Who is responsible for responding to supply chain risk alerts? In some companies, department leaders or managers are responsible for responding to alerts. Others create a Center of Excellence to manage risk across the supply chain. Here we discuss both options and what is required for each approach.
A typhoon is forecast to make landfall near a key port. A tier-2 supplier files for bankruptcy. Your risk platform flags both. Even the best decision-grade risk intelligence is lacking unless you know how to respond to supply chain alerts.
- Who is responsible for catching the alert?
- Who responds to risk alerts?
- Do they have predefined thresholds for actions they can take?
- When does an alert need to be escalated?
Companies usually answer the alert ownership question in one of two ways. Some let functional teams in planning, procurement and logistics own the alerts that touch their work. Others build a supply chain risk management Center of Excellence (CoE) to own risk across the business.
Option 1: Let functional teams own their alerts
In this model, each team owns the risks closest to its decisions. The people who feel the impact first also take the first action.
Planning watches for disruptions that threaten supply and demand plans. Planners run what-if scenarios, rebalance inventory, and shift production when a site or supplier goes down.
Procurement tracks supplier health, commodity shortages, and price swings. Buyers use supplier risk scores to qualify alternates and adjust sourcing before a problem hits.
Logistics monitors shipments, lanes, ports, and other transportation hubs. Logistics teams reroute freight to avoid delays, change equipment for temperature-sensitive loads, and warn customers about delays.
Compliance receives alerts about regulatory changes, including new mandates and risks related to sanctions, human rights, and ESG requirements.
This approach has clear strengths. Your experts already know their suppliers, lanes, and plans. They can act fast because they don’t wait for a hand-off. And you can start quickly without a new headcount.
It also has limits. Each team sees only its own slice of the network. A port closure might look like a logistics problem, yet it can also drain safety stock and push buyers toward a spot market. When no one connects those dots, you miss its full impact entirely.
Put alerts where your teams already work
If functional teams own risk alerts, you should integrate risk intelligence into the enterprise systems they use every day. This means your people are not just responding to supply chain risk alerts. Instead, they also make risk-optimized decisions as part of their day-to-day work.
Know when to escalate
Whether you have integrated risk alerts in your systems, or if you are using platform alerts, you need clear guidelines. Users need to understand when they can act independently, and when an issue needs to be escalated.
Give your teams escalation triggers. For example, escalate when:
- The disruption affects more than one product line
- A critical material or single-source supplier is involved
- The potential revenue at risk crosses a set threshold
- The mitigation costs exceed a defined amount
- The event could affect customer commitments or regulatory obligations
You need to have clear, well-defined escalation processes. This includes named decisionmakers, and guidelines on how fast they must respond.
You should review how well the response worked after every major event. See what worked, what could be improved, and if the process could be streamlined.
Without this discipline, the decentralized model can break as users move into new roles or leave your company.
Figure 1: If your team handles risk alerts without a CoE, they need clear guidelines and processes, so teams know when they can act without executive oversight and who is the decisionmaker if escalation is needed.
Know when not to respond
Alongside knowing when to escalate a risk alert, your functional teams also need to know when a response is not needed.
Sometimes knowing about a potential risk and deciding to ignore it is a perfectly acceptable response.
Think for example of high winds interrupting a port for a day. You have a shipment headed towards it, but the weather should have cleared by the time the cargo arrives.
Your supplier could experience a flood, but they will be back up and running within three days. If you have enough inventory to absorb the disruption, there is no need to do anything about it.
A delivery of a critical input will be a day late, so you adjust the production schedule and keep the factory running.
You may need to be aware of risks like these, but you don’t necessarily need to act on them.
As Douglas Adams famously said in The Hitchhiker’s Guide to the Galaxy: “Don’t panic!”
Option 2: Build a supply chain risk Center of Excellence
A supply chain risk management CoE gives risk a single home. The CoE owns the tools and data and coordinates the response. Planning, procurement, and logistics still act on the alerts. But the CoE sees the whole picture so that different functions work in concert to achieve the desired outcome.
You do not need a large team to start. A CoE can begin with one leader. At full maturity, a company with about $10 billion in revenue typically needs four or five people.
Creating a CoE is done in 5 phases:
- Pre-rollout: Survey stakeholders, senior managers, talk to risk specialists, and draft your risk management vision.
- Rollout for operations and systems: Set up your digital risk platform, define key use cases, and establish risk governance.
- Rollout for internal customers: Give users access, training and support, and define best practices.
- Rollout to scale: Onboard users faster, quantify the value and build dashboards and feedback loops.
- Ongoing: Lead crisis management and advanced risk analytics while supporting daily risk work.
Most companies reach full maturity in one to two years. You can move faster if resilience already ranks as a strategic priority.
Figure 2: The Supply Chain Center of Excellence oversees the vision, data, tools, processes and coordinates risk alert responses over all 5 phases of the rollout.
What this looks like in logistics: Schaeffler
Schaeffler, the motion technology manufacturer, runs a central transport risk team that works as a logistics CoE.
The central team owns the process, the standards, and the Everstream platform. It screens alerts daily and keeps a global risk register. Regional risk representatives link the team to plants and service providers. Divisions set their risk appetite and approve contingency plans.
The team also draws a clear escalation line. For short-term risks – anything likely to occur in under three months – local teams adjust production, draw on stock, or expedite freight. Longer-term issues go to top management for approval. When the Panama Canal drought dragged on, Schaeffler rerouted about half of the affected volume this way.
The model pays off in fast-moving events too. When a hurricane closed the port of Savannah, the central team contacted only the affected plants. With this early insight into an upcoming risk, the local teams were prepared, and they managed the disruption without any costly air freight.
What this looks like in procurement: KION Group
KION Group, the intralogistics and industrial truck maker, takes a CoE approach to supplier risk.
KION runs supplier risk teams across EMEA, the Americas and APAC. These teams catch early signals and track dependencies down to the sub-tier. Each supplier gets a 360-degree risk score, updated monthly across six dimensions: financial, geopolitical, geographic, operational, cyber and sustainability. The team then puts a dollar value on exposure by multiplying impact by likelihood.
Governance keeps everyone aligned. Regional supplier risk councils feed a global council, which reports to a corporate risk management committee. Each discussion answers three questions: where to act now, where to watch more closely and where to invest to reduce future exposure. For active disruptions, a structured escalation brings procurement, logistics, quality, engineering, and suppliers together.
