Fire, flood, earthquake, an infestation of ants - these are not just the stuff of Hollywood disaster films but everyday occurrences that can prove devastating to a corporation when they interfere with putting out a product. Loss of output from just one critical supplier can pulse through the supply chain, shutting down production and costing millions.

But risk also creates opportunity, says Debra Elkins, Senior Research Engineer in the Manufacturing Systems Research Lab. "At the highest levels, companies can use their understanding of the probability and severity of potential business interruptions as a competitive advantage. If they're good at managing risk, corporations have a better chance of responding in a creative manner and keeping the production lines running."

The key is to make the supply chain more robust and manufacturing lines more flexible, so a blizzard in Dubuque doesn't snowball into a companywide shutdown. But how can companies determine the magnitude of the losses they'll suffer from each business interruption and the possible impacts on corporate goals?

That's the realm of enterprise risk management and the focus of Elkins' research. "Formally defined, risk management seeks to identify, quantify, and manage all risks that impact corporate performance," Elkins explains. "What we need are decision tools to rapidly measure, rank, and communicate risks to upper management, so that they can choose the best course of action." But developing those tools for a mega-corporation like GM is a daunting proposition.

As part of the GM Corporate Risk Management Team, Elkins had already started to connect the necessary theory, modeling approaches, and superior computing techniques when the terrorist attacks occurred on September 11, 2001. Immediately it became obvious just how crucial risk management had become.

Establishing the Framework
To capture the information executives need to manage risk, Elkins has developed a framework with three main elements. She starts by generating a list of business interruptions that could occur - both repeatable events, like fires and floods, and non-repeatable ones. The frequency and severity of repeatable events can be modeled using stochastic processes, which help estimate the number of events expected and the associated monetary loss. Developing these stochastic risk process models is the first element of the framework.

One of the limitations of this classical approach, however, is that only one type of risk event can be analyzed at a time. Elkins and Professor M.A. Wortman of Texas A&M University showed that correlated events - events that occur together - can cause widely different results.

"Sometimes putting out a fire results in water damage as well," says Elkins. "What's the impact if you ignore their interdependence? Our results show that you could really underestimate the amount of cash you need to protect yourself against these damages. You have to manage risks as a portfolio."

The second element in the framework calls for constructing operations models that capture the network of dependency in production facilities. These models might include global value chain or supply chain maps. Given GM's large scale, Elkins literally draws on a wall to show how the different parts fit together.

The third element requires researchers to develop appropriate measures of enterprise risks.

"We establish a benchmark using risks applied to the operational models," says Elkins. "We can then measure the efforts to reduce risk by comparing the modified risk profile to the original."

Putting the elements to work
The framework sounds straightforward enough, but Elkins wryly notes that almost everything remains to be done. "Still, if we can successfully integrate all three areas, we'll have a rich methodology to analyze enterprise risks," she says.

The techniques have obvious application to companies that manufacture or assemble parts and components - like the automotive or semiconductor industries - and also fit well with military and defense efforts like those of the U.S. Homeland Security Office.

"It's the same game," says Elkins. "If you want to make the country's water supply infrastructure or transportation network safer, you look for vulnerabilities in the system and then try to protect them."

In addition to industry and government work on enterprise risk management, a number of universities have begun to emphasize risk analysis as part of their engineering curriculum. Elkins sees the field expanding far beyond its current breadth, as researchers work to develop better models, analysis, and computing capabilities. No off-the-shelf software currently available can tackle the problems of risk management, so it must first be developed.

But Elkins sees all the work to be done as a plus. "The important thing is that we have opportunities to get better - and we're taking advantage of them," she says.

By Diane Kightlinger