Custom Risk Profiles in Cosmic Frog

Being able to assess the Risk associated with your supply chain has increasingly become more important in a quickly changing world with high levels of volatility. Not only does Cosmic Frog calculate an overall supply chain risk score for each scenario that is run, but it also gives you details about the risk at the location and flow level, so you can easily identify the highest and lowest risk components of your supply chain and use that knowledge to quickly set up new scenarios to reduce the risk in your network.

By default, any Neo optimization, Triad greenfield or Throg simulation model run will have the default risk settings, called OptiRisk, applied using the DART risk engine. See also the Getting Started with the Optilogic Risk Engine documentation. Here we will cover how a Cosmic Frog user can set up their own risk profile(s) to rate the risk of the locations and flows in the network and that of the overall network. Inputs and outputs are covered and in the last section notes & tips & additional resources are listed.

Overview of Risk Categories, Components and Subcomponents

The following diagram shows the Cosmic Frog risk categories, their components, and subcomponents.

A description of these risk components and subcomponents follows here:

1. Source count risk is the risk associated with the number of sources a customer or facility can be supplied from. The fewer the sources, the higher the risk since there are few or no back-up sources available should something happen to the main source(s).
2. Concentration risk is the risk associated with the percentage of total demand/throughput/supply that is concentrated at individual customers, facilities, and suppliers. The more highly concentrated the demand/throughput/supply is, the higher the risk as we could lose that demand/throughput/supply if something were to happen to that customer, facility, or supplier.
3. Geographic risk is the risk based on where the customer, facility or supplier is located. Geographic risk is determined by 6 subcomponents as follows:
   • Biolab distance risk: the risk associated with the proximity of the customer, facility, or supplier to a laboratory with a biolevel safety of 4. The shorter the distance, the higher the risk because the customer, facility, or supplier could be affected in case of an accident at the biolab. Data source: globalbiolabs.org
   • Economic risk: the risk associated with the economic characteristics of the country where the customer, facility, or supplier is located. This universal economic fitness measure is a combination of the country’s GDP and the number of unique exporting products. The higher the economic fitness score, the lower the risk, as the country can likely adapt well to economic changes and is more self-sufficient. Universal Economic Fitness Metric data source: https://databank.worldbank.org/metadataglossary/economic-fitness-2/series/EF.EFM.UNIV.XD
   • Natural disaster risk: the likelihood that a natural disaster will happen where the customer, facility, or supplier is located. This risk takes historical data on cyclones, droughts, earthquakes, floods, landslides, and volcanic eruptions into account. The higher the chance of a natural disaster happening, the higher the risk. Data source: https://sedac.ciesin.columbia.edu/data/set/ndh-multihazard-total-economic-loss-risk-deciles; map: https://sedac.ciesin.columbia.edu/arcgis/rest/services/sedac/natural_disaster_hotspots/MapServer?f=jsapi
   • Nuclear distance risk: the risk associated with the proximity of the customer, facility, or supplier to a nuclear power station. The shorter the distance, the higher the risk because the customer, facility, or supplier could be affected in case of an accident at the power station. Data source: https://en.wikipedia.org/wiki/List_of_nuclear_power_stations
   • Political: this is a combination of 2 indicators of the political climate in the country of the customer, facility, or supplier. These indicators are control of corruption and political stability and absence of violence/terrorism. A lower score indicates higher levels of corruption, violence and terrorism and less political stability and therefore presents a higher risk to the customer, facility, or supplier. Data source for these 2 indicators: https://databank.worldbank.org/source/worldwide-governance-indicators/preview/on
   • Epidemic risk: the risk associated with the impact of Covid-19 on the country where the customer, facility or supplier is located. A higher number indicates higher levels of transmission and therefore more disruptions to the work force and supply chain. Data source: https://ourworldindata.org/covid-cases
4. Utilization risk is the risk associated with how much the facilities and suppliers are being used. It consists of 3 risk subcomponents:
   • Throughput utilization risk: the risk associated with the amount of product flowing out of a facility or supplier as compared to the total amount of outflow it can handle. The higher the throughput utilization, the higher the risk as the location will not be able to handle much more product if needed, for example due to increased demand or another facility/supplier going down.
   • Storage utilization risk: the risk associated with the amount of product being stored at the facility or supplier as compared to the total amount of product that can be stored at the location. Like throughput utilization, the higher the storage utilization, the higher the risk as the location will not be able to store much more product in case needed.
   • Work center utilization: if work centers are being modelled, this is the risk associated with the amount of product being produced on the works centers at the facility or supplier as compared to the maximum amount of product that can be produced on the work centers. Again, the higher the utilization, the higher the risk as we cannot easily scale up production further at the location.
5. Transport time risk is the risk associated with how long the transport times are for the flows in the network. The longer the transport times the higher the risk, as longer lead-times make the network less agile, while the variance in lead-times is increased. Overall, the network will be less able to react to changes in demand.
6. Time to import risk is the risk associated with how long it takes from port of discharge to arrival at the consignee and is a country-based metric. Again, the longer the time to import, the higher the risk, as longer overall lead-times make the network less agile, while the variance in lead-times is increased. Data source: https://databank.worldbank.org/source/world-development-indicators/Series/LP.IMP.DURS.MD
7. Time to export risk is the risk associated with how long it takes from shipment to port of loading and is a country-based metric. Again, the longer the time to export, the higher the risk, as longer overall lead-times make the network less agile, while the variance in lead-times is increased. Data source: https://databank.worldbank.org/source/world-development-indicators/Series/LP.EXP.DURS.MD

Custom Risk Profiles – Inputs

Custom risk profiles are set up and configured using the following 9 tables in the Risk Inputs section of Cosmic Frog’s input tables. These 9 input tables can be divided into 5 categories:

Following is a summary of these table categories; more details on individual tables will be discussed below:

1. The Risk Rating Configurations table is the high-level table where a custom Risk Rating can be added and linked to a Risk Profile. Once all the tables are set up, the Risk Rating can be included by setting Status = Include on this table.
2. The overall risk score is calculated from the risk scores of the 4 risk categories (Customer, Facility, Supplier and Network), which are weighed using the weights set in the Risk Summary Configurations table.
3. The Customer, Facility, Supplier, and Network Risk Configurations tables are used to set the weights of the different risk components. For risk components that do not have further subcomponents (the ones in black font in the diagram at the beginning of this documentation), like Source Count Risk and Time To Export, the Band Definition that needs to be used to determine the risk score of that component is selected on these tables too.
4. Geographic risk and Utilization risk are the 2 risk components that are made up of multiple subcomponents. The weights to be used for these subcomponents to calculate the overall geographic and utilization risk scores, and the band definitions selected for these subcomponents are set on the Geographic and Utilization Risk Configurations tables.
5. The actual bands for the risk levels are specified in the Risk Band Definitions table, the names entered here for the band definitions are used in the 6 Configurations tables mentioned in the previous 2 bullet points to link them together.

Risk Rating Configurations Table

We will cover some of the individual Risk Input tables in more detail now, starting with the Risk Rating Configurations table:

1. Give your Risk Rating a name in the Risk Rating Name field. This name will be shown in the output tables to identify the records that used this custom Risk Rating. A custom Risk Rating for Optimization (Risk Rating Template Optimization) and one for Simulation (Risk Rating Template Simulation) have been set up already in this table and the other Risk Input tables. So, instead of starting a new custom Risk Rating from scratch, a user can also opt to change the weights and band definitions of these Risk Ratings as desired.
2. The Risk Profile Name field is used to link the Risk Profile together with the weights and band definitions that will be set in the other Risk Input tables. The same Risk Profile Name that is used in this table needs to be used on all records in the other Risk Input tables so that they make up 1 complete Risk Profile together.
3. One can set up multiple custom Risk Ratings. Only ones that have Status set to Include will be used when running a simulation or optimization. The default OptiRisk rating that is built into Cosmic Frog will always be run too.

Risk Summary Configurations Table

In the Risk Summary Configurations table, we can set the weights for the 4 different risk components that will be used to calculate the overall Risk Score of the supply chain. The 4 components are: customers, facilities, suppliers, and network. In the screenshot below, customer and supplier risk are contributing 20% each to the overall risk score while facility and network risk are contributing 30% each to the overall risk score.

These 4 weights should add up to 1 (=100%). If they do not add up to 1, Cosmic Frog will still run and automatically scale the Risk Score up or down as needed. For example, if the weights add up to 0.9, the final Risk Score that is calculated based on these 4 risk categories and their weights will be divided by 0.9 to scale it up to 100%. In other words, the weight of each risk category is multiplied by 1/0.9 = 1.11 so that the weights then add up to 100% instead of 90%. If you do not want to use a certain risk category in the Risk Score calculation, you can set its weight to 0. Note that you cannot leave a weight field blank. These rules around automatically scaling weights up or down to add up to 1 and setting a weight to 0 if you do not want to use that specific risk component or subcomponent also apply to the other “… Risk Configurations” tables.

Facility Risk Configurations Table

Following are 2 screenshots of the Facility Risk Configurations table on which the weights and risk bands to calculate the Risk Score for individual facility locations are specified. A subset of these same risk components is also used for customers (Customer Risk Configurations table) and suppliers (Supplier Risk Configurations table). We will not discuss those 2 tables in detail in this documentation since they work in the same way as described here for facilities.

1. The Geographic Risk Weight set on this table specifies how heavily the combined geographic risks (specified in the Geographic Risk Configurations table discussed further below) should be weighed when calculating the individual risk scores of facilities.
2. The Concentration Risk Weight field specifies how heavily concentration risk should be weighed when calculating the risk score of an individual facility. It works together with the Concentration Risk Band field: this field contains the name of a Band Definition specified in the Risk Band Definitions table, set to “Facility and Supplier Concentration Band Template” here. Looking this definition up in the Risk Band Definitions table shows the following bands and associated risk scores:

The first band is from 0.0 (first Band Lower Value) to 0.2 (the next Band Lower Value), meaning between 0% and 20% of total network throughput at an individual facility. The risk score for 0% of total network throughput is 1.0 and goes up to 2.0 when total network throughput at the facility goes up to 20%. For facilities with a concentration (= % of total network throughput) between 0 and 20%, the Risk Score will be linearly interpolated from the lower risk score of 1.0 to the higher risk score of 2.0. For example, a facility that has 5% of total network throughput will have a concentration risk score of 1.25. The next band is for 20%-30% of total network throughput, with an associated risk between 2.0 and 3.5, etc. Finally, if all network throughput is at only 1 location (Band Lower Value = 1.0), the risk score for that facility is 10.0. The risk scores for any band run from 1, lowest risk, to 10, highest risk.

3. The Utilization Risk Weight set on this table specifies how heavily the combined utilization risks (specified in the Utilization Risk Configurations table discussed further below) should be weighed when calculating the individual risk scores of facilities.
4. In future, Cosmic Frog users can set up their own Risk categories and then use the User Defined Risk Weight field to specify how heavily that risk should be weighed when calculating the risk score of individual facilities.
5. The Source Count Risk Weight field specifies how heavily source count risk should be weighed when calculating the risk score of an individual facility. Like Concentration Risk, Source Count Risk looks up the risk for different bands of number of sources from the Risk Band Definitions table, the name of this Band Definition is specified in the Source Count Risk Band field (set to “Source Count Band Template” here). Like what was done under bullet number 2 above, we can look up the band definitions of this Source Count Band Template to see how different source counts will be assigned risk scores from 1.0 to 10.0.

Geographic Risk Configurations Table

Following screenshot shows the Geographic Risk Configurations table with 2 of its risk subcomponents, biolab distance and economic:

As an example here in the red outline, the Biolab Distance Risk is specified by setting its weight to 0.05 or 5% and specifying which band definition on the Risk Band Definitions table should be used, which is “BioLab and Nuclear Distance Band Template”. The Definition of this band template is as follows when looked up in the Risk Band Definitions table:

This band definition says that if a location is within 0-10 miles to a Biolab of Safety Level 4, the Risk Score is 10.0. A distance of 10-20 miles has an associated Risk Score between 10 and 7.75, etc. If a location is 130 miles or farther from a biolab of safety Level 4, the Risk Score is 1.0.

The other 5 subcomponents of Geographic Risk are defined in a similar manner on this table: with a Risk Weight field and a Risk Band field that specifies which Band Definition on the Risk Band Definitions table is to be used for that risk subcomponent. The following table summarizes the names of the Band Definitions used for these geographic risk subcomponents and what the unit of measure is for the Band Values with an example:

Geographic Risk Subcomponent	Risk Band Definition used in the Risk Profile Template Optimization template	Unit of Measure for Band Values
BioLab Distance	BioLab and Nuclear Distance Band Template	MI, e.g. a 30 mile distance has a risk score of 6.0
Economic	Economic Band Template	Country’s Universal Economic Fitness score (range 0-32.5 in 2019). E.g. a UEF score of over 12.0 has a risk score of 1
Natural Disaster	Natural Disaster Band Template	Location’s probability to be struck by a natural disaster. E.g. a probability of 25-30% has a risk score between 8.8 and 9.5
Nuclear Distance	BioLab and Nuclear Distance Band Template	MI, e.g. 20-30 mile distance has a risk score between 7.75 and 6.0
Political	Political Band Template	Country’s combined score on control of corruption and political stability & absence of violence/terrorism. E.g. a political score of -1.0 to -0.5 has a risk score of 9.8 to 9.0
Epidemic	Epidemic Band Template	The epidemic’s transmission rate. E.g. a reproduction number of 1-1.5 has a risk score from 2.25 to 7.0

Utilization Risk Configurations Table

Similar to the Geographic Risk component, the Utilization Risk component also has its own table, Utilization Risk Configurations, where its 3 risk subcomponents are configured. Again, each of the subcomponents has a Risk Weight field and a Risk Band field associated with it. The following table summarizes the names of the Band Definitions used for these utilization risk subcomponents and what the unit of measure is for the Band Values with an example:

Utilization Risk Subcomponent	Risk Band Definition used in the Risk Profile Template Optimization template	Unit of Measure for Band Values
Throughput Utilization	Facility Throughput and Storage Utilization Band Template	Percentage of throughput capacity used at location. E.g. a utilization of 65-80% has a risk score from 2.0 to 8.0
Storage Utilization	Facility Throughput and Storage Utilization Band Template	Percentage of storage capacity used at location. E.g. a utilization of 80-90% has a risk score form 8.0 to 9.7
Work Center Utilization	Workcenter Utilization Band Template NetOpt	Percentage of work center capacity used at location. E.g. a utilization of 70-80% has a risk score from 1.5 to 3.0

Network Risk Configurations Table

Lastly on the Risk Inputs side, the Network Risk Configurations table specifies the components of Network Risk in a similar manner: with a Risk Weight and a Risk Band field for each risk component. The following table summarizes the names of the Band Definitions used for these network risk subcomponents and what the unit of measure is for the Band Values with an example:

Network Risk Component	Risk Band Definition used in the Risk Profile Template Optimization template	Unit of Measure for Band Values
Transport Time	Transport Time Band Template	HR, e.g. a Transport Time of 240-336 hrs (10-14 days) has a risk score from 8.5 to 9.8
Time to Import	Time To Import and Export Band Template	HR, e.g. a Time to Import of 48-96 hrs (2-4 days) has a risk score from 3.0 to 8.0
Time to Export	Time To Import and Export Band Template	HR, e.g. a Time to Import of 96-120 hrs (4-5 days) has a risk score from 8.0 to 9.5

Custom Risk Profiles – Outputs

Risk outputs can be found in some of the standard Output Summary Tables and in the risk specific Output Risk Tables:

1. The Output Summary Tables contain risk outputs for the Risk Rating that is specified as the Primary Risk Rating on the Model Settings table. By default, this is the OptiRisk risk rating which uses weights and band definitions that are set up under the hood. If a user specifies to use a Risk Rating that is set up in the Risk Input tables as the Primary Risk Rating, then the Output Summary Tables will use the inputs of that Risk Rating to calculate the Risk Outputs captured here. A couple of examples of Risk Outputs in the Output Summary Tables are:
   1. The Optimization Network Summary, Optimization Greenfield Network Summary, and Simulation Network Summary tables all contain an overall Risk Score for each scenario.
   2. The Optimization Customer Summary, Optimization Greenfield Customer Summary, and Simulation Customer Summary tables all contain a customer risk score and scores for the customer risk components of concentration risk, source count risk, and geographic risk for each individual customer.
2. In the specific Output Risk Tables, the OptiRisk risk outputs are by default always included whether it was used as the primary risk rating or not. Outputs for any custom Risk Rating that has Status set to Include in the Risk Rating Configurations table are included in these output tables too. How these risk output tables feed into each other is similar to how the risk input tables feed into each other, and the hierarchy is explained in the following diagram. It is also noted in this diagram how an overall customer risk score is calculated from individual customer risk scores, and similar for the overall facility risk score, overall supplier risk score and overall network risk score:

The following screenshot shows the Optimization Risk Metrics Summary output table for a scenario called “Include Opt Risk Profile”. It shows both the OptiRisk and Risk Rating Template Optimization risk score outputs:

1. The built in OptiRisk rating calculates an overall Risk Score of 5.3 for this scenario, which is calculated from the 4 risk categories of Customer, Facility, Supplier, and Network, using the weights that are set up underneath the hood.
2. The Risk Rating Template Optimization risk rating that was included in this scenario calculates an overall risk score of 4.5, which is calculated as follows using the weights set on the Risk Summary Configurations input table (see further above): customer risk weight * customer risk score + facility risk weight * facility risk score + supplier risk weight * supplier risk score + network risk weight * network risk score = 0.2 * 4.5 + 0.3 * 5.7 + 0.2 * 7.4 + 0.3 * 1.2 = 4.5

On the Optimization Customer Risk Metrics, Optimization Facility Risk Metrics, and Optimization Supplier Risk Metrics tables, the overall risk score for each customer, facility, and supplier can be found, respectively. They also show the risk scores of each risk component, e.g. for customers these components are Concentration Risk, Source Count Risk, and Geographic risk. The subcomponents for Geographic risk are further detailed in the Optimization Geographic Risk Metrics output table, where for each customer, facility, and supplier the overall geographic risk score and the risk scores of each of the geographic risk subcomponents are listed. Similarly, on the Facility Risk Metrics and Supplier Risk Metrics tables, the Utilization Risk score will be listed for each location, whilst the Optimization Utilization Risk Metrics table will detail the risk scores of the subcomponents of this risk (throughput utilization, storage utilization, and work center utilization).

Example Calculation of a Facility’s Overall Risk Score

Let’s walk through an example of how the risk score for the facility Plant_France_Paris_9904000 was calculated using a few screenshots of input and output tables. This first screenshot shows the Optimization Geographic Risk Metrics output table for this facility:

The geographic risk score of this facility is calculated as 4.0 and the values for all the geographic risk subcomponents are listed here too, for example 8.2 for biolab distance risk and 3.6 for political risk. The overall geographic risk of 4.0 was calculated using the risk score of each geographic risk subcomponent and the weights that are set on the Geographic Risk Configurations input table:

Geographic Risk Score = (biolab distance risk * biolab distance risk weight + economic risk * economic risk weight + natural disaster risk * natural disaster risk weight + nuclear distance risk * nuclear distance risk weight + political risk * political risk weight + epidemic risk * epidemic risk weight) / 0.8 = (8.2 * 0.05 + 5.3 * 0.2 + 2.8 * 0.3 + 2.3 * 0.05 + 3.6 * 0.1 + 4.5 * 0.1) / 0.8 = 4.0. (We need to divide by 0.8 since the weights do not add up to 1, but only to 0.8).

Next, in the Optimization Facility Risk Metrics output table we can see that the overall facility risk score is calculated as 6.8, which is the result of combining the concentration risk score, source count risk score, and geographic risk score using the weights set on the Facility Risk Configurations input table.

This screenshot shows the Facility Risk Configurations input table and the weights for the different risk components:

Facility Risk Score = (geographic risk * geographic risk weight + concentration risk * concentration risk weight + source count risk * source count risk weight) / 0.6 = 4.0 * 0.3 + 9.3 * 0.2 + 10.0 * 0.1) / 0.6 = 6.8. (We need to divide by 0.6 since the weights do not add up to 1, but only to 0.6).

Notes & Tips & Resources on Risk

A few things about Risk in Cosmic Frog that are good to keep in mind:

1. A scenario’s overall risk score will be rounded up to 1 decimal place. So, a calculated overall risk score of 4.03 will be reported as 4.1. This rounding up does not happen in other areas of the risk calculations. E.g. if a customer’s risk score is calculated as 8.11, it will be reported as 8.1.
2. The custom risk profiles that are pre-populated in the Risk Inputs Tables can be modified by users as they see fit. If you want to go back to the pre-populated numbers, the best way to do so currently is:
   • open a new model or an existing one where these numbers were not modified
   • select the Risk Inputs Tables (you can select multiple tables by holding down the ctrl key) and click on File > Export Excel or File > Export CSV
   • switch back to the model with the changed numbers that you want to reset to the original numbers
   • use File > Import File to import the file(s) that were exported under bullet b above
3. Currently, in the pre-populated custom risk profiles, there are some band definitions that are used in multiple places. For example, the Source Count Band Template is used to determine the source count risk at both customers and facilities. This is fine to do, but if different band definitions are appropriate for your use case, you can create 2 separate band definitions for source count risk, 1 for customers and 1 for facilities.
4. If you change any of the primary units of measures in the Model Settings table, you may need to update some Band Lower Values of the Risk Band Definitions. For example, the default Primary Distance UOM is miles (MI). If you change this to kilometers (KM), the Band Lower Values of the BioLab and Nuclear Distance Band Template will now be interpreted as being in KM rather than in MI.
5. One way to have Risk really drive the outputs of your models is to use it with Sequential Objectives. You can choose geographic risk and/or concentration risk and/or source count risk and/or transport time risk as objectives that the Neo optimization engine needs to take into account while optimizing. See this “How to Use Sequential Objectives” help article for more details on how to set up sequential objective optimization.
6. The “Global Risk Analysis” Cosmic Frog model in the Resource Library is a good example model that showcases Risk. Here, the supply chain is being stress tested by excluding each location one by one in many scenarios and then comparing the cost and risk outputs. There is a video with this resource which will be helpful to watch when exploring this model. It also has an example of using Total Profit and Geographic Risk as the 2 objectives for a Neo optimization run. If you are unfamiliar with the Resource Library, then please see this help article on “How to use the Resource Library”.