Proactively and reactively managing risks through sales & operations planning

Purpose – Risks can easily disrupt the demand–supply match targeted by sales and operations planning (S&OP). As surprisingly little is known of how organizations identify, assess, treat and monitor risks through tactical planning processes, this paper zooms in on the S&OP set-up and process parameters to explore how risks are managed through S&OP. Design/methodology/approach – A multiple case study analyzes the S&OP processes of seven organizations in the process industry, drawing on 17 in-depth interviews with high-ranking representatives, internal and external documents, and a group meeting with participating organizations. Findings – The study finds that organizations proactively design their S&OP based on their main risk focus stemming from the planning environment. In turn, such designs proactively support organizations’ risk identification, assessment, treatment andmonitoring through their S&OP execution. Reactively, a crisis S&OP meeting –making use of the structure of S&OP – can be used as a risk-treatment tool, and S&OP design can be temporarily adapted to deal with emerging risks. Originality/value – This study is among the first to empirically elucidate risk management through S&OP. S&OP design, execution and adaption are identified as three interconnected strategies that allow organizations to manage risks. The design enables risk management activities in the monthly execution of S&OP. The reactive role of S&OP in risk management is particularly novel.


Introduction
Sales and operations planning (S&OP) is commonly used by large organizations to address one of the most fundamental issues in supply chain (SC) management: matching demand and supply (Ho et al., 2015;Grimson and Pyke, 2007). Yet given the dynamics and volatility of businesses, it seems likely that risks stemming from the environment, SC and organizations themselves (J€ uttner et al., 2003;Thom e et al., 2012) offset the aim of S&OP to generate a balanced plan (Riley et al., 2016). Examples of such risks include extreme weather conditions, supply delays, demand surges/declines and legislative changes, i.e. events impacting supply or demand. Accordingly, previous conceptual work has suggested that risk management (risk identification, assessment, treatment and monitoring; Fan and Stevenson, 2018) through S&OP is equally important as financial alignment (Noroozi and Wikner, 2017). Furthermore, management-oriented S&OP maturity models advocate using scenarios as a risk-treatment tool within S&OP (Wagner et al., 2014). Academic studies have only mentioned the relevance of risk management in the design and execution of S&OP (e.g. Kjellsdotter Ivert et al., 2015a, b;Noroozi and Wikner, 2017). Beyond the advocated importance of risk management in S&OP (Noroozi and Wikner, 2017), there are still no detailed insights into how organizations manage risks through S&OP. Given the necessity to consider risks in matching demand and supply, this is surprising (Kristensen and Jonsson, 2018). Therefore, this study aims to systematically explore how organizations manage risks through S&OP.
Drawing on an in-depth case study of seven organizations in the process industry, this study makes the following contributions. First, extending the contingency view of Kjellsdotter Ivert et al. (2015a), we show that organizations design their S&OP considering risks in their planning environment related to demand, material supply and capacity supply. Consequently, to manage risks through S&OP, most organizations cannot use the normatively proposed structure in the handbook for S&OP (hereafter termed the S&OP blueprint) advocated in most of the managerial literature (e.g. Wagner et al., 2014). Second, this study shows that such specific design of S&OP enables identifying risks beyond the main risk focus. At the same time, risk treatment is core to S&OP activities balancing demand with capacity supply, material supply with capacity supply, or optimizing capacity supply. These new, fine-grained insights extend understanding of how organizations manage risks through S&OP execution in different planning environments (Kristensen and Jonsson, 2018). Third, we contribute to better understanding the under-researched S&OP set-up parameter "planning levels" (Lapide, 2012). This study shows that hierarchical planning levels not only help to manage risks through S&OP execution but also provide decision-making power on employing risk-treatment options. Last, this study demonstrates a reactive role for S&OP, contradicting the predominantly suggested proactive role of S&OP in risk management (Stahl, 2010;Wagner et al., 2014). Reactively, S&OP provides established structures and communication lines to treat risks in a crisis S&OP meeting, enabling fast and efficient decision making once a risk has materialized. Additionally, risks can also be managed by temporarily adapting the S&OP design.

Theoretical background
Sales and operations planning S&OP was introduced in the 1980s as a business process aiming to balance supply and demand in the tactical planning horizon (Ling and Goddard, 1988). Today, it is associated with improved service provision, lower inventory levels and higher profitability (Thom e et al., 2014;Hulth en et al., 2016). Scientific and management-oriented literature on S&OP focuses on various subjects, including conceptual frameworks (Thom e et al., 2012;Tuomikangas and Kaipia, 2014), performance effects (Thom e et al., 2014;Hulth en et al., 2016), horizontal and vertical alignment (Olhager et al., 2001;Oliva and Watson, 2011), the design and implementation of S&OP (Kjellsdotter Ivert et al., 2015a, b;Kristensen and Jonsson, 2018;Wallace and Stahl, 2008), and overcoming silo thinking through cross-functional planning and execution (Swaim et al., 2016).
Following the conceptualization of Kjellsdotter Ivert et al. (2015a), the S&OP process is designed and executed based on set-up and process parameters. Table 1 defines the underlying dimensions and the typical S&OP blueprint configurations of both parameter types. An organization's S&OP can be considered mature if it strongly complies with the standard blueprint (Grimson and Pyke, 2007;Wagner et al., 2014;Danese et al., 2018).
The set-up parameters comprise the planning object in terms of the aggregation level of planning, the planning frequency of the S&OP cycle, and the planning horizon, i.e. the timeframe considered (Grimson and Pyke, 2007;Kjellsdotter Ivert et al., 2015a). Managementoriented work also considers multiple organizational levels of S&OP as a set-up parameter (Lapide, 2012), where S&OP execution is conducted either locally and globally or at the business group and enterprise levels (Lapide, 2012). As such, the planning levels do not refer Managing risks through S&OP to operational, tactical and strategic planning but solely to S&OP execution at different hierarchical levels in large organizations (Kristensen and Jonsson, 2018). The three process parameters are S&OP inputs, activities and outcome. The inputs comprise functional plans, constraints (e.g. production capacity), and goals (e.g. reducing inventory levels or improving service levels). While some scholars argue that forecast generation is an S&OP activity (Grimson and Pyke, 2007;Kjellsdotter Ivert et al., 2015a), this paper defines it as an S&OP input because forecasts are usually generated in functional plans. S&OP activities generally comprise four S&OP process steps, starting with a demand review to achieve a consensus-based, unconstrained demand forecast. This is followed by a supply review to provide a basic capacity plan (Tuomikangas and Kaipia, 2014;Kjellsdotter Ivert et al., 2015a;Wagner et al., 2014). The pre-S&OP then reconciles both plans and provides a first integral plan, which is finally approved in the executive S&OP meeting (Wallace and Stahl, 2008). As such, the outcome is an integrated, cross-functional plan aiming to match demand and supply (Oliva and Watson, 2011). Accordingly, cross-functional plans contain decisions concerning inventory levels and location, production plans, sourcing, promotional activities (Sodhi and Tang, 2010;Tuomikangas and Kaipia, 2014).
While some prior research suggests a blueprint for S&OP (e.g. Grimson and Pyke, 2007;Wallace and Stahl, 2008; see Table 1), empirical studies (e.g. Kristensen and Jonsson, 2018) show that S&OP parameters are shaped by the product-, demand-, and supply-related factors of the planning environment (Kjellsdotter Ivert et al., 2015a). In particular, Kjellsdotter Ivert et al. (2015a) find that companies customize the planning horizon, frequency, object and activities depending on contingencies related to internal (e.g. product complexity, production network complexity), supply (e.g. uncertainty), demand (e.g. product portfolio stability, service levels) and environmental factors (e.g. industry characteristics). It is suggested that such context-specific S&OP design might help to manage specific externalities and risks so as to maintain supply-demand balance (Kristensen and Jonsson, 2018 The interval between two consecutive S&OP cycles Wallace and Stahl (2008) Granularity is monthly Wallace and Stahl (2008) Planning horizon The amount of time a plan spans into the future Olhager and Johansson (2012) Typically 3-18 months, but up to 36 months Wallace and Stahl (2008) Planning levels Tactical planning at multiple organizational levels Lapide (2012 high S&OP maturity, additional risks beyond such contingency factors are usually managed during the monthly process execution through scenario and SC risk management, involving customers in collaborative S&OP to manage new product introductions (Kaipia et al., 2017) or in time-condensed, short-cycle "mini S&OP" in response to demand disruptions (Wallace and Stahl, 2008). Given the aim of S&OP to match demand and supply, risk management through S&OP likely focuses on risks impacting demand and supply. Yet detailed understanding of the implications of S&OP design choices and risk management through monthly execution of the S&OP remains lacking (Kristensen and Jonsson, 2018).
Supply chain risk management through S&OP Risk management permeates all functions and levels of an organization and might even extend to suppliers and/or customers (Friday et al., 2018). As such, it should naturally be part of S&OP. The aim of risk management is to reduce the possible performance impacts of risks before a risk manifestsi.e. proactivelyand/or once a risk has materializedi.e. reactively (Wagner and Bode, 2008). This study defines SC risks as events that potentially impede the ability to fulfill demand, resulting in negative consequences for the focal firm (adapted from Wagner and Bode, 2006). SC risk management is typically divided into four activities: risk identification, assessment, treatment and monitoring (Fan and Stevenson, 2018;Ho et al., 2015;Kern et al., 2012).
Risk identification is the structured determination of different types of potential SC risk sources (J€ uttner et al., 2003;Kern et al., 2012). Three main risk sources can be distinguished within S&OP: (1) internal risks, such as machine failures or IT breakdowns, that impact supply; (2) supply network risks, such as defaulting suppliers or demand surges, that impact demand and/or supply; and (3) environmental risks, such as earthquakes or political instability, that also impact demand and/or supply (J€ uttner et al., 2003). Any of these risk sources can lead to imbalance in the S&OP plan (e.g. Tuomikangas and Kaipia, 2014;Kjellsdotter et al., 2015b), so they need to be identified. Regardless of the risk source, the nature of a risk can be highly divergent: for instance, an earthquake destroying production capacity (environmental risk) and a defaulting supplier (supply network risk) have completely different implications for organizations in terms of the event's probability and impact (Wagner and Bode, 2006). Therefore, risk assessment determines the significance of the potential loss (impact) (Zsidisin et al., 2004) and the probability of manifestation (frequency) for all identified risks (Zsidisin et al., 2004). S&OP literature to date does not explicitly consider risk assessment, even though it helps to determine the right risk treatment (Norrman and Jansson, 2004;Kern et al., 2012), i.e. whether to accept, share, avoid, or mitigate a risk (Tomlin, 2006). Research indicates that low probability/low impact risks should be accepted, low probability/high impact risks should be shared or transferred (e.g. insured against), high probability/high impact risks should be avoided, and high probability/low impact risks should be mitigated (e.g. through redundant inventory or multiple sourcing) (Giunipero and Eltantawy, 2004;Fan and Stevenson, 2018;Scholten and Fynes, 2017). S&OP literature suggests performing scenario planning as a risktreatment tool (e.g. Singh and Lee, 2013;Tuomikangas and Kaipia, 2014) and presents specific measures to treat risks through S&OP, such as dynamic pricing or managing inventory, capacity resources and constraints (Thom e et al., 2012). Furthermore, the S&OP outcome includes decisions on stock levels and location, utilization of production capacity, production volumes and product mix (Tuomikangas and Kaipia, 2014), which are also acknowledged in risk management literature as important elements to mitigate or avoid risks (e.g. Tang, 2006;Giunipero and Eltantawy, 2004). Last, risk monitoring involves tracking identified and assessed SC risks over time, as the probability and potential impact of a risk might change (Fan and Stevenson, 2018). While S&OP literature does not explicitly mention monitoring, early warning signals are usually used to track performance (Cecere, 2005) or promptly spot imbalances in the plan (Wagner et al., 2014).

Managing risks through S&OP
At the same time, not all risks are foreseeable and can be managed proactively (Friday et al., 2018;Kochan and Nowicki, 2018). Some decisions taken in the S&OP, for example on inventory levels and capacity loading (Tuomikangas and Kaipia, 2014), overlap with what organizations do to reactively deal with risks as they occur such as having redundancy in inventory and/or capacity or enabling supply base and/or production flexibility (Wieland and Wallenburg, 2012;Ali and G€ olgeci, 2019;Tang, 2006). Hence, the ability to which risk can be managed reactively as they occur (Giunipero and Eltantawy, 2004;Wieland and Wallenburg, 2012) is partly determined by decisions taken in S&OP.

Conceptual summary
At its core, S&OP entails preparing for future demand and supply fluctuations (Thom e et al., 2012). Therefore, organizations design their S&OP to manage risks based on context-specific factors of the planning environment. Yet, beyond considerations of contingency factors in the design of S&OP and scenario planning (Noroozi and Wikner, 2017) and the use of the mini S&OP (Wallace and Stahl, 2008), little is known about risk management through S&OP execution. The insights on managing risks through S&OP are fragmented, mainly conceptual in nature, and mostly covered in practitioner literature (e.g. Singh and Lee, 2013;Schlegel and Murray, 2010). The potential for S&OP to reactively manage risks has received even less attention in the literature, which is surprising given the expertise in balancing supply and demand developed by S&OP participants. The above discussion suggests different areas to empirically investigate: the role of contingencies and specific risks in S&OP design, risk management during S&OP execution, and the capability to reactively manage risk through S&OP.

Methodology
To explore how risk can be managed through S&OP, we conduct a multiple case study to gather in-depth insights (Thom e et al., 2012;Tuomikangas and Kaipia, 2014). This allows us to explain the phenomenon more precisely within its natural setting (Yin, 2009). More specifically, we elaborate theory by identifying new relationships between risk management and S&OP design and execution. The S&OP process within organizations is the unit of analysis in this research.

Research setting and case selection
Following earlier research (Kjellsdotter Ivert and Jonsson, 2010;Kjellsdotter Ivert et al., 2015b) we use the process industry as an empirical base to study S&OP. The process industry is suitable for two main reasons: (1) the need to closely manage risks to ensure continuous production (Noroozi and Wikner, 2017); and (2) challenges associated with matching demand and supply, such as long and sequence-dependent changeover times and variability in the quality and quantity of raw materials (Van Donk, 2001). To focus on cases where S&OP is an established, routine and cross-functional process and incorporates scenario planning and SC risk management (i.e. level three or above in maturity), we approached large organizations that have been using the S&OP process for at least five years. An industry expert suggested suitable organizations.
Theoretical replication was used to select cases with differences in supply and demand factors, following the finding of Kjellsdotter Ivert et al. (2015a) that organizations design their S&OP process based on contextual factors of the planning environment. As such, we expected the different context-specific designs to lead to differences in managing risks through S&OP execution. Supply and demand factors for case selection were derived from the overall context in which an organization operates (i.e. industry type; B2B vs B2C). Striving IJPDLM 51,6 to include at least three organizations with a demand focus and three with a supply focus, eleven organizations were approached, of which eight agreed to participate. One organization was subsequently excluded after data collection as its S&OP maturity was found to be below level three in the ex post assessment. Table 2 overviews the selected cases.

Data collection
Data were collected during April and May 2016 through 17 on-site, face-to-face, semistructured interviews in Western Europe, lasting 77 min on average. In each organization, we discussed with a senior contact which employees would be most suitable to provide in-depth insights relevant to the research question. All informants were experienced tactical or strategical planners with substantial S&OP involvement and experience. The interview protocol (see Online Supplement) was based on prior studies of S&OP and SC risks by Sodhi andTang (2010) andKjellsdotter Ivert et al. (2015a). It was pre-tested with an S&OP practitioner to warrant that the information obtained from interviews would address the main research question.
All interviews were conducted by two researchers, recorded and transcribed verbatim within 48 h. The 293 pages of transcriptions were officially approved by the interviewees to ensure the reliability of obtained information (Yin, 2009). After conducting the interviews, email exchanges were used to resolve unclear interview data. Additionally, in three organizations, a follow-up interview was scheduled to address remaining open questions (see Table 2). Data collected from the interviews were triangulated with data from S&OP documentation (slide decks) and observations and notes of a group meeting with participating organizations. During the group meeting, we presented preliminary findings to obtain feedback from the involved companies and sharpen the managerial implications. Furthermore, two case organizations (Cases B and D) presented their S&OP structure and a typical risk included in their S&OP. The three-hour session confirmed and elucidated how the case organizations differently manage risks through S&OP, and provided further inspiration for the data analysis.

Data analysis
We followed the three steps of Miles and Huberman (1994) for data analysis: data reduction, data display and conclusion drawing and verification. After reducing the data from interviews, archival data and S&OP slide decks to words, sentences and paragraphs that gave insights into the research question, we began mapping the S&OP process in each organization. In doing so, data on the S&OP set-up and process parameters were deductively coded, and each process was analyzed in comparison to the S&OP blueprint (Table 1). This allowed us to also code for differences between the S&OP blueprint and the cases in terms of set-up and process parameters, thereby producing an overview of the S&OP design in each case. In the second step, the data were deductively coded for risk identification, assessment, treatment and monitoring. We juxtaposed the data coded in the first and second steps to identify where in the S&OP execution each risk management activity was taking place (linked to the S&OP process parameters) and how each risk management activity was facilitated by the S&OP design. We first did so within case, and afterwards compared across cases. When comparing across cases, it became apparent that the applied replication logic did not provide the expected results: within the supply-focused design category, Cases B and F executed their S&OP differently to Cases D and E. Further analysis revealed that this was due to differences in the organizations' main perceived risk source and primary S&OP aim. This led to the division of supply-focused cases into "material supply" (Cases B and F) and "capacity supply" (Cases D and E) to properly explain risk management through S&OP design and execution. In Cases B and F, the main aim of S&OP was not to match demand and (capacity) supply, but to match material and capacity supply, while Cases D and E aimed at optimizing production capacity, and did not engage in balancing this with demand. Subsequent further analysis revealed that S&OP was adapted reactively in response to materialized risks. Overall, the analysis aimed for insights toward theoretical concepts via analytical generalizability (Ridder, 2017), rather than deriving statistically generalizable results. To safeguard the trustworthiness of the qualitative data and analysis (Lincoln and Guba, 1985;Eisenhardt, 1989;Yin, 2009), the following analytical strategies and iterations were employed: using Atlas.ti ® to store, fragment, reassemble and code the data manually but systematically and consistently within the program; triangulating different data sources; purposefully selecting cases based on theoretical replication; and seeking feedback on the results from participating organizations.

Findings
In presenting the study's findings, this section shows how organizations manage risks proactively through S&OP design (based on the risk focus) and execution, and reactively through S&OP adaption. Moreover, the planning levels in S&OP design and execution are identified as an important set-up parameter for managing risks. Table 3 overviews the S&OP design in each case.
Proactive risk management through S&OP design All case organizations match their S&OP design with the risk focus of their planning environment with respect to the sequence (Case D), number (Case G), content (Case B) and detail level (Cases C, E and F) of the S&OP activities, or to the planning object (Case A) or planning horizon (Case E). As such, S&OP design is adjusted to be demand focused (Cases A, C and G), capacity-supply focused (Cases D and E), or material-supply focused (Cases B and F). The resulting differences in process and set-up parameters are shown in Table 3. We also find that S&OP levels are an important design parameter.
The main aim of organizations with a demand-focused S&OP design (Cases A, C and G) is to manage demand risks to ensure high customer service levels by balancing demand and Managing risks through S&OP capacity supply. We find a demand-focused design in cases producing branded consumer goods that are (mostly) sold via powerful retailers. Therefore, throughout the S&OP in Cases A, C and G, satisfying demand leads decision making. Accordingly, S&OP prioritizes promotions as well as pricing and product portfolio considerations in relation to available capacity. To enable demand-focused S&OP, Case A conducts its S&OP at the stock-keeping unit (SKU) level, different from the product level suggested in the blueprint to identify potential risks in detail. Case C's demand-focused S&OP design is evident in the high number of demand reviewsone for each local market "in a little over 30 countries" [C2]. This enables Case C to identify demand risks early in the process and close to their source, as "they know exactly what is going on there [in the market]" [C2]. In Case G, the demand-focused design is evidenced by the incorporation of an additional S&OP activity (portfolio review) at the beginning of the S&OP process. During this portfolio review, the product portfolio and promotions are discussed.
Capacity-supply-focused S&OP design is found in the organizations particularly concerned with high utilization rates (Cases D and E). The primary S&OP aim is to optimize use of internal production capacity: "If one thing is specifically difficult in [our industry] then it is the utilization of the installations, which is the focus of the entire S&OP process. Hence, each hour in which you do not utilize your capacity is a loss and, therefore, a risk" [E2]. The capacity-supply-focused S&OP design thus originates from high investments in production capacity combined with high production volumes, which require attention to bottlenecks or machinery breakdowns to ensure continuous production. To manage such capacity supply risks, Case D changes the sequence of the S&OP process: it starts with a supply review, rather than a demand review, to "model all inputs as precisely as possible to operate the plants close to optimality" [D2]. Through near-optimal operations, Case D is able to achieve the high utilization rates required to cover large capacity investments. Case E's capacity-supply-focused design is evidenced by the number of supply reviews. Similar to the demand-focused Case C, which conducts over 30 demand reviews, Case E performs five separate supply reviews (one for each plant) to plan capacity supply. This allows Case E to identify capacity-related risks in detail, in line with its capacity-supply focus.
Material-supply-focused S&OP design is found in Cases B and F, which mainly deal with risks related to material provision: "You have uncertainty on the supply side: we are required to process all incoming raw material and we may not cancel the deliveries" [B1]. The materialsupply-focused design stems from specific contractual relations with suppliers that require the organizations to process all delivered raw materials. As such, beyond balancing demand and available capacity, the primary aim of S&OP is the match both with material supply. Consequently, Case B changes the content and Case F the detail level of S&OP activities. More specifically, Case B uses the supply review to discuss incoming material supply, whereas all other cases focus on capacity-supply issues during this meeting. Furthermore, in Case F, one business group's S&OP is dedicated solely to planning raw-material inflow. This allows the organization to pay particular attention to matching material supply with capacity supply, while the S&OP processes in the other three business groups aim at balancing capacity supply with demand.
Finally, we find an additional parameter of S&OP design that is not directly related to risk focus but is relevant for risk management through S&OP execution. Specifically, S&OP design can also include multiple planning levels across the organization: Cases A and G operate the S&OP process on three levels (global, regional and local) and Cases B, C and F on two levels (global/local and enterprise/business group). More specifically, Cases A, B and G perform all S&OP activities across multiple levels, while the demand-focused Case C only performs the demand review and Case F only the final S&OP meeting at two planning levels.

IJPDLM 51,6
Proactive risk management through S&OP execution The abovementioned demand-, capacity-supply-, and material-supply-focused S&OP designs enable all cases to proactively manage risks during execution of the monthly S&OP cycle. Table 4 overviews how risks are managed during S&OP execution.
The data indicate that S&OP design specifically enables risk identification during the monthly execution. The risk-focused design choices allow organizations to identify a wide range of risks during the S&OP process that might threaten the main aim of their S&OP. For example, demand-focused designs enable the timely identification of different threats to meeting demand through additional demand reviews (Cases C and G); capacity-supplyfocused designs have multiple supply reviews (Case E), allowing for detailed identification of threats to capacity utilization at the plant level; and material-supply-focused designs ensure identification of the most relevant risks by changing the content of supply reviews (Case B) or dedicating one business group's S&OP to material supply (Case F; see Table 4). Identified risks mentioned in the interviews and found in the S&OP slide decks include the following: legislative changes that impact demand (Case A) or material supply (Case B), variability in raw-material supply (Case B), potential unavailability of a bottleneck installation due to maintenance or breakdown (Cases D and E), relocation of products in the production network due to a plant closure (Case E), and entering a new market (Cases C and G).
Our data suggest that once a risk has been identified, the assessment is mostly independent from the design and exploits the qualitative experiences of S&OP participants (Cases B, D, E, F and G) and/or uses quantitative data to assess the likelihood and potential financial impact of an event. Yet the design focus of the different cases appears to play an important role in decision making on the best risk-treatment strategies. Available options when generating scenarios, such as extending the number of shifts, outsourcing, or investing in additional production lines, are mostly related to capacity supply (see Table 4). Cases B and F, in line with their material-supply focus, specifically devise scenarios to manage gaps in the balance between material and capacity supply, while Cases A, C and G adapt their capacity supply to be able to meet demand. By contrast, the capacity-supply-focused cases (D and E) focus on optimally using their production capacity due to stable demand and high changeover costs. As such, scenarios allow organizations to decide whether to: (1) avoid a risk, for example by phasing market interventions such as price changes, promotions and new product introduction across several months, instead of attempting them all simultaneously (Case C); (2) mitigate a risk, for example through capacity investments, outsourcing, or building up inventories (all cases); or (3) "do nothing as the [installation] is relatively stable at the moment" [E1].
Risk monitoring can be observed in Cases A, B and (most prominently) D. Case D does "not expect that, when we have calculated several scenarios at the beginning of the month and presented them, the decisions we take the moment the risk actually materializes would differ or that we would better anticipate the risk" [D1]. Instead, to monitor risks, the first half of the final S&OP meeting is spent evaluating the previous plan's performance to pick up early warning signals from deviations between planned and realized performance. Case B also uses S&OP for risk monitoring and considers the ongoing suitability of risk-treatment decisions for major risks stemming from legislative changes over the course of a year. Additionally, Cases A and B engage in challenging the input parameters (i.e. forecasts from Sales and available production capacity from Operations) that signal potential biases in the S&OP inputs and function as an early warning signal.
The results presented above are visible across multiple planning levels in Cases A, B, C, F and G. In relation to risk management activities, these levels serve different purposes: the local/business group level can quickly identify relatively small risks, whereas the global/enterprise level can identify risks that are more systemic. However, at the same Managing risks through S&OP time, consolidating risks at the global/enterprise level can provide "a risk-pooling effect, where small risks will cancel out across the different regions" [B2]. Moreover, decisions on suitable risk-treatment options are escalated from the lower level (i.e. regional/business unit) to the higher level (i.e. global/enterprise) if there are significant financial consequences (Cases A, B, F and G). For example, "it can be that a decisionsuch as outsourcingis escalated to the master S&OP [enterprise level]. Smaller decisions such as switching products to a different line can be taken in the pre-S&OP or final S&OP [business group level]" [F2].

Reactive risk management through S&OP adaption
The data show two ways in which risks are managed reactively: (1) adapting planning frequency through a crisis S&OP meeting; and (2) temporary adaption of the S&OP horizon. First, to deal with risks that require an immediate response to avoid a plant standstill, Cases D and F conduct a crisis S&OP. "If, for example, two or three plants break down at the same time, it has such a big impact on the balances and our profit that we need to address this in an exceptional S&OP. It mostly takes 30 to 45 min, and we sketch the new situation and devise a new optimal plan that is then formally approved by the business manager" [D1]. The crisis S&OP meeting is, therefore, neither a replacement for the monthly S&OP cycle nor a complete S&OP process, but an additional activity that resembles the final S&OP meeting in having the required decision-making authority to address mitigation strategies for major disruptions. While all other cases have a true tactical S&OP horizon and use contingency plans independent of the S&OP process to deal with materialized risks, Cases D and F include operational planning in their S&OP; as such, sudden disruptions are addressed in their S&OP horizon.
Second, Case A also uses the S&OP process to reactively deal with risks by temporarily reducing the planning horizon in response to (in)stability in the planning environment. More specifically, a legislative change prevents Case A from identifying and assessing long-term risks and requires adaption of its production portfolio, so neither historical sales data (for product-level forecasting) nor the bill of material (for production planning) can be used as inputs for the S&OP process. "In principle, we look 4 to 36 months ahead, but at the moment it is 12 months at most. This is because of the current situation in our industry due to legislation" [A2]. Consequently, the organization accepts risks beyond the next year as it is unable to mitigate, avoid, or transfer them, and temporarily reduces the planning horizon from 36 months to a maximum of 12 months to operate with a more certain/stable planning horizon. "When everything is up to date again in terms of material numbers for the SKUs, the forecasting, and the bill of material, and you know which plant will deliver the new products, you can go back to the regular forecast and look 36 months ahead" [A1]. This indicates that dealing with a low probability/high impact risk might require a temporarily adapted S&OP design to once again enable proactive risk management in S&OP execution.

Discussion
In exploring how risks can be managed through S&OP, we find that S&OP design and execution play proactive roles and S&OP adaption a reactive role. Proactively, risks can be managed through S&OP design based on the organization's risk focus, i.e. demand, capacity supply, or material supply. The resulting design focus allows organizations to identify, assess, treat and monitor their most important risks during the monthly S&OP execution. Moreover, the S&OP level is identified as an important design choice influencing how risks are managed through S&OP. Reactively, in response to major disruptions, a crisis S&OP meeting can be convened and/or S&OP design might be temporarily adapted. Figure 1 depicts these findings.

IJPDLM 51,6
Proactive risk management through S&OP design and execution To fulfill the aim of balancing demand and supply through S&OP (e.g. Thom e et al., 2012;Noroozi and Wikner, 2017), S&OP design requires consideration of contingency factors (internal, supply, demand and environmental) to manage specific externalities and risks (Kjellsdotter Ivert et al., 2015a). As confirmed by our data, risk-focused designs differ from the blueprint and enable risk management through S&OP. In contrast to suggestions in S&OP literature (e.g. Thom e et al., 2012), we found that some organizations do not use S&OP to balance demand and (capacity) supply. Rather, they aim to match material supply with capacity supply or to optimize internal capacity supply. Those organizations that aim to match demand and capacity supply will design their S&OP to focus on demand risks, seeking to ensure demand can be met through capacity adjustments. By contrast, organizations that aim to match capacity supply with material supply will design their S&OP to focus on material supply risks, so as to enable processing of all incoming raw material with their available capacity. Finally, companies that aim to optimize internal capacity will design their S&OP to focus on capacity supply risks, seeking to ensure the effective exploitation of high capital investments. These new, fine-grained insights not only highlight S&OP uses beyond matching demand and (capacity) supply (Tuomikangas and Kaipia, 2014) but also extend knowledge on how organizations design S&OP to manage risks (Kjellsdotter Ivert et al., 2015a) that might endanger their main aim.
P1. To manage risks through S&OP: (1) Organizations that aim to balance demand and capacity supply tend to design the S&OP process to be focused on demand risk; (2) Organizations that aim to balance material and capacity supply tend to design the S&OP process to be focused on material supply risk; and (3) Organizations that aim to optimize internal capacity tend to design the S&OP process to be focused on capacity supply risk.
Managerial literature suggests the need to design S&OP at multiple planning levels to be able to handle organizational complexities (Wallace and Stahl, 2008;Lapide, 2012) Figure 1. Managing risks through S&OP Managing risks through S&OP organizations might execute supply or demand review meetings at the regional or local level (e.g. per plant or market) to enable risk identification close to the source (Wallace and Stahl, 2008). On the other hand, the global/enterprise planning level might be beneficial as the aggregation of lower level plans pools their many inherent small risks. At the same time, costly risk-treatment measures are often escalated to the highest level to exploit the executive S&OP meeting's decision-making authority.

P2.
Through multi-level S&OP design, organizations can: (1) Identify risks requiring detailed knowledge at an early stage at the business unit/ regional level; and (2) Pool risks or identify systemic risks at the enterprise/global level with decisionmaking authority on costly risk-treatment options.
The risk-focused design at different planning levels enables risk management through S&OP execution, showing the risk management potential of S&OP beyond scenario planning (Noroozi and Wikner, 2017;Schlegel and Murray, 2010;Stahl, 2010;Singh and Lee, 2013). We find that risk identification and treatment are directly related to S&OP design, while risk assessment and monitoring seem not to be. More generally, organizations that do not follow the S&OP blueprint nonetheless appear well equipped to identify and treat risks during S&OP execution.
P3. In addition to proactively managing risks, and beyond scenario planning, S&OP design that deliberately deviates from the blueprint can enable and support risk identification and treatment in S&OP execution.

Reactive risk management through S&OP adaption
To date, S&OP has mainly been associated with proactive decision making on a tactical horizon (Thom e et al.. 2012;Noroozi and Wikner, 2017). The possibility for S&OP to contribute reactively to decision making, particularly in response to risks, seems to have been mostly overlooked by the academic community. Yet our findings highlight two ways in which the S&OP structure facilitates reactive risk management. First, we find that the S&OP process can be adapted as a risk management tool. This follows the logic of the mini S&OP (Wallace and Stahl, 2008) and collaborative S&OP (Kaipia et al., 2017), whereby the S&OP process design is adapted for a specific purpose and for a limited time to deal with, for example, demand disruptions or new product introductions. More specifically, we find that in response to materialized disruptions, the S&OP structure can facilitate a crisis S&OP meeting, resembling the executive S&OP meeting, to facilitate rapid, suitable solutions. This notion is supported by Bower (2018), who argues that smaller misalignments can be resolved without a whole S&OP cycle. Yet Bower (2018) refers to informal rebalancing in between regular S&OP activities, whereas we observe a rather formalized response to major events. The monthly execution of S&OP leads to clear responsibilities, roles and structures captured in processes (Tuomikangas and Kaipia, 2014) that can be drawn upon to deal with disruptions in a crisis S&OP meeting. Through the crisis S&OP meeting, organizations exploit routines (Scholten et al., 2019) that can help to deal with the unexpected, rather than working with contingency plans that are often not practiced or lie forgotten in a drawer (Choularton, 2007). As such, beyond its implications for S&OP literature, the crisis S&OP meeting also expands the range of available risk-treatment options in the risk management literature (Tomlin, 2006;Giunipero and Eltantawy, 2004).
P4a. In addition to the primarily proactive role of S&OP, using S&OP's established organizational structures and processes, organizations can reactively manage risks through a crisis S&OP meeting.

IJPDLM 51,6
Second, organizations can manage risks reactively through S&OP by temporarily adapting the S&OP horizon. Previous work highlights the need for an adaptable planning horizon in S&OP when product-group characteristics differ (Kjellsdotter Ivert et al., 2015a), but not to support risk management. This study finds that for known environmental risks, organizations can shorten the S&OP horizon to facilitate foreseeability in matching demand and material and/or capacity supply. It seems that organizations deviate from the original S&OP design to create a new temporary fit to the changed environment. As this was only observed in one case, we suggest future research into when how and why organizations deviate from their original S&OP design.
P4b. Risks can be reactively managed through S&OP by temporarily adapting the S&OP design to new and/or transitory environmental conditions.

Conclusion
This paper explored how risk management is conducted through S&OP, finding that riskfocused S&OP design enables organizations to proactively perform risk identification, assessment, treatment and monitoring in S&OP execution. As such, it challenges the predominant view that scenario planning is the only risk-treatment strategy conducted during S&OP execution. This paper also shows how the S&OP process is used to reactively to deal with unforeseen events, pointing out the role of crisis S&OP and temporary changes to the S&OP set-up parameters in responding to materialized risks. Moreover, it adds empirical evidence to the notion of multi-level S&OP in relation to risk management activities. Given the overall importance of risks in the design and execution of S&OP, we call for further research to adopt a risk management perspective and use the S&OP as an empirical base.
Besides theoretical contributions, this study has managerial implications. First, the findings suggest that managers need awareness of their environment to be able to fit S&OP design to their organization's circumstances and address their risk focus. Second, the study provides examples of how different risk management activities (beyond scenario planning) can be conducted during the customized S&OP process. Third, the findings suggest that the S&OP process can be used to reactively deal with disruptions. By exploiting the cross-functional capabilities developed through continuously matching supply and demand, managers can potentially minimize the impact of disruptions. Managers could further benefit from temporarily changing S&OP design in response to high uncertainty due to environmental risks.
Finally, the study's limitations and potential avenues for future research must be considered. Primarily, the study design departs from the S&OP process to explore links with risk management. As such, it does not systematically explore risk focusi.e. demand, material supply, or capacity supplybeyond what happens in the S&OP process. Future research should, therefore, investigate the interface between risk management and S&OP from a risk management perspective. Potentially interesting avenues include further exploring the roles of crisis S&OP and temporarily adapted S&OP design as reactive risktreatment tools, as well as an in-depth study of risk monitoring during S&OP. Additionally, the study suggests that multi-level S&OP runs in parallel across different hierarchical levels. While this study recognizes the importance of multi-level S&OP processes for managing risks, future research should investigate the nature, form and success factors of multi-level S&OP. Additionally, as risk monitoring is rather unexplored in risk management literature (Ho et al., 2015;Fan and Stevenson, 2018), our findings suggest that S&OP is a useful platform to study risk monitoring in more depth. In particular, the combination of early warning signals from KPI discussions and monitoring risk-treatment strategies over time can be a fruitful avenue. A final recommendation is to validate our findings in sectors other than the Managing risks through S&OP process industry and through methods other than case study research, so as to further increase the generalizability of this study's insights.