THE STARK REALITY
OF RESILIENCE

There is a particular kind of self-confidence visible in the data, which may be cause for celebration or concern. Across all five major threat categories we tested - climate, sustainability and regulation, geopolitical conflict, tariffs and emerging technology - between 89% and 92% of CEOs told us their business was prepared (having, in their words, a formally documented and, where necessary, board-approved mitigation strategy that had been tested) to handle the impact.

On its own, this looks like a story of organizational maturity. However, we asked a follow-up question, which may reframe the narrative.

Nine in ten CEOs say they are prepared for shocks with tested mitigation plans in place. But half couldn't last three weeks without operational disruption. Is there a gap between confidence and capacity?

THE THREE-WEEK CEILING

We asked CEOs how long their businesses could maintain operations without disruption to revenue or customer delivery if a major shock, such as a tariff escalation, an extreme weather event, a geopolitical shutdown, or a cyberattack, occurred tomorrow. They displayed lower confidence.

Put differently: 51% of CEOs at $500m+ global businesses say their organization could not maintain undisrupted operations beyond three weeks. The figures vary sharply across markets; for instance, 59% of Australian CEOs and 52% of US CEOs fall into the sub-three-week camp, compared with just 39% of Singaporean CEOs and 48% of UK CEOs.

REVENUE EXPOSURE WHEN SUPPLIERS GO DOWN

Of course, the big question when it comes to disruption is how much revenue is at risk. We asked: if your top three suppliers were disrupted for 2 weeks, what percentage of revenue would be at risk?

The modal answer was 11-20% of revenue (56%). Almost a quarter (24%) put the risk at 21-40%. In the UK, 42% of CEOs forecast a 21-40% revenue hit from a two-week disruption to their top three suppliers. This was the highest of any market we surveyed, perhaps reflecting the makeup of the UK's industrial base and thus how resilience, or a lack thereof, may play through. This is an important lens for businesses with a UK base or arm.

The commercial argument for investing in resilience, i.e., creating a strategic supply asset, may be rooted in these ‘revenue at risk’ numbers.

_{[2] https://www.weforum.org/stories/2025/01/supply-chain-disruption-digital-winners-losers/}

WHY THE GAP EXISTS

The reasons are likely multifaceted,
but in our work with CPOs across the globe, three explanations recur.

FIRST, preparedness can become a documentation exercise. A formally written, board-approved mitigation strategy is a real thing, and it needs to work in the real world. Businesses may feel covered because they have a plan, which ties back to a contract. The plans rarely buy as much time as their owners assume. Green on a scorecard does not mean operationally tested and ready, nor does it guarantee being a ‘customer of choice’ when needed.

SECOND, where dual sourcing has been pursued, it has often been implemented only at Tier 1. There is a genuine location shift happening in supply markets (e.g., China+1), but according to multiple sources, a majority of organizations still report a lack of supply visibility beyond Tier 1. Further, the World Economic Forum notes that more than 40% of organizations still report limited or no visibility into even Tier 1 supplier performance[3]. Many supply chains tie back to a common source. Many “+1” locations carry a new set of risks.

THIRD, the inventory build that did happen during 2021-2023 has been quietly unwound. Stockpiling has long been a primary mitigation strategy, but whilst inventory levels built sharply post-COVID, market and economic pressures have prompted a gradual unwinding from 20-23 onwards.

[1] https://www.weforum.org/stories/2025/01/supply-chain-disruption-digital-winners-losers/

_{[3] https://www.weforum.org/stories/2025/01/supply-chain-disruption-digital-winners-losers/}

1 | STRESS-TEST THE RUNWAY AND THE PLAN.
Buyers should move towards operational stress-testing as a build on documentary hurdles. The benchmark question for any board is: how long can we run, not what is written in our continuity plan? This means involving a broader set of stakeholders in the testing regime.

2 | BUY VISIBILITY INTO TIER 2 AND 3.
The lack of deep visibility into Tier 1, and more importantly, beyond Tier 1, is the single most underinvested resilience lever in the playbook. It is also one of the hardest and most expensive to achieve. Whilst the solution is possible, it is not practically achievable for the masses until such a point that utility solutions arrive.

3 | QUANTIFY REVENUE-AT-RISK PER SUPPLIER.
Revenue-at-risk measures, where material, should appear on the board risk register. Resilience can become a commercial and operational measure once it has a number against it.

WHAT TO DO ABOUT IT

For most businesses, the easy savings
have been achieved, and more innovative commercial and operational moves are needed to balance financial and operational performance.
Three priorities may follow.