project.

Why This Matters in 2026

By mid‑2026, leading firms treat SCRM as part of enterprise risk management (ERM). Boards, regulators, investors, and customers expect evidence of supply chain resilience, not just low cost.

Regulatory and Market Drivers

EU rules like CSRD (in force from 2024) and the emerging CSDDD, plus SEC climate disclosure rules and investor pressure, push companies to show how they manage supply chain risks.

Three Pillars of Embedded SCRM

Governance structures and roles. 2. Key risk indicators (KRIs) and performance metrics. 3. Integration with ERM and strategy. The next steps unpack each pillar with practical guidance.

Step 2: Typical SCRM Governance Structures

Governance Needs Structure

Embedding SCRM requires clear structures and decision rights. Typical elements: board oversight, a cross-functional SCRM committee, operational roles, and formal policies and standards.

Board and Executive Oversight

A board Risk Committee and an executive sponsor (CRO, CSCO, or similar) receive updates on major supply chain risks and set overall direction and risk appetite.

Cross-functional SCRM Committee

A Supply Chain Resilience Committee includes procurement, operations, logistics, finance, IT/cyber, sustainability, quality, legal, and ERM. It reviews dashboards, approves policies, and prioritizes mitigation.

Operational Roles

Category managers assess risks for their suppliers, analysts maintain data and models, BCM/resilience teams align plans, and IT/cyber manage digital supply chain risks.

Policies and the Governance Pyramid

A written SCRM policy and supporting standards guide daily decisions. Picture a pyramid: board and C‑suite at the top, the SCRM committee in the middle, and operational roles at the base.

Step 3: Map SCRM Roles in a Real Organization

Use this thought exercise to connect governance concepts to a realistic setting.

Your task (3–4 minutes):

Pick an organization

Choose either:
A company where you have worked or interned, or
A well-known company (for example, Apple, Toyota, Zara, or a large supermarket chain).

Identify who likely plays each role (write this in your notes):

Board / executive sponsor: Who would own supply chain risk at the top level? (e.g., Chief Operations Officer, Chief Risk Officer)
Cross-functional committee: Which departments would need to be at the table? List at least 5.
Operational owners: Who would:
Assess supplier risk?
Maintain risk dashboards?
Lead business continuity for supply disruptions?

Spot potential gaps

Is there a clear single point of accountability for SCRM?
Are IT/cyber and sustainability/ESG included, given digital and ESG-related supply chain risks?

Reflect (1–2 sentences)

Where do you think this organization is strong in SCRM governance?
Where is it vulnerable (for example, no cross-functional forum, or risk is treated as “procurement’s problem” only)?

Use your notes as a reference when you reach the quiz and later modules on strategy and investment.

Step 4: From KRIs to KPIs – Measuring Risk and Resilience

KRIs vs KPIs

KRIs are early-warning metrics about risk exposure. KPIs track performance outcomes, including resilience. Effective SCRM uses both and links them together.

Operational KRIs

Examples: percentage of single-source spend, lead time volatility, number of suppliers in high-risk regions, and share of critical suppliers without tested continuity plans.

Financial and Service KPIs

Examples: on-time in-full (OTIF) during disruptions, revenue at risk if a key supplier fails, and disruption costs such as expedited freight and lost sales.

ESG and Compliance Indicators

Under rules like CSRD and emerging CSDDD, firms track supplier ESG audits, confirmed labor or environmental incidents, and remediation times as part of SCRM.

Resilience Capability Metrics

Resilience metrics include time to detect and recover from disruptions and the percentage of critical suppliers with dual sourcing or alternative routes.

Step 5: Example – Designing a Simple SCRM Dashboard

Scenario: Electronics Manufacturer

You are designing a monthly SCRM dashboard for an electronics firm relying on Asian suppliers. The goal is a one-page view for the Supply Chain Resilience Committee.

Section 1: Risk Exposure (KRIs)

Dashboard KRIs: 45% of critical parts single-sourced, 70% of semiconductor spend in one country, and 3 of top 20 suppliers flagged as high financial risk.

Section 2: Resilience Capabilities

Metrics: 60% of A‑class items dual-sourced, 50% of critical suppliers with tested continuity plans, median 2 days to detect and 5 days to workaround disruptions.

Section 3: Performance Impact (KPIs)

KPIs: OTIF 96% in normal weeks vs 89% during a port strike, plus $1.2M in extra air freight last quarter due to late supplier deliveries.

Section 4: Actions and Visual Layout

Actions: qualify second sources, demand continuity plans, escalate geographic concentration. Visually: region heat map, dependency bar chart, OTIF trends, and a top‑5 risk table.

Step 6: Design Your Own KRI Set

Apply what you have learned by sketching a KRI set for a specific product or supply chain.

Your task (3–4 minutes):

Choose a product or service

Example options:
A smartphone
A supermarket’s fresh produce line
A hospital’s supply of critical medicines
A clothing retailer’s seasonal collection

List at least 3 KRIs and 2 KPIs

For each KRI, describe:
What it measures (for example, percentage of volume from one country).
Why it is a risk early-warning.
For each KPI, describe:
The performance or resilience outcome (for example, OTIF during peak season).
How it links back to your KRIs.

Set simple thresholds

For each KRI, define:
A green range (acceptable).
An amber range (needs monitoring).
A red range (requires action and escalation).

Reflect briefly

Which of your KRIs would be most useful for a board-level conversation?
Which are more relevant for operational teams (buyers, planners)?

You can compare your list with the example dashboard from the previous step and refine it.

Step 7: Integrating SCRM with ERM, Strategy, and Investment

SCRM in ERM

Supply chain risks should appear in the enterprise risk register, using frameworks like COSO ERM or ISO 31000, with SCRM KRIs feeding the overall risk dashboard.

Impact on Strategy

SCRM influences strategic choices: make-or-buy, nearshoring vs offshoring, supplier portfolio design, and decisions about inventory and capacity buffers.

Capital Allocation

Investments in warehouses, dual sourcing, and IT visibility should be evaluated using risk-adjusted return, not just immediate cost savings.

Sustainability and Regulation

Under CSRD and similar rules, SCRM aligns with ESG due diligence to manage and disclose sustainability-related risks in supply chains.

Learning from Crises

Real disruptions drive updates to KRIs, governance structures, and strategy, creating feedback loops between crisis response and long-term planning.

Step 8: Quick Check – Governance and Metrics

Test your understanding of how governance and metrics embed SCRM in organizations.

Which combination best shows that SCRM is truly embedded in an organization?

Procurement tracks supplier prices monthly, and a crisis team meets only during major disruptions.
A cross-functional SCRM committee reviews KRIs and KPIs regularly, SCRM risks appear in the enterprise risk register, and supply chain risk is considered in major investment and sourcing decisions.
The logistics team monitors delivery delays, while the sustainability team separately audits suppliers for ESG issues, with no shared dashboard.

Show Answer

Answer: B) A cross-functional SCRM committee reviews KRIs and KPIs regularly, SCRM risks appear in the enterprise risk register, and supply chain risk is considered in major investment and sourcing decisions.

Option 2 is correct because it includes cross-functional governance, regular review of KRIs/KPIs, integration with ERM, and explicit influence on investment and sourcing decisions. The other options describe fragmented or reactive practices.

Step 9: Key Term Review

Use these flashcards to reinforce the main concepts from this module.

Supply Chain Risk Management (SCRM): A structured approach to identifying, assessing, mitigating, and monitoring risks across the end-to-end supply chain, integrated with daily operations and strategic decisions.
Governance (in SCRM): The structures, roles, policies, and decision rights that define who owns supply chain risks, how they are escalated, and how trade-offs are made.
Key Risk Indicator (KRI): A metric that provides early warning about increasing exposure to risk, such as single-source dependency or concentration in a high-risk region.
Key Performance Indicator (KPI): A metric that measures performance outcomes, including resilience outcomes like on-time in-full (OTIF) during disruptions or cost of supply interruptions.
Enterprise Risk Management (ERM): An organization-wide process for identifying, assessing, and managing all major risks in an integrated way, often using frameworks like COSO ERM or ISO 31000.
Risk Appetite: The amount and type of risk an organization is willing to accept in pursuit of its objectives, for example, acceptable levels of single-source dependency.
Supply Chain Resilience Committee: A cross-functional group (procurement, operations, finance, IT/cyber, sustainability, etc.) that oversees SCRM policies, reviews risk metrics, and prioritizes mitigation actions.

Key Terms

Governance: The system of roles, responsibilities, policies, and decision processes through which an organization directs and controls activities like SCRM.
Risk Appetite: The level and types of risk an organization is prepared to take to achieve its goals.
On-time In-full (OTIF): A common logistics KPI measuring the percentage of orders delivered both on time and in the correct quantity.
Key Risk Indicator (KRI): A forward-looking metric that signals rising exposure to a specific risk.
Business Continuity Plan (BCP): A documented plan that outlines how an organization will continue operations during and after a disruption.
Key Performance Indicator (KPI): A metric that tracks how well a process or system is performing against its objectives.
Enterprise Risk Management (ERM): An integrated framework for managing all major risks across an organization, often overseen by a board or risk committee.
Supply Chain Risk Management (SCRM): A structured, ongoing process to identify, assess, mitigate, and monitor risks across the end-to-end supply chain.
CSRD (Corporate Sustainability Reporting Directive): An EU directive that, from 2024 onward, requires many companies to report in detail on sustainability risks and impacts, including those in supply chains.
CSDDD (Corporate Sustainability Due Diligence Directive): An EU initiative (still being finalized as of 2026) that aims to require companies to conduct due diligence on human rights and environmental risks in their value chains.