ISO 31000:2009 Enterprise and Supply Chain Risk Management: A Longitudinal Study

Abstract

This research attempts to fill two recently identified gaps in Supply Chain Risk Management (SCRM) research, specifically the lack of a common framework and limited empirical research. This research first attempts to determine if ISO 31000:2009 provides a foundation to advance SCRM research by standardizing the SCRM research framework, terms, and risk treatment categories. Secondly, it attempts to determine if ISO 31000:2009 is a useful framework for managers to link SCRM to enterprise risk management (ERM) when executing SCRM. Currently, there is no research that explicitly links SCRM to the ISO 31000:2009 ERM standard. In this study, longitudinal survey data were analyzed, and follow-up discussions with managers were used to achieve the research purpose. It was determined that current SCRM research frameworks have similarities with each other, but they also diverge to some extent. The ISO 31000:2009 framework encompasses existing SCRM frameworks, but it is more exhaustive than that , which includes the need for developing a strategic context for risk management and for ongoing performance monitoring. It is suggested that ISO 31000:2009 provides a foundation for extending and advancing future SCRM research. It was also found that firms increasingly recognize the importance of systematic SCRM, but SCRM integration and skills are lacking. Topics for future research are proposed, including for example using ISO 31000:2009 as a research foundation, potential outsourcing of SCRM, appropriate organizational structure for SCRM, deployment of IT, and SCRM return on investment.