Terrorist attacks, natural disasters, armed conflict, ethnic violence, floods, famines, hurricanes, tsunamis ... have we reached the prophesied End Times? Probably not. But the recent string of catastrophes has certainly trained the spotlights on the need for disaster preparation.

No supply chain is immune from disruption. And no supply chain—regardless of type of commodity, material or product—is exempt from the need for recovery planning. Supply chains are too necessary for social and business survival. When a tsunami hits, we must get food to hungry people, and clothing to those without. When terrorists attack, we must still get goods to market. Failure to keep goods moving puts the entire company (not to mention its employees and business partners) at risk.

Dr. Yossi Sheffi of the Massachusetts Institute of Technology has conducted the most comprehensive research on this topic. In a miracle of timing, his book, The Resilient Enterprise, hit stores immediately after the most destructive hurricane season in memory.

But, of course, this isn't really about hurricanes; they merely serve as the latest reminder of the importance of resilience and of planning (one of the dreaded "P" words). And as daunting as the prospect of recovery planning may be, it beats the alternative!

In fact, the first step in recovery planning is hardly daunting at all. It's nothing more than identifying the threats. But it's important to keep in mind that supply chain threats aren't limited to natural disasters or internal mishaps (for example, a warehouse fire). Other threats might include supplier failures, new competition, quality failures, product tampering (internal or external), theft, financial irregularities, technology change, and the loss of a major customer.

As you draft your list, you might want to categorize the threats by the type of risk they pose. Some, like a production capacity shortage or a supplier failure, threaten your sources of supply. Others threaten demand for your product—think of skyrocketing fuel prices that cause SUV sales to collapse, a big customer's bankruptcy, or Wal-Mart's decision not to renew a contract. Still others threaten internal operations (a downed communication system, for example).

To help gauge each risk's likelihood and potential impact, some companies find it useful to create what's known as a "Johari window." You first assess each threat's probability—from low to high—and assign it to one of four boxes along one axis. You then assess its potential impact—from light to severe—and place it in the appropriate box along the other axis. The resulting diagram lets you instantly identify high-likelihood, high-impact threats.

Defensive maneuvers
Once you've finished brainstorming, you should have a list of what can go wrong, the chances of its happening, and how damaging it could be. The logical next step is to translate them into actionable items, aimed at reducing the impact of a disruption and enhancing your prospects of bouncing back quickly. Here are some key recovery principles:

• Interchangeability. Wherever possible, strive to make plants, people, parts, and processes interchangeable. This allows seamless re-routing to operations unaffected by a disruptive event.
• Redundancy. Build redundancy into your processes, power backup, information processing, employee skills, and inventories. This will enable you to re-route orders, processes, materials, and people to either points of need or points with available capacity.
• Postponement. Whenever possible, defer final manufacturing or mass customization to as late in the process as possible. This will allow you to shift final production to an unaffected facility with only minor accommodations, such as supplying country-specific labels.
• Strategic supply management. Spread your risks. This might mean lining up multiple sources of supply and a stable of service providers so that you'll have options in times of crisis. The key to making this work is the quality of communications and working relationships among the supply chain partners.
• Customer relations management. Put plans in place to protect key customers from the brunt of the damage, to communicate consequences and the next steps to employees and customers, and to demonstrate your commitment to helping customers harmed by the disruption to recover quickly. This presumes the pre-existence (yet another alarming "P" word!) of strong organization-wide relationships. Keep in mind that the time to start building these relationships is now—not after the catastrophe.
• Collaboration on security. Where possible, work with supply chain partners, industry groups, and government agencies to strengthen both domestic and international security.

Culture shock
Of course, these recommendations assume that your business is both flexible and capable of executing these steps effectively. If it's not, no one will take your plans seriously, and your work will be wasted. So, all of the rah-rah talk about doing the right things for the right reasons turns out to have business relevance and a bottom-line payoff.

Does this mean that a company needs to appoint a CRO, or Chief Resilience Officer? Probably not. Dr. Sheffi believes that resilient enterprises have resilience buried deep in their DNA—that the culture breeds resilience. We lean in that direction, too. And we hardly think that adding another layer of management is the best way to promote resilience. It does seem, however, that the person responsible for supply chain management would be the logical candidate to head the recovery planning.

In just a few short years, resilience, once the burden of an unlucky few, has become a fundamental requirement for business survival in a complicated, interdependent and dangerous world. On the bright side, the same qualities that make a company more resilient also make it a stronger competitor. And catastrophic events, managed well, can give an enterprise a very public chance to shine in front of its customers. How many opportunities does one get to advance the cause of "customers for life"?