Risk management essential for strengthening global chip supply chain

Semiconductors are commonly described as the brains of modern electronics. For example, in modern vehicles, there might be over 3,000 chips that enable telematics, infotainment, and other features. Similarly, household appliances, like refrigerators, microwaves, and washing machines, increasingly rely upon chips to power their ‘smart’ features.

Amidst a global chip shortage, many industries have been impacted by the lack of access to the supply of chips they need, and issues related to the semiconductor supply chain have been brought to the forefront. Supply chain risk management practices are instrumental and needed more than ever to mitigate the impacts of these concerns.

The chip shortage has a number of causes. The primarily cited reason is the COVID-19 pandemic, which caused a sudden increase in demand for laptops and other devices to facilitate the shift to work-from-home. However, even before the pandemic, there was a trend toward the Internet of Things, as well as increasing adoption of electric vehicles, driving up demand for semiconductors. Meanwhile, as demand continued to rise, supply chain issues like the winter storm in Texas that brought down the power grid and a fire in a Japanese chip facility have disrupted supply.

More supply needed

The war in Ukraine further complicated the supply problem, as Ukraine produces between 45%-54% of the world’s neon gas used in semiconductor production. As a result of these issues, US Secretary of Commerce Gina Raimondo noted that the median inventory of chips has fallen from 40 days in 2019 to less than 5 days in 2022. Companies report 12-month lead times or more to get the electronic components they need.

Source: Adobe Images

To alleviate these lead times, more supply is needed. However it costs billions of dollars to construct a new semiconductor fabrication facility (or fab). The trend for many years was to offshore the manufacturing to locations with reduced labor costs, largely in Asia. This has resulted in an industry where firms are hyperspecialized – so-called “fabless” firms specialize in the design of the chips, and contract their manufacturing to third-party foundries that specialize in the technologically sophisticated manufacturing processes, while other companies specialize in the assembly and testing steps. This all results in a complex global ecosystem, with many points of failure.

Geopolitically, one of those potential points of failure is Taiwan. Taiwan accounts for almost two-thirds of global chip manufacturing capacity, with the firm TSMC capturing a 54% share of the global semiconductor manufacturing market – by far the market leader (South Korea’s Samsung is in second place with 18% market share). With concerns mounting that China may attempt to invade Taiwan, it is worth thinking about what impacts that might have on the global semiconductor supply chain.

Harvesting semis

Imagine the failure of the energy grid, which increasingly relies upon digital technologies. What would life look like for an extended period without power and without a reliable supply of replacement chips? In a world where there are already shortages, a scenario in which a foreign nation like China cuts off exports could be catastrophic. As an example of what this could look like, US sanctions and export controls on Russia have resulted in Russians resorting to harvesting semiconductors from dishwashers and refrigerators to use in their military equipment.

Another concern is the trustworthiness of the components. Recent reports, for instance, claim that equipment installed on cell towers throughout the United States, manufactured by the Chinese telecommunications company Huawei, have the ability to disrupt US nuclear arsenal communications. As another example, a hardware attack impacting almost 30 companies, dubbed the “big hack”, involved the covert insertion of a tiny chip on a motherboard at a Chinese manufacturing facility that created a stealth doorway allowing unauthorized access to the networks of the tampered systems.

A further concern is the increase in counterfeit components. As supply shrinks and demand increases, this opens the door for counterfeit components to flood the market. One source of counterfeit electronics is electronic waste (or e-waste) that comes from discarded items containing chips. Around 70% of e-waste ends up being dumped in China, where informal recycling operations have popped up to harvest potentially valuable electronic components and materials. These parts are then often repackaged or relabeled and make their way back into the supply chain, having been found in applications such as US military aircraft. Further, it is expensive to remove and replace counterfeits once they are identified – an order of 100,000 counterfeit capacitors (at one cent each), totaling $1,000, could cost millions of dollars to fix.

With the CHIPS Act recently passed by Congress, providing $52-billion in incentives to build manufacturing facilities and a 25% tax credit, it will still take time for these new facilities to be built and begin operating. In the meantime, there are a several tools available that supply chain professionals can use to manage their supply chain risks.

Hardware & software assurance

Importantly, companies do not need to start from scratch – there are a number of international standards that can be leveraged to assist with risk management. For example, ISO 31000 provides general enterprise risk management guidance, applicable across any industry sector, whereas certain industries have more specific guidance, such as ISO/SAE 21434, which addresses vehicle cybersecurity. Related to counterfeit electronics, there is, for example, SAE AS6171, which provides guidance on testing methods to use for suspect counterfeit electronics. Another standard, SAE JA7496, provides guidance on cyber-physical systems security across the entire systems engineering lifecycle. The committee responsible for this standard’s development is currently working on additional guidance specific for hardware assurance and software assurance. Furthermore, industry groups such as GSA TIES are working on developing secure and trusted frameworks for the IoT value chain, leveraging tools for supply chain traceability and data analytics.

While some indications point to the global chip shortage beginning to ease, there are still plenty of issues with the global supply chain, including persistent inflation, long backlogs at container ports, and disruptions of goods out of China due to its strict zero-COVID policy.

Supply chain risk management practices such as onshoring (or ‘friendshoring’) production, strategically sourcing from a diversified pool of vendors, consolidating procurement functions, selecting the right level of buffer inventory, and enhancing supply chain visibility, are all proposed levers that can be pulled. Additionally, companies need to develop models for stress testing their supply chain under various scenarios so they can understand how shocks will impact performance.

Conclusion

Finally, organizations need to develop supply chain resilience, or the ability to withstand and bounce back from disruptions. According to one study, there are 16 different supply chain capabilities, such as flexibility, adaptability, anticipation, and recovery, that contribute to supply chain resilience.

At the end of the day, the chip supply chain is critical for the functioning of the global economy. Adopting good supply chain risk management practices can help to reduce the impacts of disruptions and enhance security for consumers – ensuring our safety and protecting our way of life.

———-

Zachary A. Collier, Ph.D., is assistant professor of management at Radford University, and is a visiting scholar at the Center for Hardware and Embedded Systems Security and Trust (CHEST).