Mind the gap

It's one of those conundrums of life: in seeking to make your operations more efficient, you could be increasing your susceptibility to risk should things go wrong.

Simply put, there's a danger in putting all your eggs in one basket. If you consolidate your operations into one factory, what happens when it suffers a major fire? And if you reduce your stockholding and the number of your suppliers, what happens when there are disruptions to supply?

It all comes down to managing risks. Risk management can substantially mitigate exposure to reputational and financial damage whether it be a costly product recall, or major incidents involving employee injuries; fire or flood damage. While some in food and drink manufacturing are ahead of the pack in this field, many particularly smaller companies haven't got a clue.

"Risk management has become a much higher profile topic," said Paul Hopkin, technical director of Airmic, the Association of Insurance and Risk Managers, who chaired Food Manufacture's recent risk management round table, sponsored by insurance broker Lockton.

Hopkin put much of the reason down to more complicated global supply chains within the food and drink sector these days where, for example, there are far more opportunities for contamination both intentional and unintentional. And then there is the risk of doing serious reputational damage to valuable brands.

Business continuity planning​

Ian Harrison, Lockton's specialist broker for food contamination and product recall, believes the food and beverage sector has better business continuity plans than many others. "In the early days of business continuity planning (BCP) only a few multinationals would have some kind of plans," said Harrison. "The amount of stuff we can now do to tick the box for our underwriters to give them a high degree of comfort is really light years away from how it was only 19 years ago." However, RSSL investigative partner David Brown was less sanguine and feared that, while some may be ahead of the game, far too many in the sector are woefully unprepared as far as their disaster management and BCPs were concerned.

"The top 100 may be very, very capable," said Brown. "For me, it's maybe that next tranche down they all understand there is a need to do this but they don't seem to know what it is they actually have to do. And there is another tranche below that, which says: 'I don't know what you are talking about.' So, I agree, we are a lot better in the food industry I'm just not convinced how good we are."

But it's not enough just to put BCPs into place, they must be tested to establish whether they are fit for purpose. Simulated exercises provide a powerful tool, as these help to highlight where plans can fall down. And, quite often, this is the result of failures to communicate properly both internally and externally when things do go wrong.

Karen Masters, business development manager at RSSL, said: "I would strongly advise anybody looking at business continuity to simulate, to see if it actually works, but also to look at your team dynamics." Leatherhead Food Research's crisis management manager Tony Hines concurred: "In your simulation exercise, that's where you pick things up."

It was an issue taken up by R&R Ice Cream's group HR director Peter Pickthall, who said BCP had become central to R&R's planning since consolidating operations from seven sites down to two in the UK, making it far more susceptible to crises that might put sites out of action.

"Premises risk management has got to be an area you focus on much more," said Pickthall. "Because the more you consolidate to reduce cost and increase efficiencies, the greater the risk becomes as you then have fewer places to go in the event of a disaster."

So, the best in the business recognise the importance of devoting resources to putting robust contingency plans in place. But even then, things are not always within their control as, Rachel Phillips, product risk manager for Pepsico, pointed out.

"One of the things we spend a lot of time doing is in making sure our suppliers have their own systems in place and that they would dovetail with our own systems," said Phillips. "We share our crisis and incident management plans with our major suppliers and support them developing their own systems."

But even for Pepsico, the unexpected can occur. Phillips cited the example of a supplier that had a problem with aflatoxin contamination. Aflatoxins are naturally occurring mycotoxins toxic chemicals produced by fungi that are a particular cause for concern when crops are stored in damp conditions.

The problem for Pepsico was that the supplier rang Pepsico's raw materials receiving department at the site in question to notify it of the issue rather than calling a designated central contact. Since that department was unmanned when the supplier rang, the person left a message on voice mail and "we didn't find out about the issue until the following morning", reported Phillips.

"That 1216h could have been critical in terms of traceability, stopping use of the batch, putting the product on hold and all those sorts of things," she said. "So it is just as important that when you consider business continuity you don't just stay inward focused; that you also look outside."

Quantifying uncertainty​

However, even for many leaders in the BCP field, the way that risks are assessed is all too often left to subjective judgment. After all, 'high risk' probably means different things to different people. To help quantify the process, mathematical techniques are now being applied that allow a more scientific approach to be used in assessing exposure to risk.

Dr Andy Hart from the risk analysis team at the Food and Environment Research Agency (FERA) at York described work carried out to help understand the uncertainties involved in different risk scenarios, which could be used to put some hard figures on risks associated with, say, product contamination intentional or otherwise.

"Understanding uncertainty is key to managing risk. If we don't understand the uncertainty, we don't understand the various things that might happen and how likely they are, then it's very difficult to manage risk in an efficient way." Basically, the idea behind understanding uncertainty and making the best decisions is a question of knowing what the possible outcomes are and how likely they are.

The trouble is, argued Hart, "best estimates are not enough". "Best estimate gives you one idea of what might happen in the future, it doesn't tell you about all the other things that might happen as a consequence of your decision. And it doesn't tell you how likely they are," said Hart. "All too often, risk assessors only provide you with the best estimate of the risk or what might happen and they don't tell you about the uncertainty about the other outcomes and how likely they are.

"Understanding the uncertainty helps us to choose policies that have a high chance of success. And it helps us to identify when and where more information is needed."

This quantitative approach makes use of deterministic calculations to identify the range of different outcomes and probabilistic calculations to estimate their probabilities.

Using a hypothetical example of sampling for contamination, Hart said that understanding the uncertainties helps design sampling to control the risk of failing to detect contamination. He noted that it depends on the homogeneity of the product as well as the number and quality of measurements.

"If the contamination is concentrated in a small part of the bulk of your product, then the number of samples that you need to achieve a good level of certainty about the contamination in the product bulk as a whole goes up," he warned. Such heterogenous contamination is a common problem, for example, with mycotoxins in wheat. However, it could equally be relevant for adventitious contamination with genetically modified crops or nut contamination.

Hart concluded: "Doing this type of analysis allows you to take account of the uncertainties that exist in our knowledge about future outcomes. It can be uncertainties that are present in data measurement uncertainties, sampling uncertainties. It can be uncertainties about the model; about the structure of the process; and it can be uncertainties about expert judgments and about how much experts really know the issues they are making judgments on."

Getting company Boards to adopt such a scientific approach to quantifying the uncertainty and risk of their business activities may prove more problematic, however.

Locktons' Harrison said: "When we talk to clients about what recall limits and what contamination limits they should buy, we ask them to do a worst case scenario: basically work out what the scenarios are likely to be and what they will cost and that forms a basis of their limits. Then it's a trade-off on the cost-benefits of the limits."

The question then arises: how bad can the worst case actually be? As Hart said: "Very often you can think of some worst case things, then you can think of some really, really worst case things and then you can think of some absolutely catastrophic things these are different points in the tail of distribution of risk."

But Ashley Martin, risk manager for Molson Coors, described how the use of probabilistic risk analysis had helped his company with a particular packaging contamination issue in the past. "We had a packaging issue and we worked on a very simplistic probability impact analysis and it really drove our decision making on what we needed to do as far as re-engineering it and resupplying it," said Martin. "That was very sellable to the Board."

Brand and reputation​

When it comes down to it, though, reputational damage can prove the most costly in the long run if crises are not handled well.

As the Food Processing Faraday's former chief executive Bob Marsh clearly put it: "Your entire ability to alter your future reputation depends on the style of management that you put in at the crisis."

RSSL's Brown added: "If you look through the past 2030 years, the companies that have done badly out of brand reputation protection are the ones that have done terrible PR job."