Securing the electric power supply chain is increasingly critical
For electric power companies, the number of suppliers and contracted laborers providing expertise and skills has expanded over the years to meet a wide range of industry needs.21 For example, from 2015 to 2020, Exelon’s supplier pool had grown by 18%, to 8,000 suppliers, and its spending rose by 13% to US$9.5 billion.22 In the case of clean energy technologies, concerns about supply chain security affect not only manufactured components but also go deeper into the key materials and critical minerals needed to build those components (see Renewable transition: Separating perception from reality). To manufacture a solar panel, about 40 components must get to the factory, including rare earth elements,23 making analyzing not just Tier 1, but also Tier 2 and Tier 3 suppliers increasingly important to diversify supply risk.
While having such a vast breadth and depth of suppliers can help mitigate supply constraints caused by natural disasters, pandemics, trade policies, and more, it can also open the door to more noncompliance and safety risks, especially without adequate supplier qualification and risk management controls. Understanding these multitier supplier dependencies and vulnerabilities better can help power and renewable energy companies address not only the physical but also the cybersecurity risks that the sector is increasingly facing.
Consequently, many companies are expanding their supply chain management approach and integrating it into total third-party risk management (TPRM). In fact, their third-party networks now go well beyond suppliers of goods and services to include affiliates and joint venture partners, research and development (R&D) organizations, technology incubators, retailers, distributors, and sales agents that can cause disruptions in the supply chain.
Until recently, companies in the electric power sector often addressed supply chain risk management in siloes, separating risks related to policy, technology, finance, corruption, cybersecurity, suppliers and other stakeholders, and more. And supply chain owners often had sole responsibility. But siloed approaches to TPRM can result in check-the-box exercises in which a business unit or function narrowly focuses on a single part of the business, without considering the effects on other areas of supply chain. Today, there’s increasing coordination between functions in a more integrated, cross-risk approach. Executives across the organization, from chief financial officers to chief operating officers, are increasingly involved, and some companies are combining supply chain with TPRM. These programs are continuously monitored to enable proactive management of emerging risks. A senior supply official at a Midwestern utility noted that they recently integrated supplier relationship management into their supplier quality team and aligned it with the supply chain function.
Companies can manage these risks by improving supply chain visibility—illuminating each tier of the supply chain from primary supplier (Tier 1) through their supplier’s supply chain (Tier 2 and beyond). With greater visibility, they can better understand the potential risks involved with each supply chain partner, across all tiers. For example, a company might think it is diversifying risk by procuring solar panels from four to five suppliers, but if those suppliers were all purchasing a critical element for producing solar panels, such as polysilicon, from the same supplier, the risk may be insufficiently managed. Most of our survey respondents reported limited visibility into their supplier network beyond Tier 1 or Tier 2 (figure 6).