Risk treatment/management
The third step in Ericsson’s process is called risk treatment, which includes both
developing risk mitigation strategies and deciding on those. This is a line
responsibility, and who is doing it depends on which tier the risk source is part of:
for higher tier, supplier sourcing is responsible, while for lower tier, the supply chain
manager (Figure 6), and for internal plants it is production. Standard templates and
tools for this (Figure 10) are developed by the SCR manager. Those templates start
with describing the risk source and its probability and consequence, and continue with
a summary of different mitigations strategies, their costs and how they affect the risk
situation. To compare the cost of different preventive actions with the business
interruption value is regarded as very important. Finally, responsible persons are
appointed.
Risk monitoring and follow-up
If the risk level is very high, or high and not mitigated, risk monitoring is required. If
the residual risk, after mitigation, is not reduced to an acceptable risk level it must
continue to be monitored. Risk assessment and treatment templates (Figure 10) and
“the spider web” (Figure 9) are used to monitor who is responsible internally and how
different supply chain partners are developing compared to their commitments. For
suppliers and sub-suppliers, special attention is given to how their risk management
processes are developing.