Approaching supply chain risk management with a pure compliance mindset is dangerous, no matter how extensive your compliance program. In the previous chapter, we explored the limits of audits, dashboards and reports for managing supply chain risk. While I'll admit these tools are sometimes necessary, they rarely do more than tick boxes. They provide a kind of retrospective validation - something that will not give you the strategic insights that influence success. When you focus on past events and prescriptive regulations, it's much harder to handle novel disruptions. You firefight problems as they come. Decisions are reactive, often happening in siloes. Rather than preventing supplier failures, you end up expediting materials after the event.
The strategies discussed in chapter two represent a low-maturity approach to risk management. For the rest of this series, we reveal what it means to be a mature organization and the steps you can take to get there. How can you identify risk patterns, giving you the foresight to anticipate threats? How can you use data to inform choices and integrate perspectives across functions? Instead of ad hoc judgments, what crisis committees and flexible decision-making structures can you establish? Maturity is what separates reactive problem-solving from strategic decision-making. As your maturity rises, you reduce surprises. You make choices based on your individual risk appetite. And you align risk management with your business objectives.
It all starts with measurement
Before you can improve anything, you need to assess your current risk management practices. Building resilience without knowing your baseline is like plotting a route without a starting point. You’ll probably get lost along the way. A maturity assessment will help you uncover how close you are to best practice and industry peers. It will clarify what you need to work on first. The direction you need to take. If you have limited visibility into your suppliers, for example, you might start by formalizing your mapping process.
It could feel like you're ticking all the right boxes, but you're still getting stuck firefighting problems. Doing a maturity assessment will reveal where you're falling down. As we saw in chapter two, traditional compliance metrics show what you did, but not what you achieved and where you need to go next. It does not matter how many audits you conducted if nothing changed as a result. By contrast, maturity metrics measure capabilities. The skills and processes that determine how you’ll fare in your next disruption. They check for proactive and reactive practices - early warning systems instead of post-incident audits.
The data from maturity assessments supports executive decision-making too. By understanding your current capabilities, you identify where investments and resources will have the greatest impact. Board members value maturity metrics because they make trade-offs evident. Your CFO is more likely to invest in mapping when they see a maturity score highlighting a visibility gap. Measuring maturity will not boost your resilience right away, but it turns an abstract goal into a clear, achievable journey.
Building your resilience in a practical way
Achieving resilience across your entire enterprise can feel like an overwhelming task. As with anything, it helps to break it down. In chapter one, we introduced BSI’s MESH methodology. It provides a structured roadmap to help you strengthen your risk management practices. You map your supply chain. You evaluate your maturity. You build your strategy. And you harmonize efforts across your team and suppliers.
The MESH framework also organizes supply chain resilience into eight core dimensions. These represent the capabilities you need for a more mature approach to risk management. You start by measuring your maturity across the dimensions. Then you use this understanding to make changes in the areas that will make the biggest difference, scaling your efforts over time. Improvements in any dimension will bolster the others. But this modular approach helps you build resilience at a pace that makes sense for you.
I'll explore each dimension in its own chapter but let me introduce them briefly.
The eight dimensions
- Governance and strategic alignment – Strong governance structures give you the clarity to define risk appetite and embed resilience in your supply chain strategy.
- Supply chain visibility and mapping – True visibility means mapping multi-tier supplier networks, identifying critical nodes, and understanding vulnerabilities.
- Risk management and business continuity – Regularly assessing your risks and testing scenarios builds capacity to tackle issues as they arise.
- Supplier assurance and performance – Monitoring risk patterns and closer collaboration with suppliers reduces recurring problems.
- Logistics and transportation resilience – In the event of disruption, you need route diversity and contingency capacity to maintain the flow of goods. Too often, companies focused on production schedules and factories neglect these capabilities.
- Digital infrastructure and data integration – Systems should talk to each other. Consolidating information will support risk intelligence and improve your decision making.
- Regulatory and ethical standards – Integrating environmental and social governance (ESG) throughout your supplier lifecycle builds trust with consumers and regulators.
- Workforce capability and culture – You can only manage risk effectively if your people have the right skills and training.
Optimizing your maturity
Taking control of your supply chain does not mean a complete and immediate overhaul of how you manage risk. Whether you’re just starting to formalize risk management or already have sophisticated systems in place, the MESH methodology meets you where you are. As you upgrade your capabilities across the eight dimensions, you assess yourself against five maturity levels, building on what you have.
The MESH maturity levels
- Basic: Your risk management is ad hoc, informal or reactive. Surprises are common and decisions often made in the moment. You have few structured processes, and success relies on heroic efforts by individuals rather than systems. You do not have consistent ownership of supply chain risk.
- Developing: You have some risk management processes in place, but they are inconsistent. There’s growing awareness of key risks, but capabilities remain siloed or uneven across your business.
- Established: You have formalized your risk management approach. Proactive, structured processes exist and you review these periodically. Data informs your decision making. You have a defined continuity plan and some cross-departmental coordination. But resilience is a distinct activity rather than a key part of your supply chain strategy.
- Advanced: You have an integrated approach to risk management, coordinating across business functions. You conduct regular scenario tests, using lessons learned to update your processes. You have embedded resilience thinking into your operations. Decisions are often made with the future in mind.
- Optimized: You have a fully integrated resilience strategy recognized for its strategic value. You refine practices on an ongoing basis as a tool to create competitive advantage. Your strategy informs innovation and creates customer confidence. It enables you to adapt quickly to any changes in your environment.
Most of you will fall somewhere in the middle of this spectrum. Chances are you’ll be at different levels for each of the eight dimensions. That’s okay. The idea is to achieve steady, manageable gains in maturity in the areas most important to you. You’re not going to leap from “Developing” to “Optimized” overnight. The MESH methodology is about shifting your perspective. Moving away from checking boxes to building capabilities. Assessing the maturity of your approach, then raising your game step by step.
How can you get started?
I've spent the first three chapters of our MESH series making the case for a new approach to risk management. Chapter one explored your operating context, the challenges you face in this era of permanent disruption, and why the complexity of modern supply chains requires an enterprise-wide risk management system. In chapter two, we dismantled traditional compliance methods - the illusion of control they create - and we paved the way for the maturity model introduced in chapter three.
In the next part of this series, I’ll be diving into the eight MESH dimensions. I'll explore what each of these capabilities means in practice and how you can use them to build resilience. You'll receive practical guidance and tools to help you improve your maturity.
Each chapter will cover:
- Why the dimension matters to your business
- The signs and symptoms of low maturity
- What a high maturity approach looks like
- Common pitfalls and blind spots for decision-makers
- Scenarios illustrating the dimension in action
- Questions you can ask yourself about your maturity status
- A simple self-assessment tool to apply to your organization
- Guidance on how to gauge your progress and performance
By the end of the MESH series, you will have a comprehensive view of your maturity and a blueprint for how to improve it. You can use this to reduce your risk exposure, and to enhance your performance. By better adapting to disruptions, you bring products to market faster, in an increasingly complex environment. If you take away one thing, I hope you remember this: that resilience has a rightful place at the heart of your organizational strategy.
