Risk management professionals conduct supply-chain analyses to identify

Within the ISO 31000 framework, supply-chain analysis is a fundamental activity in the risk identification process (Clause 6.4.2). The primary objective is to systematically examine the network of suppliers, manufacturers, distributors, and customers to identify and understand potential weaknesses, dependencies, and points of failure. These are the vulnerabilities that could be exploited by risk sources (e.g., natural disasters, geopolitical events, supplier failure), leading to disruptions that negatively impact the organization's objectives. The analysis provides the necessary input for assessing and treating supply-chain risks.

A. Contingent business interruption coverage is a form of risk treatment (specifically, risk financing), which may be chosen after vulnerabilities are identified and assessed, not the purpose of the analysis itself.

B. Customer technology needs are typically identified through market research or product development processes, not through a risk-focused supply-chain analysis.

C. International regulatory requirements are a potential source of risk, but the analysis is much broader, encompassing operational, financial, and strategic vulnerabilities across the entire supply chain.

1. ISO 31000:2018

Risk management — Guidelines

Clause 6.4.2

"Risk identification": This clause states the purpose of risk identification is to "find

recognize and describe risks that might help or prevent an organization achieving its objectives." Supply-chain analysis is a method to find and recognize such risks originating from external dependencies and vulnerabilities.

2. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886. https://doi.org/10.1111/j.1539-6924.2010.01442.x. This article discusses how the ISO 31000 framework applies to various contexts. Applying its principles to a supply chain inherently involves identifying vulnerabilities (potential risks) to manage them effectively (p. 883).

3. MIT Center for Transportation & Logistics. (2014). Supply Chain Vulnerability. White Paper. The research from this center consistently frames supply chain risk management as the process of identifying vulnerabilities and building resilience. The initial step is always to "understand the sources of risk and where the supply chain is vulnerable" (p. 2).