Earthquakes, hurricanes, and fires don’t happen very often, but they can cause catastrophic damage when they do. These are what Yossi Sheffi calls low-probability, high-impact disruptions. The chances that such events will happen at any one place are pretty low. But the chances they will occur somewhere along any global company’s thinly stretched supply chain are much higher. For a company that isn’t prepared for a disaster, the result can be lost sales in the hundreds of millions of dollars and even unplanned exit from the business.

Which is why Sheffi, a professor of engineering at MIT and an expert on supply chain management, spent the last four years on a Cambridge-MIT Institute research project studying supply chain disruptions. Much of what he and a team of researchers found out he put into his latest book, The Resilient Enterprise (Cambridge and London: The MIT Press, 2005).

In that book, he shows how high-impact disruptions — a hurricane in Central America, an earthquake in Taiwan, even a thunderstorm in New Mexico — can inflict severe, even irreparable, damage on companies. A lightning strike in that New Mexico thunderstorm started a fire in a Philips microchip plant, shutting it down for weeks. That meant a severe disruption to the supply chains of the plant’s two biggest customers, Nokia and Ericsson. Nokia rebounded quickly, but Ericsson did not and soon had to drop out of the cell phone handset market.

Sheffi uses these and other examples to explain why some companies survived, why others didn’t, and what organizations can do to make themselves resilient enough to bounce back from disasters.

CSC World: You wrote that 9/11 didn’t make companies take business continuity any more seriously. Have they responded the same way to Katrina?

Sheffi: No, because in one sense Katrina had an even bigger impact than 9/11. One reason companies went back to business as usual after 9/11 is that no one faulted the government for its response.

But Katrina exposed so many flaws in federal government processes, in FEMA and DHS, and in the state and city governments. After 9/11, we heard a lot about how disasters are everyone’s problem and somehow we’ll all pull together. I hear less and less of that now. Business and Americans in general lost a lot of confidence in the ability of government to respond in a crisis. Companies believe they’re on their own, so they are taking business continuity more seriously.

But I don’t call it business continuity in my book. It’s about resilience, which is more than business continuity.

CSC World: Why don’t you call it business continuity?

Sheffi: Because I don’t want to pigeonhole it. Business continuity is usually an afterthought, something companies think about after they build their supply chains.

So many companies see a business continuity plan simply as a list of things to check off. Typically, a company’s plan has never even been tested. Remember the fire drills you did in grade school? The school didn’t hand you a piece of paper. Everybody actually had to leave the building. Why would any businessperson, facing much more complicated disruptions, think all they need is a piece of paper? If you don’t test your plan, you don’t have a plan.

CSC World: What do you mean by resilience?

Sheffi: It’s a concept from material science. It means the ability of material to bounce back to its former shape following some kind of deformation. In business, it means the ability to get back to the same level of production, sales, customer service — whatever performance metric you want to use — following a disruption. Resilience isn’t a separate function in a company. It’s a characteristic of an organization, part of its culture.

CSC World: Companies have always faced risks. Has globalization increased those risks?

Sheffi: Yes, absolutely. Companies are building longer supply chains, with more entities involved, which means the companies need longer-range market forecasts. Resilience is about how you design your supply chain.

There are two ways of dealing with risks. One is redundancy — extra inventory, extra capacity, many suppliers. But redundancy is an expensive way to do business, especially if you’re doing it to deal with low-probability, high-impact disruptions. The other way is to run a lean operation with not much inventory and with single suppliers rather than multiple suppliers.

CSC World: In your book, you advise companies to build deep relationships with their main suppliers.

Sheffi: There are very good reasons to have a single supplier. It’s more economical, you get better access to innovation, and you get more attention as a big customer. But if you have a single supplier, that supplier is part of you. You had better understand that. If something happens to them, something happens to you. And you can’t recover quickly from a major disruption to a single supplier. So you have to make a big investment in knowing as much as you can about that supplier — their financial strategy, who their suppliers are, etc..

To see what can happen when a company doesn’t make that investment, look at Land Rover. Land Rover’s only supplier of chassis was UPF Thompson, but in 2001, it was taken completely by surprise when a shipment of chassis failed to arrive. UPF had been making some dangerous investments in Southeast Asia, and it went bankrupt. These things should not be unanticipated. Land Rover should have known what kind of investments UPF Thompson was making. That’s an example of a shallow relationship with a single supplier.

CSC World: What are some examples of deep relationships with single suppliers?

Sheffi: Dell has very deep relationships with two of its suppliers, Microsoft and Intel. But it has more shallow relationships with suppliers of commodities like disc drives. Dell has several suppliers of disc drives, and it will switch from one to another to save a few cents per disc. Dell can also switch easily if one supplier is disrupted.

Did you know that all of McDonald’s fishcakes are made by a company in Massachusetts? This is a 35-year relationship based only on a handshake. There’s no contract. The supplier doesn’t sell to Burger King or Wendy’s, and McDonald’s doesn’t buy from anyone else. They develop new products together, they work together. If one got in trouble, the other would help.

CSC World: In your book, you say that’s another reason for deep relationships.

Sheffi: Yes. My main point was anticipating problems with suppliers. In addition, if you are a large part of the market for your supplier, there’s a higher chance that your supplier will go to the wall to help you if you got in trouble. And if you build a strong relationship with that supplier, they’re likely to help you without asking you to sign a contract first; they will trust you, and this trust can expedite actions when it matters..

It’s dangerous to have a shallow relationship with a single supplier. And it’s too expensive to have deep relationships with multiple suppliers. You have to do one or the other. Either deep relationships with one supplier or shallow relationships with many suppliers. Or deep relationships with main suppliers and shallow relationships with commodity suppliers.

CSC World: You also wrote about corporate culture. Why is that important?

Sheffi: A lot of companies are doing the right things in terms of supply chain design. But companies with a resilient culture also have something else, something in their DNA. Companies that survive disruptions communicate a lot. They communicate obsessively. There was a lot of communication in Nokia after the fire in the chip plant in New Mexico, so all the key people knew right away there would be delayed deliveries. That didn’t happen at Ericsson.

Resilient organizations also empower people. Going back to Katrina, the Coast Guard performed brilliantly. In a normal year, the Coast Guard saves 4,000 to 4,500 people. In the first four days of Katrina, it saved 24,000 people. All the helicopters you saw on TV for the first few days were Coast Guard. They did all that with no order from above. The Coast Guard has several operational principles, and the first one is local initiative. Local commanders went into action because they are expected to act without going through the chain of command.

We all know about Toyota, that workers on the production line can pull a cord and stop the line if they see a problem. It’s part of the reason for Toyota’s success. Toyota employees are empowered to act when they see a problem. In addition, Toyota has been successful in instilling in their employees a sense of their bigger mission. Resilient organizations foster that sense of a bigger mission which makes people “go through walls” and perform extraordinarily when this is called for.