Case Study: Medtronic's Healthy Medical Device Supply Chain

Lesley Hume:

So let me introduce today’s presenters. Joe Robinson is VP of enterprise risk and continuity for Medtronic. Joe has held this role for the last three years and is responsible for leading the enterprise risk and global business continuity programs for Medtronic’s operations, including global supply chain, ensuring effective crisis management when disruptions occur. Joe has over 22 years of leadership in the field of risk management, including enterprise risk, crisis management, security and business continuity. He’s worked with large scale organizations to ensure the resilience of supply chains and has experience in both public and private sectors working with organizations such as Micron Technology, Abbott Labs, Navistar, and the US Department of Defense. Joe also recently retired from the United States Army Reserve as a military intelligence officer. During his 21 years of combined reserve and active duty time in the Army, he held the following roles: assistant professor of military science at Boise State University, counterintelligence branch chief, company commander, biometrics intelligence officer and security officer. Joe has a bachelor’s degree in business administration from Westminster College and has maintained his membership as a certified business continuity professional since 2010.

I’m also joined today by David Shillingford. David is based in New York. He’s Everstream’s Chief Strategy Officer and a co-founder. I’m Lesley Hume. I’m our digital director and coming to you from Melbourne, Florida. So we have a lot to cover in today’s agenda. I’m going to turn it over to David to start with a little bit about who Everstream is and our expertise on today’s topic. David.

David Shillingford:

Great. Thank you very much Lesley, and welcome Joe. Great to have you with us. So different people look at supply chain risk through different lenses, so I’ll start with a couple of comments on Everstream so you can understand the lens that we are looking through today. We’re a data and analytics company. We leverage data and analytics to enable companies to take risk into account when making supply chain decisions during planning and execution across source, make and deliver. So if my hyper-short attention span kids were ever to ask me what we do, I’d say we keep the world moving by keeping risk out of the way.

You’ll hear us talk a lot about data during the webinar. This is at the core of the challenge and where we focus much of our efforts. We’re analyzing billions of data points every day, but you’ll hear numbers like that from many companies. The part that people often miss is what I’ll call the invisible heavy lifting, such as the need to have years of curated historical data to train predictive models and to have multilingual teams and for those teams to be in the same region as our clients’ supply chains. So as you can see, even just a few of our clients cover every country in the world.

Much of what you’ll hear from Joe today also applies to industries beyond healthcare. We found that our experiences with one client in one industry are transferable to others in other industries, particularly where one industry is further ahead than another. We’ll also touch on the importance of what we call ecosystem thinking and why companies should look wherever possible to embed risk insights into existing platforms and to make those platforms smarter rather than creating new separate workflows for risk management.

So with that, let’s look at a few best practices that we see across the industry and in which Medtronic has been a trailblazer. No single company covers all supply chain risks, so it’s necessary to partner with a company that specializes in collecting data that is specific to supply chain risks, such as location-specific hazards, and is willing and able to integrate other risk data that crosses industries and functions like cyber risk or financial health scores, and all of this data should be made available across all supply chain functions using a standardized score to support cross-functional collaboration. And now we’re seeing companies making these scores available to suppliers and to clients to increase upstream and downstream synchronization and orchestration.

Our discussions with CFOs and chief supply chain officers almost always end up at the same point. They want to understand revenue at risk. In other words, can my supply chain deliver the goods and materials that we need to make our forecast? And to do this requires much more than understanding supplier risk. Third-party risk is an important component for sure, but it’s necessary to build a product-centric view of risk by knowing what materials and components are sourced and from where and the risks at those locations, and be able to roll all of this up to the product level.

And finally, if the last two years have taught us anything, it’s that the majority of risk for most companies lies beyond their tier 1 suppliers and could just as easily be a logistics network risk. It’s easy to say, map your multi-tier supply chain, but any company who’s tried this knows that it’s hard or in some cases impossible to do this. So I’m going to end with a little bit of good news and that is that it is becoming possible and it’s becoming easier every day through big data and artificial intelligence and how companies are starting to leverage that to see into their sub-tier supply base.

So with that, I’d like to hand it over to Joe, who is genuinely one of a small handful of people who have become experts in managing supply chain risk long before the COVID pandemic broke. So with that, over to you Joe.

Joe Robinson:

Thanks very much, David. So I’ll start off with a brief introduction on Medtronic and who we are. If we can go to the next slide, we’ll kick that off. So it really all begins with the Medtronic mission. The Medtronic mission compels us to alleviate pain, restore health, and extend life. This is our enduring north star that not only inspires and guides us, but it really defines who we are and how we approach these types of risk issues within our supply chain. Can we go to the next slide? So we engineer medical technology that improve the lives of patients around the world because we truly believe technology can transform lives and we’re seeing it every day because this really is what matters most, transforming the lives of patients, and that’s the approach that we take as I’ll talk about when we think about our products and our value streams and how we make them more resilient. Next slide.

So for Medtronic, this gives a general perspective of the size and scale that we’re dealing with. So if you think about it, 19 distribution sites, 79 manufacturing sites, that translates to a significant number of suppliers and sub-tier suppliers that really could be counted as exponential as you think of the growth that exists underneath that, which we’ll talk about more, but we operate around the world with all of our products. Next slide.

So I’m going to talk about product business continuity and how we really focus on our value streams to make them more resilient. Next slide. So our model really focuses first and foremost on how do we prioritize what’s most important. We can’t cover everything in the same way because the resources required to ensure that we’re successful would just be too significant, so we prioritize our products, make sure we have a critical list, and then do the deeper dive associated with those specific products.

So when we talk about prioritization, we look at three different areas. First and foremost, we evaluate patient criticality. So is this a product that is life saving or life sustaining, and are there alternatives in the marketplace or are we a sole supplier? We also look at the strategic impact, so recognizing what’s the market growth potential or can we reach more patients long term with this particular product? And the operational impact, so how does this impact our commitments that we’ve made to our customers? How does this impact our ability to forecast and meet expectations that have been set? Next slide.

So first, we really, once we have that list of critical products identified, we map the entire value stream, and this is everything from order entry all the way to the delivery to that patient, so recognizing what exists within our supply base, looking at our own manufacturing sites, verifying where the products are sterilized because they’re medically sterile products. What’s our distribution channel? What are the key markets for that product and how do we ensure we have an understanding of all of those different nodes that exist? Because visibility then leads to optionality later on. Next slide.

So once we have the visibility of where everything is and what is most important, we perform a risk assessment, so recognizing the risk that exists within our supply base, again, at our own manufacturing sites or elsewhere. By being able to understand the risk at each location, we can then determine what the appropriate mix is that we need to establish for investment into resilience efforts, because the greatest risk might exist in our supply base instead of our manufacturing site. Or if it’s in a hurricane zone for our manufacturing location, we may invest in hardening that facility or establishing backup power options, things along those lines, but it gives us that understanding of wherever the greatest risk is so we can make those decisions. Next slide.

So doing a little bit of a deeper dive on the supply risk model. As we think about the products that we make, we look at all third parties that go into this, so everything from raw materials to components to critical services and sterilization as I mentioned before. We map those critical supply bases. So all of the critical products, we look at the supply base and we map with a goal down to tier three, so we take the bill of material and map that back to our suppliers. We identify the risk that exists within the supply base.

You heard David talking about it’s not just doing a risk assessment based on the supplier and their financial stability, their performance, et cetera. It’s also looking at the location risk data, or taking it a step further, not just like the natural hazards or the political instability that exists for that supplier, but where are components manufactured? How old is the tooling that exists for those particular components? If that tooling is obsolete, does that create unnecessary risk that we should go after and make sure that we’re aware of and investing in? And then also responding to incidents, so being able to monitor the different locations that exist and identify where those impacts are so that we can quickly respond and action those impacts. Next slide.

So here’s the first case study. This is an actual Medtronic product that we went through and we mapped the value stream and we mapped those sub-tier suppliers. So if you think about it, working our way backwards from the arrows, we have one Medtronic product. We manufacture it at one location that’s specific to Medtronic, and we have direct relationships with 29 tier 1 suppliers. As we went back and did the work associated with mapping the sub-tier, we found that based on those tier one suppliers and the material that they provided, they actually purchased that material from 212 different suppliers. Taking it a step further back to tier three, there’s 1,766 tier three suppliers that support those tier two suppliers. And then again, as I said, exponentially, you look at tier four. Now we have 13,876 different suppliers that make up that supply base where we only have that direct relationship with 29.

So as you can see, just in terms of our ability to manage the number of suppliers, the risks or issues that could impact our supply are vast. So I’m going to have you click once Lesley and it’ll build on this slide. So when a disruption occurs at tier four, number one, how do you monitor across 13,876 different suppliers at that tier four level? You can’t man that. It has to be done with data, it has to be done with analytics and it has to be automated so that we get the right information associated with that type of disruption. But then what you can expect is about 30 days of inventory within tiers, so it’s going to take about four months to really gain that visibility of an impact. So going from tier four, tier three, tier two, finally to tier one where you receive that notification, it could be up to four months that have occurred between that disruption and when you’re finally realizing it.

So what could you do with that window is the main point, and that’s what we’re trying to discover. And an example that I would use is everyone knows around the semiconductor supply today. It’s severely constrained and lead times for ordering within the semiconductor space have grown in a significant way. So where we used to be able to order 90 days out, we’re now having to deal with more than a year of placing those orders in advance and making sure that we have that locked in.

So Medtronic doesn’t typically have direct relationships with semiconductor manufacturers, but gaining that understanding and visibility allowed us to take steps to work with our direct suppliers and understand where those semiconductors were coming from, and then set up dialogue directly with the semiconductor manufacturers. So they understood that Medtronic is a medical device manufacturer, we have patients that are relying on us for the products that we provide, and giving them that perspective then helped to prioritize their focus on supplying to our suppliers. So it’s that type of visibility that gives us the ability to take action. And again, it’s about creating options, and if you don’t understand the supply base or the sub-tiers that exist, you can’t think through what options or actions you might want to take when the disruption occurs.

And next slide. So again, this is the final slide I think that I have. It’s around taking that final step. So not only do we build business continuity plans for our own manufacturing sites, which looks at the local operation, but now for each of these critical products, we document resilient strategies. So we take that full value stream and we recognize where we’re most vulnerable and make the investments in that area so that we’re ensuring that we’re shored up as much as possible and that we’re resilient, and whether that means building finished goods inventory or investing in our risk reduction in our supply base, those are the types of trade offs and choices we can make now that we understand the risk that exists and have that full visibility of where we can have the most impact. Next slide. I think that’s all that I have. It’s just a thank you and questions.

Lesley Hume:

Correct. All right, so we’re moving on to… Thank you so much, Joe. That was extremely informative, and as well, David, for giving us an overview of the value that Everstream provides to customers. So I think we’re going to open it up now for questions and let’s see if we’ve got any. So what I would suggest is if you again open up the chat at the top right or in the go to webinar toolbox and you can submit your questions.

It looks like we’ve got one already, so if I can ask the presenters to turn your cameras back on. So Joe, I think this one looks like it’s for you. How did you get to know that your tier 4 was 13,000 plus suppliers and you’ve identified the material identification behind those?

Joe Robinson:

And so that’s a great question. And again, I would say it’s impossible to do through brute force manual effort. And so I may take the first part of this question, but I’d probably pass it to David as well because we did partner with Everstream to do that mapping and to gain that visibility within our supply base. David, maybe if I could pass that question over to you in terms of the approach that Everstream takes in gaining that visibility.

David Shillingford:

Yeah, sure. So as Joe says, the sort of traditional approach of trying to do this through surveying tier 1 suppliers has been proven for all sorts of different reasons to be either challenging or impossible. So the approach that we’ve taken over the last few years is to aggregate billions and billions of supply chain transactions, and that might be a shipment record, it might be import export, and also to source what we think of as industry reference data, so that’s databases of what manufacturers are where and what they make. And we are then combining all of that and using graph technology, entity resolution technology to boil billions of transactions down into millions of suppliers as discrete entities, whether it’s a company or whether it’s a part of a company ,and the facilities and the relationships between those companies and the relationships between those facilities from a product-centric view.

So it’s critical to understand the flow of materials and components from one facility and from one company to another, and by doing that, we can then marry it with the data that Medtronic already has to build out or at least start to build out the view of their multi-tier supply chain. I don’t want to pretend that this is a hundred percent or perfect or even easy on day one, but I can say that it’s the only way to solve this problem, and we’ve made a ton of progress and every day it gets better. Beauty of AI with human help is that it’s always learning, always gets better, building out the graph, learning more, discovering and uncovering more unknown suppliers and unknown risks.

Lesley Hume:

Thank you, David. We have another question from the audience. Which type of risk domains do you monitor on your tier 1 suppliers and how do you, for example, measure financial stability? So perhaps that’s two questions. Starting with you, Joe.

Joe Robinson:

Yeah. So we definitely do a full risk assessment that’s across the board, so looking at operational risks, so what’s performance? How’s their quality? All of those typical things that you would expect to see, but then in addition to that, we look at natural hazard risk based on their location. We look at political instability. We look at even some of the more ESG-centric risks like water scarcity in the locations that they’re manufacturing. We look at a broad spectrum of operational-type risks like that.

And then of course, financial stability is an important factor. We look at our partnerships that we have with other third parties that provide that data, ratings and things like that, but that’s not always the best indicators of what’s happening today versus what’s happened in the past. So we do try to take a more strategic approach with our suppliers of looking to those that we have direct relationships with and understanding their ability to continue to deliver, whether it’s looking at their exposure to one particular customer of theirs, so if one customer makes up 60% of their supply base, obviously they’re pretty well concentrated within that particular customer. So it’s things like that that we’re trying to balance and gain additional visibility to, and also recognizing their ability to receive supply, because if they can’t and they can’t deliver on their commitments, that’s obviously going to drive additional financial instability for those suppliers.

Lesley Hume:

Great. Thanks Joe. We have another question. Or actually David, did you have anything you wanted to add to that?

David Shillingford:

No, I think Joe covered that extremely well as I’d expect.

Lesley Hume:

All right, good. So here’s the next question. Is Everstream giving a possibility to find end-tier suppliers for customers? And if yes, what’s the accuracy or percentage of found suppliers? David?

David Shillingford:

Yeah, that’s a great question, and I would say that the answer to the last bit varies enormously from industry to industry and company to company. There are some industries that share data less or where data is essentially less public than others. Aerospace defense would be an obvious example. Whereas there are others that have their own reasons or for compliance reasons, there’s more transparency. Food and beverage would be an example of that. So there’s an industry side to it.

In terms of the first part of the question, yes. We essentially score our confidence that a discovered supplier has the relationships within our clients’ network that the graph says it is. It would be misleading for the graph to be binary in terms of this is a tier three supplier or this is not a tier three supplier, and so we use alternate data sets to score our confidence level as to whether or not a tier two, tier three, tier four supplier is in the network or not. And what our clients are doing with that is to say, well, if something happens, as Joe said, you’ve got weeks, months lead time essentially, but if something happens at a tier three, tier four and we’ve scored it at 50%, that’s the time to get in and work out whether it really is or is not, and you’ve got time to do that, but you don’t want to be waiting until that ripple hits your tier one.

Joe Robinson:

Can I add something to that, Lesley?

Lesley Hume:

Yes, by all means.

Joe Robinson:

From my perspective, there is no silver bullet. Anyone that’s looking for a silver bullet in mapping their sub-tier supply base, it just doesn’t exist. We’ve focused for such a significant amount of time on discovering what’s the best way to achieve this, and what I would say is we really need to, as an industry, recognize where we’re going to gain the most visibility in the fastest way possible, and then continue to drive that iteration and improvement over time. Because there’s a maturity scale that’s going to come from this that I definitely am recognizing will take investment from a Medtronic and an Everstream to continue to drive. But I’d say it’s about partnership, identifying what the right fit of a partner is and growing that maturity together to be able to reach that sub-tier and gain more confidence in the accuracy that exists within that sub-tier supply base.

Lesley Hume:

Exactly. So I know we’re almost at the bottom of the hour, but I’d like to fit this last question in. So the question reads, with the emphasis on direct materials, aka on the product or bill of materials, how should we look at consumables that support a particular product, where their lack of availability may directly or indirectly impact resilience? David?

Joe Robinson:

Great question. Oh, sorry.

Lesley Hume:

Or Joe? I was going to say [inaudible 00:27:30]

David Shillingford:

[inaudible 00:27:30].

Lesley Hume:

Go ahead.

Joe Robinson:

Yeah, no, I definitely have thought about this one a lot. So the way that Medtronic approaches it is we think about those different products that support a site manufacturing process. We build those into our business continuity plan at the site level, but we still have third parties that make up the supply, whether it’s a gas, whether it’s some type of material that goes into the manufacturing process, a consumable as it says here. It’s really important to gain that visibility as well and then identify what your suppliers are within that field and look at it from more of a material, a gas perspective and map that back as a critical need for your supply base.

So again, if we’re talking about semiconductor manufacturing, well, in Russia and Ukraine, there’s a neon supply that makes up a significant percentage coming from that region. So having that understanding again gives you that insight of how do we take the steps necessary to be able to manage that? Again, there’s no silver bullet, but the more visibility you have, the more understanding you have and the more you can elevate those insights, the better chance you’ll be able to make an appropriate decision when the time comes.

Lesley Hume:

Exactly. David, did you want to add anything?

David Shillingford:

Just to say, I think that the question emphasizes the importance of taking a big data and AI approach to multi-tier mapping, because very often you don’t even know what questions to ask, to start off with, and the graph will show you these interdependencies, some of them that are sort of multi-tier and look extremely indirect. But if Coca-Cola suddenly starts moving back to glass bottles as they have, that’s going to have an impact on industries that have nothing to do with food and beverage on the face of it, but have huge dependencies on glass, and medical devices would be an example of that.

Lesley Hume:

Right. So I said that was the last question, but I think we have one more. We want to just jump in because this is obviously something that people have lots of questions about. So the question reads one more if we can, in practical terms, what does your team do in case an incident or a risk is identified at the sub-tier level? Joe?

Joe Robinson:

I’d say number one is ask questions. So if you have a sub-tier that’s disrupted and you have a relationship only with your supplier, start asking them questions around, are you aware of this disruption? Maybe we would ask if we can buy some additional inventory to make up a potential gap. Maybe we would ask if we can have a direct conversation with the sub-tier supplier to understand whether or not their impact is going to be long term. So I think there’s, again, it’s just options. It gives you that ability to say, do I need to do something? And if yes, what would it look like? And I gave the example of the semiconductor manufacturer where we went directly to the semiconductor manufacturer to say, are you aware that you’re supplying Medtronic and that we are creating these life saving, life sustaining products? And they said, Oh no, we’re not. Okay, well, given that you now know that, what does that mean? Can we leverage that opportunity to gain understanding and support our overall supply?

Lesley Hume:

Okay. Well, I think we have a few more questions if you don’t mind. I think folks are probably hanging out for a few more minutes. Again, very relevant subjects so I’m going to throw in one more, and then if we don’t get to all the questions today, we can certainly put them in the material that we distribute to folks after the webinar is over. So here’s the last question. Do you have plans to tie your operational data for planning and operational procurement, manufacturing and logistics, in the future to orchestrate the continual synchronization of these risk insights. Joe?

Joe Robinson:

So yes. Again, if you have that much visibility, you’re going to create a significant amount of noise. So the more we can connect our systems and automate some of the considerations that we’re trying to make, then the better off we’re going to be long term to take the noise out of the system and start getting to the more impactful decisions that will really help Medtronic and others to keep their supply base going. So simple answer, yes, of course. The more we can connect, the better off I think we’re going to be.

Lesley Hume:

David, did you have anything to add?

David Shillingford:

Well, it’s actually a, it’s a great question, and it feels very sort of futuristic I think for a lot of companies. But in terms of the so what about that question for today, you’re either on that path or you’re not on that path, and you are only on that path if you are applying a big data and data science approach to the problem, because without that, you cannot be dynamic. You cannot have a dynamic view of multi-tier suppliers. You can’t have a dynamic view of risk and to make that predicted where wherever possible.

And without that, you’ll never have the data and the insights that you can share internally and externally for partners to trust that what you say is actionable, but if you can get to that point and you can integrate with the right platforms, the right type of insights and build trust in those insights, it’s a magical thing. We’ve seen that starting to happen and it is transformational for supply chains. It is just an enormous competitive advantage for the companies that are on that path.

Joe Robinson:

I’ll give a very practical example. If you think about hurricane season, imagine if you preloaded your expectation in terms of your own finished goods inventory to increase during hurricane season so that you have a bit more buffer, or to send that additional demand to your supply base that’s in that region that says during hurricane season we want, instead of 30 days, we want six weeks or eight weeks or whatever the target is. Imagine that that happens automatically based on your risk information coming in and building that buffer to manage that risk. It’d be pretty nice.

Lesley Hume:

Sounds like nirvana.

David Shillingford:

[inaudible 00:35:09].

Lesley Hume:

All right. Right. So listen, this has been really truly insightful. Thank you so much Joe for sharing the Medtronic story and insights. David, as usual, thank you for giving your perspective. I want to thank everybody that joined us today, and as I mentioned, if we didn’t get to your question, I apologize, but we certainly will send those responses out with the webinar follow-up material. So with that, I wish you all a great day and thanks for joining us.

David Shillingford:

Fantastic.

Joe Robinson:

Thank you very much.

David Shillingford:

Thank you Joe. Thanks Lesley.

Lesley Hume:

Cheers.