Setting the Grounds for the Transition from Business Analytics to Artificial Intelligence in Solving Supply Chain Risk

Abstract

As supply chains (SCs) become more complex globally, businesses are looking for efficient business analytics (BA), business intelligence (BI), and artificial intelligence (AI) tools for managing supply-chain risk. The tools and methodologies proposed by the supply-chain risk management (SCRM) literature are mostly based on experts’ judgments, their knowledge, and past data. The expert evaluation-based approach could be partly or fully replaced by AI solutions, increasing objectivity, impartiality, and impersonality, reducing sources of human mistakes, biases, and inefficiencies in SCRM. However, the transition from BA to AI in SCRM is not a self-contained process; though attractive as a vision, it is not straightforward as a management or implementation process. The purpose of this research is to explore and define the conceptual grounds for transitioning from BA to AI in SCRM. The conceptual SCRM structure, its AI suitability, and implementation terms are defined theoretically based on a literature review. A single, in-depth business case study is employed to explore the theoretically defined terms of AI-based SCRM implementation. The proposed conceptual AI-suitable SCRM structure is defined by five principal building blocks: risk events, risk-event indicators, data-processing rules and algorithms, analytical techniques, and risk event probability forecasts. The study concludes that the business environment meets AI-based SCRM-implementation terms of data existence and access. Since data on risk events and negative outcomes are limited for machine learning, experts’ experience and knowledge might be utilised to build initial rules and data-processing algorithms for AI.

1. Introduction

The issue of sustainable supply chains to reduce risk is permanently on the business agenda. To gain a cost advantage or to expand market share, many firms try to make supply chains more resilient by constantly improving supply chain risk management by employing various methods and models. Managing supply chain risks with sophisticated methods uses a variety of applications, starting with essential supply tracking and finishing with sustainability issues, including hybrid meta-heuristic algorithms for a supply chain network considering different carbon emissions regulations [1], following multi-objective optimisation modelling of the sustainable green supply chain, and decisions about sustainable closed-loop supply chain networks. Reduced risk in the supply chain has a positive effect on a firm’s finances and improves the use of resources, which brings the firm closer to sustainability development goals.

The business issues related to supply-chain risk (SCR) identification, assessment, and management are becoming more complex and dynamic due to firms’ attempts to be more efficient and competitive, followed by the wide adoption of global sourcing, global partnership and networking, and global supply-chain (SC) integration [2,3]. These strategies, in turn, constantly increase SC risks [4]. As stated by Trkman et al. [5], “In the modern world competition is no longer between organisations, but among supply chains”. Supply-chain risk management (SCRM) has consequently become a prerequisite to sustainable business development, ensuring a competitive benefit and enhancing organisational efficiency. Scientific discussion [5] and national and supranational policy trends [6,7,8,9] emphasise the need for advancements in SCRM theory and practice based on contemporary analytical techniques employing AI and big data (BD) analytics. However, these advancements are not self-starting and require conceptually reasoned, empirically proven grounds. Based on interview data, even large commercial enterprises struggle to manage SCR, as managers face challenges in understanding the impacts of various internal and external factors on certain risks. They strive to judge and interpret the available evidence on the possibility of loss and how to take discrete actions to manage risk [10].

The SCRM literature encourages the application of experts’ experience-based judgments, their knowledge, and past data. These solutions are motivated by the assumption that SCRs are difficult and complicated to manage due to the lack of relevant data to identify and assess risks by estimating objective risk indicators [11]. The common outcome of such SCRM tools is rated preferences, which are used to support SC decision-making.

Earlier proposed SCRM conceptualisations are not appropriate due to the need to engage experts (which requires time to implement) to focus on whole SCs instead of certain nodes and edges in SC networks. They are insufficient for AI applications since they follow the assumption that experts’ knowledge and experience, not objective data-based indicators, are the main data source for SCR identification and assessment. Current computational, data-linking, data-collection, and data-processing capabilities united by AI solutions could improve and enrich SCRM at the levels of both everyday business practice and scientific SCRM research.

Experts’ experience and knowledge are good to apply to research and scientific studies but difficult to generalise and complicated to access and apply in everyday business life and practice. The practical implications of previously proposed SCRM methodologies are limited to studied cases and constrained in time, “The SCR debate in academic literature is rather limited to a case- and location-specific studies” [12]. Fan and Stevenson [13] also found a dominance of case study and survey methods in SCRM research and limited use of secondary data. This article proposes a generalised conceptualisation of AI-based SRCM to promote objective data-driven SCRM solutions, which will not be context or certain case specific.

AI solutions and applications do not occur in a vacuum [14,15,16,17]. Normally, they are developed by extending and expanding conventional business analytics (BA) and business intelligence (BI) practices. The practical relevance and motivation of this research are to explore current SCRM practices to learn how theoretically defined terms for AI-based SCRM are met in contemporary business. In other words, from a conceptual point of view, the research question is: what are the conceptual structure and implementation terms of AI-based SCRM? Objective secondary data and data sources related conditions will be defined as terms for AI-based SCRM implementation.

Such a conceptualisation would help in achieving missing integrations of technical and managerial systems [18]. The attempts to enrich business functions with AI are problematic since business relationships (including sales and purchases) do not always follow patterns discoverable by data analytics. New developments and recent changes in business environments could dramatically alter expected trajectories based on past data analytics. Thus, the conceptualisation of AI-based SCRM is a field worth researching. The proposed conceptual SCRM structure and the exploration of its implementation terms contribute to the SCRM field by defining the conceptual grounds for BA-to-AI transformation in SCRM. SCRM is a process of risk identification, assessment (or evaluation), reaction (or decision-making), and monitoring [11,13]. The present study focuses on the identification stage and does not cover assessment, decision-making, or monitoring.

The purpose of this research is to explore and define the conceptual grounds for the evolution from BA to AI in SCRM. The specific objectives are the following: (1) to define a conceptual SCRM structure (and its implementation terms) suitable for AI-based SCR identification; (2) to explore AI-based SCRM implementation terms in a selected company’s case; (3) to define the conceptual grounds for AI in SCRM based on the conceptual SCRM structure and empirically explored terms of its implementation.

The conceptual AI-suitable SCRM structure is defined by five principal building blocks: (1) defined risk events, (2) defined risk event indicators, (3) data-processing rules and algorithms, (4) analytical techniques, and (5) risk event probability forecasts. The existence of and access to the data on indicators relevant to SCR identification are considered the principal terms for AI-based SCRM implementation. The empirical research supports the conceptual proposition that these terms for AI-based SCRM implementation are met by the business environment. It means that empirical research supports the proposition that the data needed for SCR identification exist and are accessible for business.

The empirical evidence to support the findings is gained by employing a single, in-depth business case study.

This case study research reveals that, in SCR identification, business practitioners know and use objective, secondary, data-based indicators that are available and accessible from sources either inside or outside the organisation. This research proposes that abundant secondary data exist which could be structured and utilised for automated, AI-based SCR identification.

The research findings that support the conceptual propositions are presented in the form of a conceptual matrix linking risks covered by SCRM and factor indicators (i.e., a risk/indicator matrix, henceforth referred to as R/I-m). Risks are defined as events or circumstances affecting the focal company by financial or other losses caused by engaged SC partners (buyers, carriers, or suppliers) and purchase or sales contract details. Risk events and indicators are two blocks in the conceptual SCRM structure that are explored empirically.

The R/I-m serves as a reservoir to mine data-processing rules and algorithms (i.e., to create and develop a third conceptual SCRM structural element) that associate dependent (risk events) and independent risk-prediction variables and play a twofold role in conceptualising AI-based SCRM. They could be discovered by AI itself while processing R/I-m, but they could also be explored and revealed by current BA practices. Conventional data-processing rules and algorithms would provide a current human experience-based economic and business management logic to be later refined and corrected by AI based on data. In this way, BA is expected to convert gradually into AI.

The following chapter of the paper defines the research context by reviewing the relevant literature on BA-to-AI transition and previous SCRM conceptualisations. The conceptual SCRM structure suitable for AI and the principal terms of its implementation are the outcomes of the literature review. The third chapter then outlines the research method. The fourth chapter presents the research results: the structured SCRs and their indicator lists that support the theoretical assumptions of the terms of AI-based SCRM implementation. The closing fifth chapter extends the discussion to further research and the potential and practical implications of the findings. The central role of the data-processing rules and algorithms is also defined here. Conclusions are given at the end of the paper.

2. Literature Review

The central research problem is the fact that to manage risk—that is, to mitigate it to prevent loss—complex analytical procedures must be performed. Managers, supported by functional business services, must identify risks and respective potential losses to assess the extent of risks and take measures to prevent expected losses. Problematically, however, all these required analytics could be done in varying ways, with an extensive selection of available tools and methods, including BA and BI (sometimes referred to as BA/I due to blurred conceptual boundaries) and AI tools.

2.1. The Foundation Gained from Experience in Business Analytics

Today’s data-driven business environment enables business executives to use layered, diverse data to support strategic and operational business decisions. However, processing large arrays of data inevitably raises the question of how to sort, systematise and analyse them, diminish labour, and speed up analysis. Thus, BA/I facilitates extracting and shaping data to interpret information and generate data-based action plans for the business. Although they are alternatives, BI, BA, and AI have different specifications and outcomes. When effectively interchanged, they can supplement each other and help achieve business goals effectively.

BA involves understanding business performance based on data and statistical methods and can be used to develop strategies, acknowledge sales and market opportunities, strengthen connections with the clientele, better indicate possible hazards, and reduce threats [19,20,21,22,23].

BI was mentioned in the scientific literature as early as 1950 [24,25,26] and was recently identified as a management technology trend [24] to rationalise the process of collecting, reporting and analysing data and presenting actionable information to executives [27]. Although human hypotheses are involved in analysing collected data, especially in the early stages of BA or BI, and management decisions apply individually developed practices, they are sometimes naive tools and solutions [17]. Such a situation was observed in the case company. Scientific research has also found evidence that organisations have largely failed to capture the full benefits of BI systems and seek ways to leverage value from other systems [10,28,29].

The essential idea of AI is learning [30] and constant improvement over time. It refers to computer systems capable of mimicking, learning, and replacing human intelligence [31], but the transition from BA/I to AI is not self-starting and requires conceptually reasoned, empirically proven grounds. Despite its long history and widespread acceptance as a decision-aid tool, AI has seen limited application in SCRM. The potential of AI to solve complex problems and search for SCRM information has not been fully exploited [31].

In the case of this research, SCRM is the subject to search for the grounds to facilitate BA/I-to-AI transitions. The conceptual structure of SCRM should be defined considering the two aforementioned BA/I and AI perspectives to reveal ways, patterns, or terms of the proposed transition from one kind of practice to the other. The revealed terms for transition should then be explored empirically to prove propositions about needed change in practice.

The conceptual structure of SCRM is defined based on a review of previous research in the field. Previous SCRM solutions in the scientific literature are often presented as methodologies for SCR identification and assessment, which suggests defining lists of objects (i.e., potential suppliers, manufacturers, distributors, certain risks and issues in SCs) that need evaluation in terms of SC risk. Then the range of the respective risk factors is set. Objects in SCs and events within or around SCs (depending on particular model specifications) are then evaluated “on the basis of experts’ experience and past data” [32] or “expert knowledge, historical data, and supply chain structure” by employing questionnaires to identify risk factors and their likelihoods [33] or through “brainstorming meetings with experts who have a complete and detailed knowledge of the considered system” [34]. Experts’ experience, knowledge, and past data-based evaluations of potential SC partners, predefined risks, and other SC issues are processed by selected multi-attribute (or multi-criteria) decision models (MADM or MCDM) employing the analytical hierarchy process (AHP) [34,35,36], goal programming [32], and bow-tie analyses and diagrams, which map risks and display the links between potential causes, evaluated probabilities, preventative and mitigative controls and potential impacts, calculating total risk likelihoods and impact values [33]. Quite often, the technique in order of preference by similarity to the ideal solution (TOPSIS) and criteria importance through inter-criteria correlation (CRITIC) methods are employed to deal with experts’ assessments [37]. The outcomes of such SCR identification and assessment methodologies are decision-preference indices based on the least overall SC risk. Risk identification, assessment, and evaluation are made based on experts’ judgments.

Another common conventional business analytics-based SCRM scenario is a fuzzy inference system (FIS), which also considers all SC agents. Failure modes and effects analysis (FMEA) also calculates total aggregated SC risk [33,38]. Close to the FIS is fuzzy synthetic evaluation, which is based on qualitative linguistics and expresses and defines fuzzy variables in mathematical logic [39,40]. Fuzzy numbers are used to quantify and estimate risks when adequate data to measure risk factors are difficult or impossible to acquire [33].

Value at risk (VaR) in the SC operations reference model (SCOR) was calculated by Li et al. (2013) as “the probability of events times the monetary impact of the events for a specific process, supplier, product or customer”. The risk matrix approach (RMA) also considers two essential metrics, probability and severity [4]. However, these methodologies and proposed modifications are based on the scoring, rating, and evaluating of potential risks and their factors from experts’ experiences, knowledge, and points of view. The dominant SCRM conceptualisations are mostly based on the notion that “since the precise ex-ante estimation of the probability and severity of an event is challenging, the concept of subjective judgment should be introduced” [35].

2.2. The Limitations of Business Analytics-Based Supply Chain Risk Management and Research on the Ways to Overcome Them

The above-defined SCRM analytical outcomes deliver SCR assessments for predefined SCs. Calculated preference indices assess overall SC risk. However, current business dynamics require rapid changes and adaptations in SCs. New partners enter SCs while others leave them every day. SCs are even more dynamic in the merchandise business, where quick decisions following markets’ conditions are common in everyday practice. Applicability of MADMs and similar BA practices are limited due to the need to engage experts (which requires time to implement) to focus on whole SCs. Fuzzy numbers applied to estimate risk factors and respective event probabilities become less relevant when companies easily access data and data-processing capabilities. Expert evaluation-based AHP and similar approaches could be replaced by AI solutions, which will be able to deliver instant online assessments for every potential SC partner. MCDM approaches based on pairwise comparisons have other limitations as well: the need to assign precise numbers to long lists of items is challenging even for experienced experts, different experts provide different evaluations, and a predefined assessment scale (usually 1–9) imposes prior limits on estimations [35].

The next step towards objective data, not subjective evaluation-driven risk identification and assessment, is applying statistical, mathematical modelling to calculate the expected probabilities of predefined risk events, such as binary logistic regression [41], Bayesian network (BN) probability models [11,42], ripple effect assessment in multi-stage SCs modelled with the integrated Discrete-Time Markov Chain and Dynamic Bayesian Network (DBN) [43], and a system dynamics framework [44,45]. BN model parameters (i.e., probability tables) should still be specified by industry experts and managers, so most BN models are still subjective, especially in the development phase. These models employ objectively measurable predictors, such as supplier deliverable storage capacity, production capacity, transportation capacity, order level, re-order interval, lot size [41], demand, order quantity, order-fulfilment rate, production rate, inventory, product, transportation cost, cost per truck, truck capacity, price, safety stock, etc. [45].

The system dynamics modelling approaches require that “projected or anticipated values for initial probability, initial cost and initial time (delay) were provided to activate the system” [44]. Again, these parameters are set by experts sharing their knowledge, experience, and respective insights. Objective indicators-based models still are rare in the literature. The essential problem that limits the wider application of objective data and mathematical–statistical modelling is a lack of quantitative data and records of bad events and negative business impacts: “Database of disruptions from different sources are not maintained so supply chain risk data is non-existent. Now we are talking about big data but their usability is a question mark, and finding appropriate sources of data is a complex task” [11].

The empirical analysis of general data analytics capabilities in the context of SC resilience [46] indicated that improved information processing capacity has a positive impact on SC resilience by reducing the ripple effects of negative or disruptive events. SC resilience is one of the interrelated research fields which investigates SC properties and opportunities to recover after disruption [46], i.e., after an event with negative consequences. Such findings support the proposition of our research, that data analysis instead of expert-based risk evaluation could be a relevant way to manage the risk that emerges in SCs. The conceptual structure of AI-based SCRM would be useful to extend information processing capabilities that are considered to have a significant role in improving SC resilience [46,47,48].

Our study finds its place within the research field, covering conceptualisations of the data-driven decision support SCRM systems. The digital supply chain twin model [49], proposed to be developed for constant mapping of disruption risk in supply networks and ensuring visibility; vary SC resilience angles, covering SC viability achieved by enhanced integrity of intertwined supply networks [50]; the agent-based simulation study of resilience strategies in blockchain-coordinated SCs [51] that revealed how cooperation and deeper SCs integration could reduce the risk and increase resilience as well as confirmed relationships among trust and transparency development through blockchain technology in humanitarian SCs [52], are few current conceptual outcomes that support relevance and suitability of our study in the state-of-the-art context. AI-enabled SCRM would be another relevant option for businesses in managing risk and increasing SCs resilience.

The present study extends the data-driven decision support SCRM systems research field by paying particular attention to the role of AI, which is often mentioned as central in the current and future SCRM systems. Through the aim of the research is to conceptualise the grounds of the AI that would allow transition from BA to AI in SCRM, the empirical study takes a practical perspective and looks at the problem through the eyes of a business that meets dynamic and constantly changing SCs, where blockchain coordination, deeper integration and smart contracts still are in a future perspective, where day to day risk management has higher priority compared to complex concepts of resilience and disruption.

2.3. The Place for Artificial Intelligence-Based Approach in the Field of Supply Chain Risk Management Research

The current study attempts to expand the idea of objective data- and risk indicator-driven SCRM to encourage faster development of AI-based SCRM systems and solutions. The question of data existence and availability is explored deeper by empirical, qualitative research and is reported later in this paper. Figure 1 summarises the differences between the dominant and AI-based SCRM solutions producing the research gap and respective questions. The figure indicates that the conceptual SCRM structure and the terms of its implementation should be explored and defined to set the grounds for the shift from the dominant approach to an AI-based SCRM one.

The aforementioned analytical approaches, terms, and concepts in the SCRM field include but are not limited to SCRM itself [53,54,55,56,57,58,59,60,61,62], supplier risk [42,63], supplier financial disruption risk [64], supply disruption risk [65,66,67], supply quality risk [68], geographical supply risk [69], supply-chain relational risk [70,71], risk in buyer–supplier relationships [72], procurement risk management [73,74], and demand and supply risk [75]. Commonly, SCR is associated with external factors and respective events that occur outside the focal organisation, most often caused by suppliers, that is, SC partners. An obvious principal element of the conceptual SCRM structure is the predefined risk or certain risk of events that should be identified, assessed, and then managed.

“Risk” is defined as the “probability of [predefined] events that [might] result in loss” [57]. In other words, “risk is to be seen as the occurrence of an event, or the occurrence of a combination of events having impacts on at least one of the company’s objectives, its overall value, or its reputation” [34]. Risk management requires that events causing negative consequences should be known and predefined, while the concept of SC disruption looks from a more generalised perspective, covering both natural disasters and man-made disasters [46,49].

The calculated probability of events that might result in losses changes the decision-making context from “decisions under uncertainty” to “decisions under risk” [57]. Thus, SCRM is defined as “the extent of information availability about randomly changing supply-chain parameters” [57]. This means that such an approach to SCRM covers only SCRs (certain events), which might be predicted based on a known, predefined set of predictors, that is, indicators. This simple definition is the background of another element in the conceptual SCRM structure: defined risk event indicators (Figure 2). SCRM is possible only based on collected data about all SC elements, including the characteristics of present and potential SC partner companies, contract details, actions and partner interactions along the SC, and even pre- and post-contracting communication with partners.

The focal company, which is intended to identify, assess, and manage SCR, must define a set of risk control points (CPs) where data on risk-predicting indicators is collected [76]. Actually, all nodes (“which fulfil different functionalities such as production, storage, and distribution” [77]) and edges (which transfer physical, informational, and financial flows between nodes [77]) in SC networks could be treated as risk CPs. The set of relevant SCR CPs could be managed as an integrated risk control system (RCS) [2]. RCS engineering builds on relationships with persons or software agents [2] at each defined CP. The RCS ensures constant data updates. The SCR CPs include companies participating in SCs (network nodes) and certain actions (network edges) of those participants throughout SCs. The former are treated as static SCR data CPs (SCPs), the latter as dynamic SCR data CPs (DCPs). The transition from BA/I to AI would enable covering a larger number of CPs and respective data. Particular attention is paid to the DCPs—SC network edges—where data relevant to SCR identification are constantly streaming (Figure 1).

The operational link between predefined risk events and the indicators to identify and assess them is built by data analytics, which covers data-processing rules and algorithms (Figure 2). These rules and algorithms are set as predefined critical values, thresholds, accepted differences between mean and trend values, etc. Conventionally in business, experience-based rules and algorithms are employed in risk identification and assessment. In this case, these rules are often problematically hidden in human minds and, therefore, tacit, implicit and thus difficult to observe, evaluate and correct [17].

The SCRM literature suggests that expected risks or certain data associated with risk events should be processed by experts based on their knowledge and experience. Mathematical modelling or AI could process the data based on statistics, mathematical data exploration and machine-learning outcomes. Data processing is set by a selected analytical technique responsible for SCRM (Figure 2) that is here treated as another element in the conceptual SCRM structure.

Risk event–probability forecasts are calculated by processing data associated with certain risk events. Calculated risk event probabilities identify risks (Figure 2).

Following these theoretical considerations, the five principal SCRM conceptual structure elements are (1) defined risk events, (2) defined risk event indicators sourced from SC network nodes and SCP and DCP edges, (3) data analytics, processing rules and algorithms, (4) analytical techniques, and (5) risk event forecasts and risk identification. These five structural SCRM elements are the conceptual background for transitioning from BA/I to AI in SCRM. Such a conceptualisation of the SCRM structure is suitable for AI since it defines dependent variables (risk events) and independent variables (risks’ events indicators), associates them with data-processing rules and algorithms, and anticipates data-processing-based outcomes. All these elements are principal in AI definitions [15,17]. The essential feature of AI—learning and constant improvement of risk prediction based on data from past prediction and forecasting—is ensured by the fourth structural element of AI-based SCRM, where appropriate technical AI tools should be installed, such as machine learning.

From a practical–empirical point of view, the conceptual SCRM structure is suitable for AI-based SCR identification; in practice, it will be equipped with the data-driven risk indicators from available, accessible internal and external data sources. Thus, two principal terms for AI-based SCR identification are (1) associations of SCRs with risk-prediction indicators from available data sources and (2) the availability and accessibility of risk prediction–indicator data from internal and external data sources.

These AI-based SCRM implementation terms assume enough data in the business environment, including internal and external data sources, for SCR identification. Another assumption is that the data sources of the indicators needed for SCR identification are well-known and easy to access inside or outside the focal organisation. The qualitative in-depth case research explores the extensiveness of data-based SCR indicators practically used in business. The empirical exploration-based proof that AI-based SCRM implementation terms are met in the business environment extends the grounds for transition to AI-based SCRM.

The final conceptual assumption is that data-processing rules and algorithms are the core of the SCRM structure and that the transition from BA/I to AI should be organised around them. Currently, unstructured, often tacit rules and algorithms should be made explicit to set initial risk-assessment models. The discussion at the end of the paper integrates the theoretical and empirical findings.

3. Research Method

The empirical study was done to prove the aforementioned conceptual grounds for AI development and implementation terms in companies or certain business ecosystems to increase SCRM efficiency. The first two structural elements—risk event definitions and associated indicators—are the main research targets of the empirical study because “AI in its essence is not about programming, debugging, software patching… [but] more about defining models, engineering variables, tweaking parameters, updating and refining models” [17]. Applied approaches to analytical techniques, methods of risk-event forecasting, and data-processing rules and algorithms are not covered by this study. Structured lists of SCRs, associated indicators, and the conceptual summary of available data sources would lay meaningful backgrounds for further research and practical implications.

The choice of qualitative empirical research is motivated by the intention to immerse ourselves into SCRM as experienced by representatives of different business functions to cover SCRM from various perspectives. The objectives of the empirical research are following:

• To explore the extensiveness of indicators relevant to SCR identification;
• To sum up the data sources of indicators for static (pre-contract) and dynamic (contract-related) risk identification.

The extensiveness, availability of, and access to SCR-relevant indicator data are conceptual terms for incorporating AI into SCRM. Since this research is exploratory and qualitative, these terms are not measured quantitatively. The available data sources are also structured according to risk types and data sources defined as static and dynamic risk CPs.

The current SCRM literature does not provide full clarity on identifying SCRs by mathematical statistical modelling with data-driven indicators of risk factors. The explicitness of risk events and their prediction indicators were considered essential terms of AI-based SCRM implementation. Therefore, we conducted a case study [78] to learn from one situational context in a company and its abilities in the transition from BA to AI in SCRM.

This research thus adopted a qualitative approach and used a single, in-depth case study as the exploratory research design. Interviews are the main data-collection method in a qualitative case study, which is an appropriate method to explore a complex phenomenon in detail [78] and reveal relevant information [79] to extrapolate conceptual generalisations. Case study-based evidence is then applied to enhance and extend SCRM conceptualisation [80]. The single, in-depth case study method is considered appropriate to explore theoretically defined terms without the aim to compare different practices and to search for similarities and/or differences [79,81]. The research “highlights a construct by showing its operation in an ongoing social context”, as the classic case study approach defines [81].

The case study approach was appropriate to catch not only conventional risk events and associated indicators but also those on the minds of business representatives still not considered practical due to limited analytical capabilities or other reasons. These risk events and data-utilisation opportunities should be addressed by our proposed transition from conventional BA/I to advanced, innovative AI solutions in SCRM.

Several criteria guided the selection of the target case company to study. The firm (referred to as the “Holding Company” for confidentiality) has extensive experience in a range of industries and markets. The Holding Company specialises in the supply and distribution of commodities and raw materials, one of the most diversified commodity and raw material-distribution groups in Eastern Europe. Its activities are grouped into several business segments: biofuel, agro, textile, food, energy, package, industry, services, and plastic materials.

The main headquarters of the company are in Lithuania; the company also has offices in Latvia, Estonia, Denmark, Poland, Russia, Ukraine, Belarus, Hungary, Romania, the United Arab Emirates, and China. The company’s main trading markets are in Eastern Europe. The Holding Company’s business model is based on (1) representing suppliers in existing and new markets (the company works with more than 2000 suppliers) and (2) developing customer networks in search of new suppliers or partners (the company has more than 5000 customers). The Holding Company sells 4000 products and has trade relations in 70 countries.

The case company and research partners joined forces in February 2019 and developed a risk-identification, assessment, and management model to help companies identify and manage SCR using AI.

In research, we “identify and make analytical generalisations to the general case of which [our] study is an instance” [82], which provides context for the research. Rashid et al. [83], a step-by-step guide for business researchers (i.e., a checklist comprised of four phases, that is, the foundation phase, prefield phase, the field phase, and reporting phase), was followed for clarity, selection, and operationalisation of the qualitative case study.

The possible limitations of the case study research worth mentioning here are the following: single data collection method, while classical case study research anticipates that multiple methods, combining qualitative and quantitative ones [84], should be employed. The within-case analysis is done, but research lacks cross-case data, which would let to look “beyond initial impressions and see evidence thru multiple lenses” [84]. However, replication across cases is not required to reach the aim of this research. This research fits the theory-elaboration, not theory-generation type case study [85], which means that the general theoretical approach is developed based on a literature review and then put into a particular empirical context to elaborate on the new and currently relevant direction. Another limitation of the empirical research worth considering is the lack of a pilot study before the main interview. The interview guide was developed by researchers and used to collect the data without a formal test of the data collection instrument.

Seven semi-structured interviews were done with representatives of business support functions at the Holding Company to critically examine SCRM in a large commercial firm operating in many industries and to understand how it explores SCR factors to identify SCRs. Semi-structured, open-ended questions allow respondents to freely express their views and provide more room to explore factors of interest by allowing authors to probe for clarifications for more in-depth answers [86].

The interviewees were not constrained by giving them a conceptual framework, predefined risk or indicator categories, or any other ideas. To ensure data validity, all the interviews were conducted by two interviewers.

Table 1. Characteristics of interviewees.

Code	Department, Position	Experience in a Managerial Position	Role in the Company	Interview Date and Duration
A	Finance (2 representatives)	15 years of experience in the financial field, 8 years of experience in the financial field	Head of financial services group, credit control specialist	31 May 2019, 3 h
B	Accounting	25 years of experience in the accounting field	Head of accounting services group	13 June 2019, 2 h
C	Logistics	14 years of experience in the transport industry	Head of transport services group	19 June 2019, 2 h
D	Legal	16 years of experience in the legal field	Head of legal services group	12 June 2019, 2 h
E	Prevention and vindication	4 years of experience in the prevention and vindication field	Head of prevention and vindication department	3 June 2019, 3 h
F	IT	17 years of experience in the IT field	Head of IT services group	9 July 2019, 2 h
G	CEO	6 years of experience in CEO position	CEO	10 July 2019, 3 h

provides data about the interviewed managers. All the interviews were recorded and fully transcribed. The questions were formulated to achieve the objectives of the study.

The data were analysed using directional content analysis, an effective process of classification, coding, and categorising [87]. MaxQDA 18 software was used to qualitatively analyse the interview transcriptions.

The following steps were taken:

• SCR coding. Great variations in how managers described SCR, what specific activities they included in SCRM and how they emphasised each practice became clear in the first transcript reading. Various risk patterns emerged that could indicate different types of risk indicators in the empirical data. To arrive at common themes in the interview data, a two-cycle coding process was followed [88].
  • The authors worked separately and developed the categories and sub-categories of SCRs that emerged from the interview transcripts.
  • After the proposed risk categories and sub-categories were sketched out by each researcher individually, we began to develop unified risk categories.
• SCR indicators coding. The next step was to find the indicators used to identify each risk. Using the risk categories as a framework, we coded sections of transcripts that mentioned known data and risk-identification indicators. The authors also compared their independently developed holistic codes and established agreement on all of them.
• SCR-indicator association and grouping by data sources. The last step was to understand risk-management practices and identify data sources of indicators of static (pre-contract) and dynamic (contract-related) SCRs.

A total of 1535 segments were coded in the interview transcripts. All codes were assigned to SCRs and data-source categories: supplier risks events—6 codes emerged from the 115 coded segments (from 6 documents); buyer risks events—7 codes emerged from the 247 coded segments (from 6 documents); carrier risks events—5 codes emerged from the 65 coded segments (from 4 documents); contract risks arising inside the company—10 codes emerged from the 329 coded segments (from 7 documents); supply-chain risk indicators—64 codes emerged from the 779 coded segments (from 7 documents).

The data were checked for reliability and validity to ensure the quality of the results. In principle, this study can be repeated to generate similar results. The data collection was carefully documented, the interviews were highly structured, and all the data were collected into a qualitative database. Internally, all the researchers were involved in coding and data analysis (Yin, 2009).

The research outcomes discussed further in the paper, due to the exploratory character of the qualitative research design [79,80,88], should illuminate the form and content of the theoretically defined grounds of BA/I-to-AI transition in SCRM.

4. Results: SCRs, Their Identification Indicators, and Data Sources

The interviewed representatives of the case company’s functional departments shared their experiences in SCRM from both upstream (supply) and downstream (sales and distribution) perspectives. The qualitative research revealed SCRs (i.e., expected events with harmful consequences for the business), respective risk-identification indicators (risk predictors), and risk control points in worldwide SCs as data sources.

Figure 3 overviews the interview data codes that define SCRs. Sums of coded segments and data sources are indicated respectively to the number of segments found in different interviews.

To reveal SCRs defined as certain events with potentially negative consequences to the business, we structured coded primary data around main SC participants as main CPs where SCRs emerged: (1) suppliers, (2) buyers, (3) carriers, and (4) commerce managers (focal company representatives) managing purchases and sales contracts.

The primary research data on the indicators used by the managers and business function representatives to predict risks were structured around the main data sources: (1) companies participating in SCs (suppliers, buyers and carriers); (2) public (e.g., State Tax Inspectorates or State Social Insurance Funds) or private (e.g., credit risk insurers, commercial banks, publicly available street views image data, global positioning system tracking data, etc.) third-party institutions authorised to collect and manage certain data about companies (i.e., SC participants) in certain states; (3) third-party analysts, who assess economic or business performance in particular states or sectors, evaluate commercial risks in these environments, monitor market prices, etc. (indicators of this third category could also be filled by the company’s internal analysts’ data); and (4) functional and/or commercial departments of the focal company itself providing details on ongoing and/or intended commercial contracts. Figure 4 gives detailed lists of data codes associated with the SCRs and their identification indicators.

The fifth category of SCR indicators (coded 2.5. in Figure 4) is worth attention. It represents individuals’ subjective evaluations of SC elements based on expertise, experience, and knowledge. Though interview data analysis supports the conceptual proposition that, in practice, SCRs are associated with objectively measured, available, accessible data and thus meet the conceptual terms of AI-based SCRM implementation, it must be acknowledged that experts’ knowledge-based subjective assessments to identify SCRs are common, not just as the data source for SCRM scientific research (as discussed above), but also in everyday SCRM. It would be unreasonable to disregard experts’ experience and knowledge as a data source. However, applying this kind of data would be different; experts would be asked not to evaluate risk but to provide knowledge-based assessments for risk-prediction models along with other objectively measured indicators.

If SCRM is based on BA/I practices, indicators in the fifth category remain hidden and implicit with unknown forms of interpretation and application but are nevertheless applied in SCRM. These indicators cover subjectively evaluating reputations of supplying, carrying, and buying companies and market risk, trust level, etc. They are not based on exact, structured, objective variables. During the transition phase from BA/I to AI in SCRM, these indicators could be valuable to tune prediction models and assist machine learning, but they would then be structured and integrated into formal risk-prediction models over time.

The revealed list of internally and externally sourced data indicators associated with certain SCRs confirms that the first theoretically defined term for implementation of AI-based SCRM is met in a business environment

Risk events and associated indicators covered by the aforementioned categories (Figure 4) comprise the R/I-m, which serves as a background to develop SCR-identification models and the overall AI framework. This matrix is a central element of the general conceptual SCRM structure (Figure 2), which was defined based on the SCRM literature review. Another term for implementing AI-based SCRM assumes the availability and accessibility of data from internal and external data sources to fill the R/I-m. To confirm empirically this condition is met in the business environment, we make a data-based summary of data sources of indicators for static (pre-contract) and dynamic (contract-related) risk identification (Figure 5).

To structure revealed risks and their identification indicators by their data sources, upstream (i.e., supply, buying side), and downstream (i.e., demand, selling side) SC perspectives [3] are broken down by already-defined SCPs, which occur and must be employed for SCR assessment before commercial contracts are signed, and DCPs, which emerge after signing commercial contracts when SC activities begin. Signing contracts multiplies SCPs by adding DCPs, so risk assessment leaves the static and enters the dynamic phase. Data from SCPs (Figure 5) describing SC-participating subjects and their activities should be collected and entered into the R/I-m to evaluate current or potential participants and the risks related to them. Data sourced from DCPs start to stream into the R/I-m when certain commercial contracts start. AI tools are needed to cope with this greater number of indicators and amount of data because humans cannot process them.

Figure 5 depicts attitudes towards SCs and points out where SCRs occur and where they could be identified and assessed by processing data available at certain CPs. The second term for implementation of AI-based SCRM, which follows the conceptual SCRM structure, is also thus empirically confirmed as met in the business environment. The revealed lists of static and dynamic risk CPs associated with certain SCRs as risk-identification data sources serve as empirical evidence that confirms the second theoretically defined term for AI-based SCRM applications.

The SC is observed from the perspective of the focal company, which is engaged in commercial business and manages SCs of various products. Such SCs extend through several countries. Local, international, and overseas shippers are also among the main participants. Generally, the activity of a certain focal company covers only part of the SC: the upstream side when the company sources resources and materials to fulfil its own manufacturing business needs and the downstream side when it distributes manufactured products.

The conceptualisation of the SCRM data sources (Figure 5) is rather simplified, abstract, and stylised. Each category of participating subject (i.e., each major SCP) requires gathering data about all potential actors who may enter SCs managed by the focal company. Each DCP also requires exploitation to extract the contract-management data. Finally, each contract constitutes its own SC with particular participants and particular contract-management data from a mix of particular contract-related SCPs and DCPs. Thus, the R/I-m should be seen and treated as a multilayer database associating data-providing CPs, SCRs, and risk-prediction indicators. In the same way, certain SCRs will be measured for particular SC partners and respective ongoing buying or selling contracts.

5. Discussion and Implications: Do the Established Grounds Ensure an Instant Transition?

In the following chapter, the generalised theoretical implications of the conceptual SCRM system are integrated with the “contextual idiosyncrasy” [85] by discussing the above-presented results of empirical research. Such integration or duality of generalised theory and empirical context is considered a common outcome of case study research. It means that all the following considerations are contextual; they are relevant in the scope of the researched context (even if this is not mentioned repeatedly in the coming paragraphs). Here, we elaborate the general SCRM concept, as defined above in the literature review, to the context of AI-based SCRM.

AI, among other generalised interpretations, is defined as “the science and engineering domain concerned with the theory and practice of developing systems that exhibit the characteristics we associate with intelligence in human behaviour” [89]. From this perspective, the principal idea of this study could be controversial; the study searches for grounds to expand AI to avoid decisions made by humans (due to inefficiency in terms of time, cost, data-processing capabilities, possible mistakes, and potential biases), while AI itself aims “to exhibit characteristics of human intelligence”. Notably, then, exhibiting characteristics associated with human intelligence should not be perceived as an attempt to replicate the outcomes or processes of human behaviour. On the contrary, while evaluation and judgement characteristics should remain, efficiency is expected to improve. Making actions and decisions more logical is the most expected positive effect [90]. It should also increase objectivity, impartiality, and impersonality by reducing common human mistakes, biases, and inefficiencies in SCRM.

AI in SCRM links SCRs and their indicators. Conventionally in business practice, this position is occupied by BA/I: data-processing rules and algorithms made by individuals that are consequently subjective, intuitive, and difficult to integrate, creating difficulties in tracking the efficiency of risk assessment, correcting mistakes, etc. A decision-maker may construct his or her decision-making behaviour to constrain the opportunity for new information to alter initial perceptions and choices [91]. Even the same set of data or ratios might be interpreted differently by different employees at the same company, which affects decision-making and enables intuitive conclusions and, therefore, human mistakes.

Such analytics in SCRM could be defined as “tasks … performed in an ‘artisanal’ fashion, with high labour intensiveness and low speed of completion” [17]. BA/I practice can support separate reactive decisions but is not sufficient for advanced predictions and proactive insights. Managers react to risk events (e.g., delayed payments, disrupted shipments, supply quality issues, etc.) based on periodic checks for SC issues in spreadsheet data, but they cannot proactively make and adapt SCRM decisions based on constant predictive risk identification.

The transition from conventional BA/I to AI—or as Davenport [17] would say, from “Analytics 1.0” to “Analytics 3.0 or 4.0”—requires “companies to transform their business models and culture with extensive use of analytics”. AI solutions would convert companies’ SCRM analytics from descriptive (dominated by structured, historical data in spreadsheets, reviews, categorisation, classification, ratings, human-made periodical, and repetitive reviews of data) to predictive (e.g., real-time identification of suspicious transactions saved from risky SC contracts and loss) and even prescriptive analytics [14]. Currently, companies are mostly engaged in descriptive analytics, so this is an appropriate starting point.

This study proposes that the BA/I-to-AI transition in SCRM is possible if SCRM is structured around predefined risk events, objectively measured data-driven risk indicators linked to available, accessible data sources, and data-processing rules and algorithms based on either expert knowledge and experience or models discovered by AI machine learning. The empirically explored terms of AI-based SCRM implementation were proved to be met in the business environment as long as SCR-identification indicators and data sources are known and used by practitioners in the business. The conceptual SCRM structure suitable for AI and the proof that it meets the terms of AI-based SCRM implementation lay solid groundwork for the BA/I-to-AI transition in SCRM.

Does this mean, however, that the proposed conceptual grounds ensure the transition can be instantaneous? Risk identification is based on the “availability of [considered events’] probability distributions” [57]. Applied AI-based SCRM solutions are expected to uncover probabilities (i.e., statistical probability distributions) of events based on observed factors associated with predefined indicators. Since the number of events with undesirable consequences is small compared to the number of events with desired ones, the availability of unwanted-event probability distributions is often an issue in risk management. AI-based SCRM developers should also expect difficulties in building prediction models due to limited unwanted-event statistics. The data for predictors (independent indicators) are available, but unwanted-event statistics will often be limited.

AI machines are expected to be able to explore the R/I-m data to develop empirically reasoned (i.e., data-based) coefficients of risk-indicator associations defined in mathematical models. However, experience-based knowledge is also relevant and required to build certain risk assessment models and make them work. The data-processing rules used by humans to identify SCRs include critical values of predicting indicators, rules to treat the indicators according to specified values or predefined threshold levels, predefined values of nominal indicators (e.g., allowed payment verification documents), tolerated levels of financial ratios, warning of risk in the case of sudden changes in the number of employees, etc. In some cases, these rules are based on and associated with other relevant indicators in the system. Due to the limited availability of risk-event statistics and constraints on mathematical–statistical modelling, BA/I rules should be considered in developing prediction models to later be corrected by AI constantly learning from accumulated data on prediction accuracy and risk events. The initial rules, procedures, and data-processing algorithms developed by humans will gradually be replaced by ones discovered by AI for examining past data, detecting patterns or relationships, and associating risk events and their predictors. Data mining, pattern recognition, forecasting, and predictive modelling are the most common techniques for this [14].

The transition from BA/I to AI in SCRM is thus not a revolution but rather an evolution: elevating existing practice to greater potential in terms of calculation power, coverage of prediction indicators, responsiveness to changing conditions, etc. The BA/I-to-AI transition in SCRM will not be instantaneous, however. It will require time to develop. Experience must accumulate [14,17] to perform better-informed classifications, categorisations (of partners and contracts), and predictions that cross boundaries of known event samples, extend the analysis, and cover all possible risks in all event–partner–contract combinations. The transition from BA/I to AI in SCRM will happen when indicators processing rules and algorithms are developed and maintained, not by humans, but by learning machines.

Figure 6 summarises the transition from BA/I to AI in SCRM based on the study outcomes on conceptual grounds. The changes in the approach to SCRM are highlighted according to the elements of the conceptual SCRM structure defined above (Figure 2). Considerably more details are presented for predefined risk events and risk event indicators since they were explored empirically.

AI analysts (e.g., Akerkar [14,15,16]; Davenprot [17]; Min [31]) point out that AI solutions often do not need to be developed (i.e., coded) from scratch. The set of SCRM-relevant indicators defined here will also require extensive use of other AI techniques. Automated street-view image recognition will require deep learning to process input data to characterise situations, for instance, such as deciding whether a shipment address indeed points to commercial premises. Statistical or semantic natural language processing will be required to process contracts, customer complaints, and commercial correspondence (in voice or text formats) to catch unfair or dishonest deals. The share of unstructured BD is growing in SCR analytics [14], and AI is the current solution to cope with and exploit it efficiently.

Since AI is not intended to revolutionise but rather evolutionise and improve SCRM, all its basic elements should remain and be used as initial building blocks. Thus, all of them should be considered essential prerequisites for BA/I transition to AI. In the same way, the relevance of this transition is proven. The BA/I approach is based state of all SCRM elements; issues occurring under BA/I approach and expected changes after the transition to AI are summarised in

Table 2. BA/I practice, issues, and expected changes after the transition to AI.

SCRM Elements	BA/I Practices	BA/I Issues	Change after the Transition to AI
1. Defined risk events	Risks are seen as specific to certain business functions, e.g., finances and accounting, law department, transportation	Function-wide risks concerns, e.g., finance managers not associating risk with shipment or product quality issues	Company/business ecosystem-wide estimations of SCR, partner companies and contract-respective risk definitions, extended range of monitored risk
2. Defined risk event indicators	Straightforward, evident, easy to access and process, e.g., financial ratios, contracts data, firms’ profiles	Many relevant data sources are not employed, e.g., GPS tracks, commercial correspondence, etc.	Optimised analytics, use of the same data for many different risk assessments, extended data sources, and a range of respective indicators
3. Data analytics, processing rules, and algorithms	Personally developed expertise and decision criteria	Bias in risk assessment due to human emotions, intuition, personal interests	Vast data and data processing, cutting-edge statistical methods, dynamic analysis that improves over time
4. Analytical techniques	Spreadsheets, manual checking for critical values, static data, past periods summaries, statistical analysis	Forecasts are mostly based on past data, limited data from ongoing processes, shortage of analysts	Optical character recognition in text documents processing, automated texts or images processing, automated machine learning, automated analysis
5. Risk event forecasts, risk assessments	Intuitive, often based on past periods data, human experience-based hypotheses	Events observed and analysed after they happened, limited data-mining capabilities	Forecasts based on machine-learned coefficients and weights of indicators assigned to risk events

. The comparison of BA/I and AI practices along with listed SCRM elements is done following Davenport [17], Andriole [90], Akerkar [14,15] and other authors. Table 2 provides a summary of the practical implications of proposed conceptual grounds for the transition from BA/I to AI in SCRM.

SCRM supporting AI decisions should be seen as integrating already existing BA/I solutions. Companies should also care more about gathering data for machines to learn. Negative risk events should be observed and registered over time to associate them with predicting indicators, thus creating training databases. “The ability to ‘bootstrap’ rich and unique training data can create more of a competitive advantage in AI than mastery of AI technology” [17]. Appropriate, relevant rule-based systems from conventional BA/I practices will be transferred to AI. Though rule-based systems are outdated BA/I techniques from the 1980s [17], they are still relevant in the transition from BA/I to AI. Human-proposed knowledge- and expertise-based rule systems (in terms of coefficients, critical values, tolerated difference levels, thresholds, etc.) will likely be taken over by AI.

6. Conclusions

• Current business dynamics require rapid changes and quick adaptation in SCRM, which employs different BA/I tools and techniques. The problem is human interpretations being involved in decision-making. The decision maker may construct his or her decision-making behaviour to constrain the opportunity for new information to alter initial perceptions and choices. Even the same set of data or ratios might be interpreted differently by different employees at the same company, which affects the decision-making process and leaves room for intuitive conclusions and, therefore, human mistakes. Therefore, the introduction of AI to SCRM should improve the accuracy of risk identification and assessment. The transition from BA/I to AI in SCRM is not a self-starting process, however, so this article has developed a particular SCRM structure that lays the conceptual groundwork for this transition, the implementation terms of which it empirically explores.
• This article has identified five elements of a conceptual SCRM structure: (1) defined risk events, (2) defined risk event indicators, (3) data-processing rules and algorithms, (4) analytical techniques, and (5) risk-event forecasts and risk identification. SCRM built on these five elements would be suitable for AI-based solutions since it would define dependent variables (risk events) and independent variables (risk-event indicators), associate them with data-processing rules and algorithms and anticipate data processing-based outcomes. Two principal terms for AI-based SCR identification to explore empirically are (1) associations of SCRs with risk-prediction indicators from available data sources and (2) the availability and accessibility of these data.
• An empirical qualitative case study was conducted to explore the terms for AI-based SCRM implementation. Two structural elements—risk-event and associated risk-identification indicators—were the main research targets. SCR events, as dependent outcome variables, and their indicators, as independent predictors, are the basic elements most required to engineer relationships among variables, build prediction models, train them and kickstart AI in SCRM. Based on the selected case study outcomes, both terms for AI-based SCRM implementation are empirically proved as met in the business environment.
• Though lists of risk events and prediction indicators are context-specific, the case data suggest that SCR events could be clustered around main SC partners (suppliers, carriers, and buyers) along with the focal company itself; while SCR identification indicators could be associated with the main data sources (i.e., partnering companies, legal, public and private third parties, external market or business analysts and business data from internal sources in the focal company). The background from which SCR-identification and assessment models emerge is the data matrix associating risk events and their prediction indicators.
• AI should develop around data-processing rules, procedures, or calculation algorithms used to process indicators’ attempts to predict risk events. Initially, data-processing rules, procedures, or calculation algorithms suggested by humans are currently engaged in SC management; they will be tested, refined, and corrected by AI employing machine learning, deep learning, and other relevant AI techniques. Working AI in SCRM cannot be developed instantly, however.
• This study has proposed that the predefined risk events, objectively measured, data-driven risk indicators linked to available, accessible data sources, and data-processing rules and algorithms set based on either business practitioner knowledge and experience or models discovered by AI machine learning are the principal grounds for transitioning from BA to AI in managing supply-chain risks.