Risk Management in the Import/Export Process of an Automobile Company: A Contribution for Supply Chain Sustainability

Abstract

Supply chain risk management (SCRM) is imperative to achieve business sustainability in the long-term perspective and also to increase companies’ competitiveness. ISO 31000—Risk Management explains in its latest versions the need for companies to integrate a risk management process into their business models. Complementary to this standard, ISO 31010 presents 31 risk tools to guide companies in this task. However, a question of practical application arises as to which tools should be used for each stage of the SCRM process. In view of the raised question, the main objective of this research is to select ISO 31010 tools that can be used in each of the stages (identify, analyze, and evaluate) of the risk management of the import and export process of an automotive industry located in Brazil. For this, the analytic hierarchy process (AHP method) was used in a case study to prioritize the tools to compose the SCRM. As practical implications, this study resulted in the suggestion of a structured risk management process, considering the assessment of key professionals of the department studied in the company.

1. Introduction

Supply chain risks can generate huge losses for companies. Factors such as increasingly spatially dispersed supply chains, increasing interdependence between companies, shorter life cycles of ever-smaller products, and strategies such as Lean Six Sigma and Just in Time, are examples that have increased the exposure of chains to risk [1,2]. Given the relevance of the theme, the concept of supply chain risk management (SCRM) has emerged from the intersection between risk management and supply chain management [3]. Moreover, the SCRM comes to contribute to business sustainability, by increasing the probability of projects achieving their strategic goals and also enabling a shift from the short- and medium-term perspective to a long-term perspective regarding business strategy. It is a relatively new subject, and according to Pfohl et al. [4], its scope is broader than the traditional risk management process.

A reflection of this relative novelty of SCRM is the lack of consensus among researchers about its stages. For example, Wu, Blackhurst & Chidambaram [5], Khan & Burnes [6], and Singhal, Agarwal & Mittal [7] argue that SCRM should be carried out in at least three stages, which differ in their procedures from author to author. Other authors [8,9,10] advocate different procedures, with more than three stages. Ritchie & Brindley [11] favor seven stages for SCRM. Because of these variances, De Oliveira et al. [12] and Santos & De Oliveira [13] propose ISO 31000 as a systematic procedure for SCRM. Santos et al. [14] in turn, propose the techniques presented by ISO 31010 as tools for the execution of this process.

ISO 31010 (Risk Management—Risk Assessment Techniques) was created to complement ISO 31000 and presents 31 tools to help professionals to structure their risk management processes. The document presents and classifies the tools as applicable or not to each stage of management. However, with such a wide range of tools, a question of practical application arises: for the import and export process of an automotive industry, located in Brazil, which of the tools presented by ISO 31010, in the view of specialists who work in this process, are the more appropriate in identifying risks, analyze their consequences and probabilities and, finally, evaluate them?

In view of the question presented, our main objective is to select ISO 31010 tools that can be used in each of the risk management stages (identifying, analyzing, and evaluating) of the import and export process of an automotive industry located in Brazil. This general objective is aligned with other recent researches, for example [15,16,17] and others.

In order for the aforementioned general objective to be achieved, the research will carry out a unique case study in the import and export process of an automotive industry, whereby seven specialists with extensive professional experience, who work in this process, will be interviewed by means of a structured questionnaire, previously organized so that the collected data can later be used as input data in the AHP method, for establishing the hierarchy of the ISO 31010 tools most suitable for identification, analysis, and assessment of risks. More details of the method will be provided in Section 3 (Materials and Methods).

The automobile company mentioned is the Brazilian subsidiary of a multinational group. Within the company, the Alliance Customs & Trade (ACT) department was chosen as a key department in the company’s strategy. The department is responsible for importing productive inputs and exporting finished products. In other words, it is simultaneously in one of the initial links and in one of the final links in the company’s supply chain: at the entrance of the imported productive inputs (which, after a study by the costs team, was found to account for about 53% of the cost of the vehicle); and at the exit of the finished product, ensuring that the product reaches the final consumer (in this case, the importer).

This is a relevant research for at least four reasons: (i) research on SCRM applied in the automotive industry is relatively scarce; (ii) research on the application of risk management tools in automotive industry import and export processes is non-existent—unless mistaken, no article on this topic was published in journals listed in the Web of Science database; (iii) risk management processes have the potential to improve the sustainability of supply chains; and (iv) the import process of the target company of this study works with inputs that are responsible for more than 50% of the final cost of a produced vehicle. Except for the last justification, which is related to the empirical study, the other justifications will be addressed in literature review section.

2. Literature Review

2.1. Sustainability and Supply Chain Risk Management

SCRM is highly focused on reducing the chances of disruption of a supply chain, in its different stages, in the face of the diversity of risks/threats [18]. However, there is an increase in the sustainable commitment of different types of companies that operate at the global and regional scale—leading to several kinds of research and actions involving various companies and stages within the supply chain related to social and environmental benefits [19,20]. Moreover, studies highlight that the sustainability of a supply chain is sensitive to its resilience level [18]. Nowadays, it is unavoidable to relate corporate image with sustainability values and performance. With the increasing implementation of outsourced services and stages within supply chains, the capacity of a company to contribute to the sustainability and resilience of a supply chain has become crucial for its prosperity and longevity in the current global market context [21].

Besides the pressure between business partners to reduce risks and increase sustainability in the supply chain, consumers are more aware and concerned with products’ social and environmental impacts [21]. A good risk management process should improve the sustainability of supply chains because it can reduce accidents that can have adverse effects on workers’ health (depending on the sector) or even reduce the loss of financial resources [22], which sustains companies and jobs. For example, Alikhani et al. [23] bring evidence that risk assessment is important to identify sustainable suppliers, not necessarily those with the best performance. This type of action may contribute to the sustainability of supply chains [23].

Different approaches to SCRM involve dealing with risk analysis to support sustainable supply chains. For example, there can be a measurement of specific indicators under a quantitative and/or qualitative perspective to evaluate a supply chain’s social, environmental, and economic performance [24,25]. Risk analysis may also undertake a qualitative approach with semi-structured interviews with managers of the supply chain [23]. A more recent research and practical approach has involved dealing with smart logistics ecological chains (SLECs), considering a risk management process that involves implementing advanced technological features related, for example, to automated risk control processes and data sharing [26]. Under another approach, Hallikas et al. [27] offer an understanding of the contribution of an adequate purchasing and supply management practice to ensure the sustainability of supply chains.

2.2. Supply Chain Risk Management and ISO 31000

SCRM originated from supply chain management (SCM) and has been gradually gaining importance [3,12], mainly due to the need to develop skills to adapt to changing environments and because supply chains operate within conflicting aspects in a global business environment [28]. Supply chains are exposed to a wide variety of risks [29], where insufficient resistance or a lack of focus on managing risks in highly complex environments can erode companies’ competitiveness [30].

Regarding the relevance of the theme, Xia & Chen [31] consider that SCRM has a strong influence on establishing cooperation between partners and on the performance of the chain as a whole. Scannell, Curkovic & Wagner [32] argue that a risk-oriented chain establishes a competitive position and long-term benefits for its stakeholders. Ritchie & Brindley [11] highlight reasons for the increasing interest in the subject: chain-related strategies and structures evolve very fast, thus there is frequent change in formats in search of competitive advantage, as well as technological changes that, despite bringing benefits, pose a threat to the established supply chain.

Mogre, Talluri & D’Amico [33] point out that the literature advocates the introduction of a structured risk management process to help companies assess supply chain risks and identify appropriate mitigation actions. Kamalahmadi & Parast [34] consider that SCRM involves the identification of potential sources of risk followed by the implementation of appropriate strategies, through a coordinated approach between members of the chain, to reduce its vulnerability. Lavastre, Gunasekaran & Spalanzani [35], in turn, argue that SCRM implies assessment, in strategic and operational horizons, in the short and long term, of risks that can affect information and material and financial flows in order to decrease their adverse effects.

Furthermore, Trkman & Mccormack [29] state that the goals of SCRM are to identify, evaluate, analyze, and treat vulnerability and risk in supply chains. In that sense, Ledwoch et al. [36] state that this interaction with each link is necessary in order to strengthen the entire system and analyze the performance and needs of the weakest link in order to improve it. They also indicate that this assumption brings to the fore considerations about the best strategy (direct mitigation or contingency) and where that strategy should be applied to improve the system’s performance in general.

The objective can also be to identify potential sources of risk in the chain and implement appropriate actions to avoid or contain the chain’s vulnerability. Mentzer & Manuj [37] state that in global chains the aims should be to reduce losses, the probability or speed of adverse events, the time for detection of these events, and the frequency and exposure to them. Kleindorfer & Saad [9] in turn, contribute to the field by defining 17 principles, as follows, representing an evolution in terms of the recognition of its importance:

(1)

The focus of risk management is on the company’s border areas in the supply chain.

(2)

The company has a deep knowledge of the interfaces in its chain.

(3)

Supply chain management and SCRM are seen as integrated and not independent of each other.

(4)

Internal SCRM is coordinated and integrated.

(5)

SCRM is part of the corporate strategy.

(6)

Managers and executives support and are responsible for SCRM.

(7)

All members of the chain have a mutual understanding of potential risks.

(8)

Information about risks in the chain is available to the entire company.

(9)

Companies within the chain have a cooperative, fair, and close relationship.

(10)

Companies within the chain have strong mutual trust.

(11)

Asymmetries between companies do not exist.

(12)

Companies have process planning and mutual goals for the chain.

(13)

Risk information is shared within the chain.

(14)

Direct partners within the chain cooperate with each other regarding risk management.

(15)

Risks and rewards are shared within the chain.

(16)

All members are involved in the chain’s risk management activities.

(17)

All members of the chain aim for the same goals regarding the supply chain.

With regards to the SCRM steps, Hallikas et al. [8], Faisal et al. [38], and Tuncel and Alpan [39] argue that a typical risk management process is composed of risk identification, risk evaluation; the decision and implementation of risk management actions; and risk monitoring. Despite that, Fan et al. [40] and De Oliveira et al. [12] state there is no consensus in the literature on how many and which phases should be considered in the SCRM process. Due to this, De Oliveira et al. [12] propose ISO 31000 as a systematic procedure for SCRM.

It is possible to observe previous studies that evaluate the influence of the ISO 31000 standard on supply chain risk management, such as Olechowski et al. [41], Ernawati et al. [42], and Lalonde and Boiral [43]. Olechowski et al. [41] focused on understanding the effectiveness of the ISO 31000 principles within the engineering industry, undertaking a large-scale survey across seven companies/organizations directed to engineering practitioners. Ernawati et al. [42] applied the ISO 31000 principles to a design science research methodology (DSRM), which sought to assess risk management with data collected through focus groups, in which the researcher was an external observer and analyzed the data of a company in the information technology sector. In the case of Lalonde and Boiral [43], they focused on the state-of-the-art of ISO 31000 principles applied to the risk management process.

2.3. Supply Chain Risk Management in the Automotive Industry

The automotive industry is extremely competitive, wielding considerable power and influence over the members of its production chain. Despite their success, the relationships between the parties in the supply chains are complex and with a series of structural weaknesses that, when considered individually, represent significant risks and, when considered collectively, can be amplified several times [44]. For example, Thun and Hoenig [45] refer to a loss of millions of dollars that occurred with the German component supplier Robert Bosch, which delivered defective high-pressure pumps for diesel injection systems to its customers in early 2005. This error was caused by a Bosch sub-supplier, compromising the entire supply chain. This example is in line with what was observed by Bloss [3], who identified significant risks in the automotive industry that could severely interrupt the operations of the entire supply chain or even end these operations for a long period of time.

There are several reasons for the high vulnerability of automotive supply chains, in a globalization context [45], such as: the need to offer many product variants and approaches to build an increasingly leaner chain; intensification of the outsourcing process; and the reduction of suppliers and cost reduction. Besides these and other reasons and risks, the situation is aggravated by managers’ lack of knowledge on how to manage these risks, as observed by Bloss [3], who stated that only 9% of those who participated in his research had a high knowledge about issues related to the SCRM, whereas 91% had no knowledge or only superficial knowledge. Perhaps this high percentage (91%) is related to the few empirical studies on SCRM in this industry [46], of which almost half were published only about a year ago, as summarized in

Table 1. Studies on SCRM in the automotive industry published in periodicals.

Year	Authors	Topics
2009	Blos [3]	Identifying risks in the supply chain and highlighting the urgency of implementing SCRM in the Brazilian automotive industry.
2011	Thun e Hoenig [45]	Distinction of internal and external risks to the supply chain and the analysis of instruments to deal with these risks in the German automotive industry.
2015	Ceryno et al. [46]	Identifying of risks in the supply chain in different stages of the chain, offering an initial risk profile for this chain in the Brazilian automotive industry.
2015	Simchi-Levi et al. [47]	Development of a risk exposure model at Ford Motor Company that assesses the impact of an interruption anywhere in the supply chain, so that the company can consider risk mitigation actions and develop contingency plans.
2016	Chen et al. [48]	Identifies global supplier selection criteria through performance measurements to mitigate risks in uncertain environments.
2018	Zhang et al. [49]	Analysis of the transmission of risks between suppliers, manufacturers, and distributors, in addition to an investigation of the strategies used by the Chinese automotive industry to mitigate the adverse effects of supplier interruptions.
2020	Mzougui et al. [50]	Compiles a comprehensive list of specific risks related to the automotive supply chain and proposes a method adapted for the analysis of failure modes, referred to as effect of risk criticality analysis.
2020	Vanalle et al. [51]	Identifies the main characteristics of risk management in the automotive supply chain in Brazil, considering first- and second-tier companies.
2020	Dias et al. [16]	Analysis of how an automotive industry located in Brazil identifies and manages the risk factors related to its supply chain.
2020	Junaid et al. [52]	Identifies and assesses risks in Pakistan’s automotive industry, ranking the most vulnerable risks for supply chains.

.

Regarding the automotive chain suppliers, Singh et al. [44] noted that the smallest and most “distant” face risks that are disproportionately greater and occur in many different forms. Vanalle et al. [51] also proved that the perceived risks in layer two are higher than those observed in layer one. In addition, they found that the performance of companies in layer two (higher risk) is lower than that of companies in layer one, providing important contexts for decision making in day-to-day business in the automotive sector. Still, as regards risk levels, Junaid et al. [52] noted that forecasting errors, failures in supplier communication, supplier quality problems, and delivery delays by suppliers are the most vulnerable risks in automotive supply chains in Pakistan, with delivery delays being the most damaging for the analyzed automotive chain.

In reference to risks involving suppliers, Zhang et al. [49] observed in the supply chain of the Chinese automotive industry that both the vehicle manufacturer (automakers) and the vehicle distributors (dealerships) are affected by supplier interruptions; which makes perfect sense, since if an assembler has its production process impacted by problems at the supplier, in a domino effect this will result in the interruption of the delivery of finished products (auto-furniture) to concessionaires. However, it was also noted that dealerships are affected by the direct commercial contact between the supplier and the distributors in terms of spare automotive parts that will be used to service customers during after-sales services. In this manner, problems in the supply chain of an auto parts supplier can affect the dealership’s business doubly, one directly and the other indirectly.

On the sources of risk in the supply chain, although some classification structures are robust, such as the one developed by Rangel et al. [53], many others are extremely generic, which makes the adaptation of these classifications for each branch of activity/type of business an extremely important issue for an adequate risk analysis. In this regard, Junaid et al. [52], Mzougui et al. [50], Ceryno et al. [46], and Blos [3] raised the main types of risks in the automotive industry, as organized and presented in

Table 2. Main risks associated with the automotive industry found in the literature.

Risks	Cited by
Supplier delivery delays	[3,50,52]
Supplier communication failure	[50,52]
Increase in input prices	[3,50,52]
Forecasting errors	[52]
Supplier quality problem	[3,50,52]
Machine breakdown	[3,50,52]
Inventory shortage	[50,52]
IT system failure	[3,52]
Cargo damages	[3,50,52]
Supplier insolvency	[3,52]
Troubling third-party logistics	[3,52]
Government regulations and/or restrictions	[3,46,52]
Insufficient capacity	[46,50]
Underutilized capacity	[46,52]
Lead times	[52]
Natural disasters	[3,50,52]
Eco/environmental risks	[3,52]
Terrorist attacks	[50,52]
Lack of flexibility	[50]
Ineffective transport	[50]
Strikes of workers or disputes at work	[50]
Increase in labor costs	[50]
Health safety or environmental (HSE) incident	[3,50]
Social instability and/or economics crises	[3,46,50]
Dependence or loss of key supplier	[3,50]
Inefficient delivery of products	[50]
Demand change for new cars or auto parts	[46]
Network-related risk source: inertia	[46]
Utilities failures	[3]
New or foreign competitors	[3]
Sabotage	[3]
Theft	[3]
Operator errors	[3]
Financial vulnerability (currency and foreign exchange rate fluctuations; credit default)	[3]

, below.

Regarding the actions and strategies adopted by the automotive industry for risk management in the supply chain, although managers agree that it is important to act and take risk into consideration in supply chain decisions, it is observed, in practice, that there is a lack of formal SCRM instruments across different levels of the supply chain [46]. This finding only reinforces similar results in the automotive industry raised before by other studies, such as Blos [3] and Thun and Hoenig [45], that is, that despite SCRM having become an extremely relevant topic for sustainability of business, practical applications of SCRM are still far from being widely implemented in this industry [46]. For this reason, as previously exposed in the introduction of this research, the next sections will be aimed at addressing tools for risk management in the supply chain of an automotive company, with the study being outlined for the import/export department of the target company.

3. Materials and Methods

To meet the general objective, that is, to select ISO 31010 tools that could be used to identify, analyze, and assess risks in the import and export process of an automotive industry, a unique case study was developed, where specialists who work in this process were interviewed. Allied to the case study, the AHP method (analytic hierarchy process) was used because it has a wide structure for multi-criteria decision making to determine priorities, using sets of paired comparisons, based on the intrinsic capacity that a human being has to structure their perceptions hierarchically when comparing two similar alternatives, with reference to a certain criterion, judging the degree of importance of one over the other [54].

As a data collection instrument, a questionnaire was prepared that asked respondents to make hierarchical comparisons, side by side, of the tools listed in ISO 31010, judging the degree of importance of one over the other. This data collection instrument was organized so that respondents could classify the degree of importance among different risk management tools.

Table 3. Risk tools included in ISO 31010. Source: Adapted from ISO [55].

Tools/Methods	Risk Assessment Process
	Risk Identification	Risk Analysis		Risk Evaluation
		Consequence	Probability
Bayesian statistics and Bayesian nets	NA	SA	NA	SA
Brainstorming	SA	NA	NA	NA
Bow tie analysis	NA	A	SA	A
Business impact analysis	A	SA	A	A
Cause and consequence analysis	A	SA	SA	A
Cause and effect analysis	SA	SA	NA	NA
Checklists	SA	NA	NA	NA
Consequence/probability matrix	SA	SA	SA	A
Cost benefit analysis (CBA)	A	SA	A	A
Decision tree	NA	SA	SA	A
Delphi	SA	NA	NA	NA
Environmental risk assessment (ERA)	SA	SA	SA	SA
Event tree analysis (ETA)	A	SA	A	NA
Failure mode effect analysis (FMEA)	SA	SA	SA	SA
Fault tree analysis (FTA)	A	NA	SA	A
FN curve	A	SA	SA	SA
HACCP	SA	SA	NA	SA
HAZOP	SA	SA	A	A
Human reliability analysis	SA	SA	SA	A
Layer protect analysis	A	SA	A	NA
Markov analysis	A	SA	NA	NA
Monte Carlo simulation (MCS)	NA	NA	NA	SA
Multi criteria decision analysis (MCDA)	A	SA	A	A
Primary hazard analysis (PHA)	SA	NA	NA	NA
Reliability centered maintenance	SA	SA	SA	SA
Risk indices	A	SA	SA	SA
Root cause analysis (RCA)	NA	SA	SA	SA
Scenario analysis	SA	SA	A	A
Sneak circuit analysis	A	NA	NA	NA
Structured or semi-structured interviews	SA	NA	NA	NA
SWIFT (structure and what if)	SA	SA	SA	SA

Legend: (A—Applicable; SA—Strongly Applicable; NA—Not Applicable).

presents all the risk tools/methods considered in ISO 31010 [55] and the classification of applicability for the stages of identification, analysis, and evaluation. It is important to highlight that to facilitate the use of the term tools/methods from the table, from here on, the use of the term “tools” may also be referring to methods because brainstorming, for example, could be considered a method.

The survey questionnaire considered all the risk tools listed in ISO 31010 and participants were asked to identify the risk tools they knew or had previously applied. Initial data on the respondents, such as time of professional experience, time in the company, education, etc., were also collected.

For the survey, seven employees of the company directly connected to the Alliance Customs & Trade (ACT) process were interviewed. These respondents were selected intentionally, based on their experience, knowledge, and interaction with the import/export process (see

Table 4. Hierarchy of interviewees.

Participants	Hierarchical Level
I1	Senior ACT Manager
I2	Brazil Plant Controller
I3	Cost Control Coordinator
I4	ACT Coordinator
I5	Control Analyst
I6	Import Analyst
I7	Export Analyst

). The choice for this selection was to ensure that only key people in the process were interviewed. These interviewees had the following characteristics:

• All interviewees had college degrees
• 29% had master’s degrees
• All interviewees had at least five years of professional experience
• All interviewees have been in the company for at least two years

The questionnaire was prepared taking into account the recommendations of Saaty [56], as regards: (i) defining the problem based on the type of knowledge sought; (ii) structuring the hierarchy; (iii) building peer comparison matrices; and (iv) obtaining the global priority of the alternatives.

The intention was to raise tools to identify risks, analyze the consequences of risks, analyze the probability of risks, and assess them. The problem was divided into four questions: (a) Which tool is more suitable to identify risks in operations importation/exportation? (b) Which tool is best suited to analyze the consequences of risks in import/export operations? (c) Which tool is best suited to analyze the probability of risks in import/export operations? (d) Which tool is best suited to assess risks in import/export operations? For each of these questions, a hierarchical structure was developed based on the tools in the ISO 31010 (see Table 3), where peer comparison matrices were elaborated, as shown in

Table 5. Criteria comparison matrix.

TOOL	Tool 1 (t1)	Tool 2 (t2)	Tool 3 (t3)	Tool 4 (t4)	Tool n (tn)
Tool 1 (t1)	t1/t1	t1/t2	t1/t3	t1/t4	t1/tn
Tool 2 (t2)	t2/t1	t2/t2	t2/t3	t2/t4	t2/tn
Tool 3 (t3)	t3/t1	t3/t2	t3/t3	t3/t4	t3/tn
Tool 4 (t4)	t4/t1	t4/t2	t4/t3	t4/t4	t4/tn
Tool n (tn)	tn/t1	tn/t2	tn/t3	tn/t4	tn/tn

Source: Adapted from Saaty [57].

.

In these matrices, respondents made paired comparisons based on an ordinal scale (see

Table 6. Fundamental Saaty scale.

Intensity of Importance	Definition	Explanation
1	Equal importance	Both tools help equally to identify risks
3	Moderate importance	Experience and judgment favor one tool slightly over another in identifying risks
5	Strong importance	Experience and judgment favor one tool strongly over another in identifying risks
7	Demonstrated importance	One tool is strongly favored over another in identifying risks and can be demonstrated in practice
9	Absolute importance	One tool is favored over another in identifying risks with the highest degree of certainty

Source: Adapted from Saaty [57].

) known in the literature as the Saaty fundamental scale [57]. When making the comparisons, the respondent evaluated, in relation to the four questions elaborated in the previous step, how much more important the tool in the column on the left was in relation to the tool that appeared in the line at the top of the matrix.

After completing the questionnaires, in the presence of the researcher, a verification of the consistency of the responses was carried out, aiming to detect possible contradictions in the weight values attributed by the specialists. This action is supported by Ishizaka and Nemery [58] as, according to these authors, when several comparisons in pairs are considered successively, they can contradict each other. The responses were then entered into a comparison matrix and checked for consistency. The questionnaires that presented inconsistent results were separated and, through a perturbation matrix, respondents were shown where the inconsistencies occurred, so that they, occasionally, could reassess their judgments, as recommended by Saaty [59].

The perturbation matrix was elaborated according to Saaty [59], with the values obtained through Equation (1).

Ɛij = aij × (wj/wi)

(1)

where:

Ɛij = disturbance value in the wij cell of the matrix.

aij = weight value assigned in cell aij of the comparison matrix.

wj = value of the relative priority of element j, obtained by the comparison matrix.

wi = value of the relative priority of element i, obtained by the comparison matrix.

Table 7. Example of a comparison matrix with an inconsistent value.

Tool	T1	T2	T3	T4	Tn
T1	1	9	9	9	1
T2	1/9	1	3	1	9
T3	1/9	1/3	1	1/5	1/9
T4	1/9	1	5	1	1/9
Tn	1	1/9	9	9	1

and

Table 8. Example of a disturbance matrix.

Tool	T1	T2	T3	T4	Tn
T1	1	3.00	0.58	1.38	0.42
T2	0.33	1	0.58	0.46	11.21
T3	1.72	1.72	1	0.47	0.71
T4	0.72	2.17	2.11	1	0.30
Tn	2.41	0.09	1.40	3.32	1

, below, exemplify this phase of the research method. Table 7 illustrates a comparison matrix. The inconsistent cell is highlighted with borders.

Table 8, in turn, illustrates a disturbance matrix, which indicates which judgment should be reviewed. The disturbance value that departs the most from 1 indicates the point where the specialist must review his judgment [59]. In the case of the example, the cell T2/Tn, which is 11.21.

After reviewing the judgment, the questionnaire was again submitted to the consistency test. If the result was less than 0.10—the standard defined by Saaty [60]—the questionnaire was accepted; otherwise, it was again subjected to the disturbance matrix. Four AHP analyzes were performed, one for each stage of the risk management (risk identification, analysis of consequences, analysis of probability, and final assessment). Figure 1 ends this section, illustrating the construction of the research based on the AHP method.

4. Results and Discussion

Although seven people participated in the survey, this section only describes the results related to Interviewee 1 (hereinafter referred to as I1), in order to optimize the available space. The final tables in this section organize the results of the seven experts interviewed.

4.1. Parity Matrices

This topic presents I1′s parity matrices for the four steps: identification, consequence analysis, probability analysis, and evaluation. In

Table 9. Results related to Interviewee 1 (I1).

SECTION 1: Identification Parity Matrix
I1	Brainstorming	Structured Interviews		Delphi Method	Checklists	PHA	HAZOP	ERA		Scenario Analysis	FMEA
Brainstorming	1	3		1/7	1/3	3	3	1/3		1/5	1/7
Structured interviews	1/3	1		1/9	1/5	1/3	1/3	1/5		1/7	1/9
Delphi method	7	9		1	5	9	9	5		3	1
Checklists	3	5		1/5	1	5	5	3		1/3	1/5
PHA	1/3	3		1/9	1/5	1	1	1/5		1/7	1/9
HAZOP	1/3	3		1/9	1/5	1	1	1/5		1/7	1/9
ERA	3	5		1/5	1/3	5	5	1		1	1/7
Scenario analysis	5	7		1/3	3	7	7	1		1	1/3
FMEA	7	9		1	5	9	9	7		3	1
Total	27.00	45.00		3.21	15.27	40.33	40.33	17.93		8.96	3.15
SECTION 2: Consequence Analysis Parity Matrix
I1	HAZOP	ERA		Scenario analysis	RCA	FMEA	ETA	Decision tree		Riskindices	CBA
HAZOP	1	3		3	3	1/5	3	3		1/7	1/3
ERA	1/3	1		1	1	1/7	1	1		1/9	1/5
Scenario analysis	1/3	1		1	1	1/7	1	1		1/9	1/5
RCA	1/3	1		1	1	1/7	1	1		1/5	1/7
FMEA	5	7		7	7	1	7	7		3	5
ETA	1/3	1		1	1	1/7	1	1		1/5	1/5
Decision tree	1/3	1		1	1	1/7	1	1		1/5	1/5
Risk indices	7	9		9	5	1/3	5	5		1	3
CBA	3	5		5	7	1/5	5	5		1/3	1
Total	17.67	29.00		29.00	27.00	2.45	25.00	25.00		5.30	10.28
SECTION 3: Probability Analysis Parity Matrix
I1	ERA		RCA		FMEA		Decision tree		Risk indices
ERA	1		3		1/3		5		1/3
RCA	1/3		1		1/7		1		1/5
FMEA	3		7		1		7		3
Decision tree	1/5		1		1/7		1		1/5
Risk indices	3		5		1/3		5		1
Total	7.53		17.00		1.95		19.00		4.73
SECTION 4: Evaluation Parity Matrix
I1	PHA	ERA		RCA	FMEA		MCS		Risk indices
PHA	1	1/3		3	1/5		1/3		1/5
ERA	3	1		5	1/3		1		1/3
RCA	1/3	1/5		1	1/7		1/3		1/5
FMEA	5	3		7	1		5		3
MCS	3	1		3	1/5		1		1/7
Risk indices	5	3		5	1/3		7		1
Total	17.33	8.53		24.00	2.21		14.67		4.88

, the interviewee evaluated which tool, in his opinion, stood out from the others due to its ability to identify, analyze, and evaluate risks. Each section in this table addresses one of the steps recommended by ISO 31010.

4.2. Consistency Test

The twenty-eight matrices (four for each of the seven specialists) were submitted to a consistency test and obtained a CR (consistency ratio) equal to or less than 0.10, as recommended by Saaty [56]. The participants were informed of the consistency criteria and received guidance and examples to rely on when judging their parity matrices. When a questionnaire showed inconsistency, the respondent was invited to review their responses (for more details, see Section 3). This ensured the minimum consistency required by the AHP method in all matrices (identification, consequence analysis, probability analysis, and evaluation), as shown in

Table 10. Consistency indexes related to all interviewees.

	Identification	Consequence Analysis	Probability Analysis	Evaluation
I1	7.05%	4.19%	4.48%	8.55%
I2	7.84%	8.38%	5.11%	5.65%
I3	9.89%	8.73%	0.00%	5.65%
I4	8.79%	9.99%	9.81%	0.00%
I5	7.92%	5.21%	6.74%	8.59%
I6	8.69%	9.84%	7.65%	7.35%
I7	9.77%	9.86%	9.15%	7.08%

.

4.3. Aggregation of Individual Priorities

Considering all respondents with equal weight within the decision, the geometric means of the priorities for each step were calculated. Tools that at least one of the respondents was not aware of or had not applied in his/her professional experience were excluded from the means.

Therefore, the tools used had to meet the following requirements:

• Be classified by ISO 31010 as strongly applicable;
• Have been marked by respondents as known.

Table 11. Identification geometric mean.

Identification	I1	I2	I3	I4	I5	I6	I7	Geometric Mean
Brainstorming	0.05	0.07	0.25	0.12	0.08	0.02	0.14	0.08
Structured interviews	0.02	0.03	0.06	0.06	0.03	0.03	0.29	0.05
Delphi method	0.28	0.26	#	#	0.24	0.07	#	-
Checklists	0.10	0.20	0.09	0.05	0.04	0.07	0.29	0.10
Primary hazard analysis	0.03	#	#	#	0.05	0.07	#	-
HAZOP	0.03	#	#	#	0.05	0.19	#	-
Environmental risk analysis	0.09	0.04	0.54	0.24	0.12	0.12	0.08	0.13
Failure mode and effect analysis	0.29	0.20	#	0.39	0.36	0.28	0.08	-
Cause and effect analysis	#	0.02	0.06	0.02	0.02	0.06	0.03	-
Failure mode and effect analysis	0.14	0.20	#	0.10	#	#	0.07	-
SWIFT (structure and what if)	#	#	#	#	#	0.07	#	-
Consequence/probability matrix	#	#	#	0.02	#	#	0.02	-

,

Table 12. Consequence analysis geometric mean.

Consequence Analysis	I1	I2	I3	I4	I5	I6	I7	Geometric Mean
HAZOP	0.08	#	#	#	0.05	0.12	#	-
Environmental risk assessment	0.03	0.08	0.08	0.13	0.09	0.18	0.10	0.09
Failure Mode and effect analysis	0.34	0.20	#	0.37	0.20	0.19	0.06	-
Cause and consequence analysis	#	0.03	#	#	0.02	#	0.04	-
Cause and effect analysis	#	0.03	0.03	0.02	0.02	0.04	0.07	-
Risk indices	0.25	0.38	0.49	0.08	0.29	0.29	0.40	0.28
Cost benefit analysis	0.16	0.22	0.26	#	0.29	#	0.21	-
Multi criteria decision analysis	#	#	0.14	#	0.02	#	#	-
Failure mode and effect analysis	0.03	0.06	#	0.13	#	#	0.05	-
Root cause analysis	0.03	#	#	#	#	0.02	#	-
Event tree analysis	0.04	#	#	#	#	#	#	-
Decision tree	0.04	#	#	0.03	#	0.02	0.03	-
SWIFT (structure and what if)	#	#	#	#	#	0.06	#	-
Layer protect analysis	#	#	#	0.02	#	0.02	#	-
Consequence/probability matrix	#	#	#	0.03	#	0.05	0.04	-
Business impact analysis	#	#	#	0.13	#	#	#	-
Fault tree analysis	#	#	#	0.04	#	#	#	-

,

Table 13. Probability analysis geometric mean.

Probability Analysis	I1	I2	I3	I4	I5	I6	I7	Geometric Mean
Environmental risk assessment	0.16	0.12	0.13	0.21	0.12	0.14	0.16	0.15
Failure mode and effect analysis	0.46	0.42	#	0.53	0.43	0.24	0.07	-
Cause and consequence analysis	#	0.04	#	#	0.04	#	0.03	-
Risk indices	0.27	0.42	0.88	0.14	0.41	0.42	0.57	0.39
Root cause analysis	0.05	#	#	#	#	0.03	#	-
Decision tree	0.05	#	#	0.03	#	0.04	0.07	-
SWIFT (structure and what if)	#	#	#	#	#	0.03	#	-
Consequence/probability matrix	#	#	#	0.03	#	0.10	0.10	-
Fault tree analysis	#	#	#	0.07	#	#	#	-

and

Table 14. Evaluation geometric mean.

Evaluation	I1	I2	I3	I4	I5	I6	I7	Geometric Mean
Primary hazard analysis	0.06	#	#	#	0.05	0.09	#	-
Environmental risk assessment	0.13	0.07	0.07	0.09	0.11	0.17	0.15	0.11
Failure mode and effect analysis	0.39	0.28	#	0.45	0.53	0.26	0.07	-
Risk indices	0.28	0.64	0.64	0.45	0.31	0.41	0.78	0.47
Root cause analysis	0.04	#	#	#	#	0.03	#	-
Monte Carlo simulation	0.10	#	0.28	#	#	#	#	-
SWIFT (structure and what if)	#	#	#	#	#	0.05	#	-

show the geometric means for each ISO 31000 risk management step. The tools with “#” results are those that were excluded from the geometric mean because they were not scored by all seven respondents. Table 11 presents the geometric means of the risk identification step.

Table 12 presents the geometric means of the consequence analysis step.

Table 13 presents the geometric means of the probability analysis step.

Finally, Table 14 presents the geometric means of the evaluation step.

The fact that there were seven interviewees who were instructed to tick only the tools they knew or had already applied created a natural filter of the various tools proposed by ISO.

As can be seen in the previous Table 11, Table 12, Table 13 and Table 14, for the analysis and evaluation steps, the choice was between two options of tools. This shows that the group had a degree of homogeneity of knowledge regarding the tools.

4.4. Selected Tools for Risk Management in the Import/Export Process

As a result of the judgment of the seven interviewees’ priorities, the tools presented by ISO 31010 that would be most appropriate to identify, analyze consequences and probabilities and, finally, assess risks in the import and export process of an automotive industry located in Brazil, are shown in Figure 2.

For the identification step, the AHP analysis resulted in selecting the environmental risk assessment tool. This tool involves the assessment of the environment through observation and factual and quantitative/qualitative analysis of the risks of the environment in order to define the effects of exposure. Additionally, according to ISO 31010, this tool can be used in different fields, as its methodology explores the different ways in which a target can be exposed to a certain source of risk. Initially, this tool was used to assess risks in plants, animals, and humans when exposed to environmental risks. One of the known strengths of this tool is the provision of a more detailed understanding of the nature of the problem and the factors that increase risk.

The inputs for this tool come from observation and factual analysis. For this reason, the participants were asked to provide documents identifying the sources of risk that their processes have already suffered or an analysis of any potential sources of risk.

For the analysis and evaluation steps, the AHP analysis returned the same tool: risk indices. According to ISO 31010, a risk index is a semi-quantitative measure of risk. It is a derived estimate using a scoring approach using ordinal scales.

Analyzing separately the reasons behind the fact that the two steps returned the same tool, it is possible to highlight a few points:

• For the consequence analysis step, risk indices had the highest relative priority for five of the seven respondents, and for the other two respondents they represented the second highest relative priority.
• For the probability analysis step, risk indices had the highest relative priority for three of the seven respondents, while for two respondents they represented the second highest relative priority, and for the others, the third.
• In the evaluation step, risk indices again had the highest relative priority for five of the seven respondents and came in second place for the other two.

These data prove the interviewees’ preference for this tool. Additionally, their matrices obtained a consistency index within the recommended range. Therefore, this would not prevent the application of the same method for the steps.

Another factor that can explain the preference of this tool is the interviewees’ familiarity with the risk indices in their professional practice. Not only at the company studied, but also in their previous experiences, the interviewees mentioned having used KPIs (key performance indicators) to measure process performance.

When analyzing the literature on the tools “environmental risk assessment” and “risk indices”, it is observed that: (i) both are considered to be strongly applicable for a risk management process, that is, for the stages of identification, analysis and assessment of risks [55]; (ii) a way to improve the communication of a certain level of risk between people and, thus, to prevent information from being misinterpreted is through risk indices, which can be expressed by numbers or categories, such as words, letters or colors [61]; (iii) the “environmental risk assessment” tool finds increasingly broad applications [62], such as megaprojects [63], transportation [64], industrial parks [65], and in support of decision-making processes [66].

5. Final Considerations

As risk management processes are appropriately implemented in supply chains, the level of resilience of these chains increases and, as a result, business sustainability is positively impacted, which can occur in the economic, environmental, and social spheres as a whole, or in any of them separately. The logic behind this relationship is, in theory, relatively simple: the more investments in “formal instruments” adjusted for a company’s SCRM, the fewer the occurrences of: (i) accidents; (ii) machines breaking; (iii) adverse effects on workers’ health; (iv) problems with suppliers; (v) environmental problems; (vi) loss of financial resources (which can lead to the dismissal of employees, decreased generation of taxes, and less investment in social projects), among other side effects of risks, which can be avoided together or alone.

In the case of the Brazilian automotive industry targeted by this study, the research had the general objective of selecting ISO 31010 tools that could be used in each of the stages (identification, consequence analysis, probability analysis, and evaluation) of the risk management of the import and export process, so that an appropriate “formal instrument” of SCRM could be obtained. This objective was achieved through interviews (structured questionnaires) with professionals with extensive experience in the Alliance Customs & Trade (ACT) department, who made priority comparisons between the tools proposed by ISO 31000, one by one, based on the AHP method. One of the biggest advantages of the AHP method is shown in the analysis of possible inconsistencies in the responses of the specialists, through a “disturbance matrix”, developed for this purpose. This analysis happens almost immediately after the delivery of the completed questionnaire, still in the presence of the respondent, with the answers checked against this matrix of disturbance. As a result of the empirical study, the “environmental risk assessment” and “risk indices” tools were selected, culminating in a customized process to meet the risk management needs of the target process of this study. A relevant aspect of this result is the support that the specialized literature on risk management (ISO 31010) gives to both tools, making them as applicable to all stages of a risk management process.

5.1. Theoretical Implications and Contributions

The literature review showed that, despite advances in research on SCRM, both in quantity and in different approaches, little research had been directed to the automotive industry. As an example, delimiting the universe of research to the Web of Science database, it was observed that less than ten studies focusing on this industry had been published in journals over the past twenty years. Of these works, almost half were published only last year. Recent research, such as that developed by Vanalle et al. [51], corroborates this gap. Still, as regards the SCRM literature, it was observed that a good portion of what was found focused on raising and identifying the main risks in the automotive supply chain, while few were dedicated to developing “formal instruments” to manage these risks.

Another relevant point observed in the literature refers to the risks that caused the most vulnerability in the supply chain, including delivery delays, quality problems, communication failures between the different layers of suppliers, and forecast errors. When taking into account the issue of vulnerability, it is observed that nowadays the operations of supply chains are more and more exposed, for innumerable reasons, of which the following stand out: new trends in business (life cycles of increasingly smaller products, strategies such as Lean Six Sigma, Just in Time, and Outsourcing); cultural adaptations in operations with less and less geographical barriers; “depreciation” of the environment, which ends up generating a reaction from nature with hurricanes, earthquakes, and other natural disasters capable of generating disruptions in supply chains; amongst others. The fact is that these findings (scarcity of research focused on the automotive industry versus increasing supply chain vulnerability) make this work a relevant complement to SCRM research, by providing suggestions for tools for the execution of risk management steps in the import/export process of the automotive industry.

5.2. Practical and Managerial Implications

Although many managers are aware that SCRM is an indispensable practice to be incorporated into supply chain management, it is observed that in the day-to-day life of the automotive industries—at least as has been found in much of the literature dedicated to this theme—is that many of these managers do not use “formal instruments” to minimize (or even eliminate) risks along the different levels of the supply chain. This does not mean that managers do not use tools for risk management, but that, in most cases, these tools are used focally, without thinking about the chain as a whole.: it is precisely in this context that the so-called “formal instruments” should come in to minimize risks. In this direction, recent studies have shown that smaller suppliers and those more distant from vehicle manufacturers suffer the adverse effects of risks in a disproportionately larger and less predictable manner. However, with chains increasingly connected and interconnected, risks that affect suppliers at more distant levels result in, due to the domino effect, effects across the entire chain.

The final result of this research can contribute to the improvement of the risk management of the import/export processes of the Brazilian automotive industry, which was the target of this case study, insofar as it takes into account the tools previously selected by those who know and directly participate in the operational activities of that process. At this point, it is emphasized that the most significant contribution of this study to practical application was the suggestion of a customized procedure with the tools “environmental risk assessment” and “risk indices”, which will allow the risks to be identified, analyzed, and evaluated by the Alliance Customs & Trade department.

5.3. Limitations and Recommendations for Future Research

Given that the present research was carried out through a single case study, its most significant limitation is that its results cannot be generalized to other industries in the automotive sector, nor to companies from different sectors. In addition, as the research was focused on the process of importing productive inputs and the export of vehicles, its conclusions cannot be extrapolated to different areas of the researched company. Despite these limitations, it is believed that rational analogies—that is, an extrapolation based on the qualitative criteria of the results exposed here,—can be developed by professionals and researchers, since the study had a real application and that followed a logical sequence of structured steps, as explained and exemplified in the selection of organized tools for the identification, analysis, and assessment of risks. It is also noteworthy that the research had an exploratory nature; given the scarcity of research as specific as the one developed here, it contributes to a better understanding and the obtaining of initial insights to increase the familiarity of researchers and professionals on this topic.

Based on the limitations addressed here and the proven scarcity of specific research on this subject, it is recommended, as future research, that: (i) more practical research on applications of tools for the realization of SCRM in automotive industries be developed, regardless of area, department, or process; (ii) descriptive research, which has a focus on obtaining statistical conclusions on risk management in import and export processes for the automotive industry, is considered; (iii) action research should be developed based on the results obtained here, that is, that the risk management process composed by the tools “environmental risk assessment” and “risk indices” is tested, preferably in processes of import and export of automotive industries.