Haute Lumière

Commerce · III.10 · MMXXVI · daylight

La Bourse  /  Volume III  /  Nº III.10

Reserves and Resilience

Volume III — Money, Energy, Information

---

THE PLATE

---

THE LETTER

Every organisation you have ever worked in holds a reserve, and almost none of them can tell you what it is for.

Some of it is cash, and the number is defended in the treasury policy with a sentence about prudence. Some of it is inventory, and it is attacked every quarter by somebody whose bonus moves with working capital. Some of it is a person who is not fully loaded, a machine that is not fully utilised, a supplier relationship that is more expensive than the cheapest one — and all three of those are attacked without anybody noticing they were reserves at all.

This chapter is about the arithmetic underneath all of that. Not the sentiment — the arithmetic. A buffer is a live asset earning less than the rest of your assets, and the difference is the premium you are paying on an insurance policy that has no policy document. That premium can be computed. The cover it buys can be computed. And the point at which the premium exceeds the cover can be computed, which means the question how much reserve has a numerical answer and has had one since 1888.

We will do that arithmetic properly: safety stock with the term that actually moves it, the newsvendor's critical ratio, expected shortfall as a bank computes it, and the efficiency–resilience relation that Robert Ulanowicz measured in ecosystem flow networks — handled as the instrument it is rather than the slogan it has become.

Then the harder half. Every reserve in this chapter costs something to hold except the ones that are alive. Soil holds water. Skill holds capability. A relationship holds a call on somebody's attention when they have none left to give. These are reserves that appreciate while idle, and a firm that carries its buffer in them is carrying a reserve its balance sheet does not show and its competitors cannot price.

That is the good news and it is not the whole news. The negative in this chapter is sharp and it is not softened: a firm that over-reserves is beaten, and beaten by compounding, which forgives nothing. We compute the exact point where the insurance stops paying.

— The Editors

---

DISCOVERY

What is already working

Reserves are the least fashionable and most load-bearing structure in economic life, and the record of them working well is long, specific and largely unread.

The Svalbard Global Seed Vault. Built into a mountain on an Arctic island and opened in 2008 for a construction cost of the order of nine million dollars, it now holds around 1.3 million seed samples. That is $6.92 of capital per sample, carried at an operating cost of roughly 23 cents per sample per year. The vault's first withdrawal came in 2015, when ICARDA — the international dryland agriculture centre whose genebank was in Aleppo — could no longer reach its own collection. The material was taken out, grown on, and redeposited. A reserve that has been drawn down and replaced is the only kind anyone has evidence about, and this one has been.

Toyota, after 2011. The Tōhoku earthquake taught Toyota that its own just-in-time doctrine had a specific blind spot: semiconductors, with long lead times and single sources. The company built a supplier database and required critical chip stock of two to six months against its business continuity plan. When the 2021 shortage arrived, Toyota ran while others stopped — and then, in September 2021, cut global production by roughly 40 percent anyway, because the COVID outbreaks in Malaysia and Vietnam hit a different link. The buffer did not confer immunity. It bought roughly two quarters, which is a real and purchasable thing, and the chapter's arithmetic is built on that honest size.

The Strategic Petroleum Reserve. In early 2021 it held about 638 million barrels. At a nominal $70 a barrel that is $44.66 billion of capital tied up, carrying at a three percent opportunity cost of $1.34 billion a year — which across 131 million American households is $10.23 per household per year. In March 2022, 180 million barrels were released, 28.2 percent of the stock, and the Department of Energy subsequently repurchased at prices below its sale prices. A national reserve that costs a household the price of two coffees a year and returns a trading gain is not a burden. It is an underpriced asset that nobody presents in those terms.

European gas storage, 2022. Storage entered March 2022 about 26 percent full. A regulation adopted that June set binding fill targets, and by November the continent's sites were around 95 percent full. On a working capacity of roughly 1,100 TWh that is 759 TWh purchased, and at an illustrative average of €100 per MWh — the figure is an assumption and it is labelled as one — about €75.9 billion, or €170 per citizen. Prices fell from €339 per MWh in August to a fraction of that within a year. The buffer did not merely cover the winter. It removed the credibility of the squeeze, which is a different and larger effect.

Germany's short-time work scheme. At the 2020 peak around six million German workers were on Kurzarbeit. German unemployment rose by 0.90 percentage points; American unemployment rose by 11.20, a factor of 12.4. What Germany held was not money. It was six million employment relationships left standing — and at a replacement cost of seven and a half months' salary on a €45,000 average, that is on the order of $168.8 billion of rehiring that did not have to be done.

Coastal wetlands. Costanza and colleagues put the storm-protection value of US coastal wetlands at $23.2 billion a year — on fifteen million hectares, about $1,547 per hectare per year. Nobody holds that reserve. It holds itself, and it enters the accounts only at the moment it is removed.

Six reserves, six forms: a vault, a warehouse, a salt cavern, a labour contract, a marsh, a seed. In every case the reserve's value showed up in a year that the people who funded it had not been able to name in advance. That is not a weakness of the argument. It is the definition of the product.

---

THE ARITHMETIC

What works, what does not, and where the line sits

First, what a buffer is actually sized against.

The standard formula for safety stock is one line, and the line is more interesting than it looks:

   safety stock  =  z · σ_DL
   σ_DL  =  sqrt( L·σ_d²  +  d²·σ_L² )

   d   mean demand per period      σ_d  its standard deviation
   L   mean lead time              σ_L  its standard deviation
   z   the service-level quantile

Two variances, added. The first is your customers. The second is your supplier. Work it on real lead times. Semiconductor lead times ran around 13 weeks in 2019 and peaked at 27 weeks in May 2022. Take a firm using 1,000 units a week with a demand deviation of 300, and assume lead-time deviations of two weeks then and eight weeks at the peak:

  2019   13 × 300²  =   1,170,000     1,000² × 2²  =   4,000,000
         σ_DL = 2,273.8      safety stock at 95% = 3,740 units
         the lead time is 77.37% of the variance

  2022   27 × 300²  =   2,430,000     1,000² × 8²  =  64,000,000
         σ_DL = 8,150.5      safety stock at 95% = 13,406 units
         the lead time is 96.34% of the variance

The required buffer multiplies by 3.58×, and demand never moved. Your reserve is sized by your supplier's reliability, not by your own volatility — and your supplier's reliability is the one term in the formula that is not in your reporting pack.

Second, what the last point of service costs.

Expected units short per cycle is σ · L(z), where L(z) = φ(z) − z(1−Φ(z)) is the standard normal loss function. Run the ladder on the 2022 case, at a holding cost of $12 a unit a year:

  service     z      E[short]   safety stock   annual carry   $/unit short avoided
    90.00%  1.282     385.9        10,445        125,343              —
    95.00%  1.645     170.3        13,406        160,876           164.82
    99.00%  2.326      27.6        18,961        227,530           467.20
    99.90%  3.090       2.3        25,187        302,242         2,945.75
    99.99%  3.719       0.2        30,312        363,740        29,834.20

The reserve is not expensive. The last point of the reserve is expensive, and the price of a unit of avoided shortage rises by a factor of 181 between the first step and the last. This is the shape of every insurance decision ever made and it is why "we should never run out" is not a policy — it is a refusal to choose a number.

Third, choosing the number. Where the insurance stops paying.

At the optimum, the marginal cost of one more unit of buffer equals the marginal expected shortage it removes:

   h·σ  =  p·(D/Q)·σ·(1 − Φ(z))      ⟹      1 − Φ(z*)  =  h·Q / (p·D)

With a $240 penalty per unit short, 52,000 units a year and orders of 26,000:

   1 − Φ(z*) = 12 × 26,000 / (240 × 52,000) = 0.025
   z* = 1.9600   →   service level 97.50%   →   safety stock 15,975 units
   carry 191,695 $/yr  +  expected shortage 36,955 $/yr  =  228,650 $/yr

And the shape around that point matters more than the point. Half a z-unit short costs 17.35 percent more than the optimum; half a z-unit long costs 9.10 percent. The optimum is a basin, not a peak, it is asymmetric, and under-reserving is punished about twice as hard near the bottom — while over-reserving is the one whose penalty grows without limit as you keep going.

Fourth, the newsvendor — which was invented for a bank.

Francis Edgeworth posed the single-period reserve problem in 1888 in The Mathematical Theory of Banking: how much cash should a bank hold against uncertain withdrawals? The answer is the critical ratio, Cu/(Cu+Co) — the cost of being short over the cost of being short plus the cost of being long. Work it on spare grid transformers, where a shortage is an outage costing $2.4m and a held spare carries at $90,000 a year:

   CR = 2,400,000 / 2,490,000 = 0.963855
   demand Poisson with mean 4 failures a year
   order the n-th spare while Cu·P(D ≥ n) > Co·P(D < n)

     n = 8   marginal value  + 37,323
     n = 9   marginal value  − 36,805      ⟹  Q* = 8 spares

Eight spares against four expected failures: twice the mean, and half the reserve idle in the median year. Its whole cost is $720,000 annually, which is 30 percent of a single avoided outage. The idleness is not waste. It is the premium, and it is cheap.

Fifth, the tail — because that is what a reserve is actually against.

Basel's 2019 market risk framework replaced 99 percent Value at Risk with 97.5 percent Expected Shortfall: not the edge of the tail but the average of it. Under a normal loss the two are nearly the same number — ES at 97.5% is 2.3378σ, VaR at 99% is 2.3263σ, a ratio of 1.0049. That near-identity is the entire calibration, and it holds exactly as long as the tail is normal. Under a Student-t with five degrees of freedom, variance-matched to the same σ, the expected shortfall is 2.7278σ — 16.68 percent higher. A buffer sized on a normal tail is a sixth short against a fat-tailed world of identical variance, and the tail is the part of the distribution nobody has enough observations of.

Sixth, the 2020–22 shock, measured.

  container freight, Drewry WCI    $1,420 (2019) → $10,377 (Sep 2021)   7.31×
  NY Fed supply chain pressure     4.3 standard deviations, Dec 2021
  Suez, six days of Ever Given     $9.6bn/day × 6  =  $57.6bn of cargo held
  US retail inventories/sales      1.45 → 1.10, i.e. 44.1 → 33.4 days, −10.6 days
  auto revenue lost to chips, 2021 $210bn                    (AlixPartners)

Now price the buffer that was not held. At 77 million light vehicles and about $500 of semiconductor per vehicle, the industry's chip spend was $38.50 billion a year. Toyota's three-month standard is $9.62 billion held, carrying at 25 percent — capital, storage and obsolescence — for $2.41 billion a year.

Against $210 billion of revenue lost in a single year, that is a ratio of 87.3×: the industry could have carried the buffer for eighty-seven years for what it forwent in one.

But revenue is not the right numerator and we will not use it as one. On a 12 percent operating margin the forgone profit is $25.20 billion, and the buffer does not recover all of it — Toyota's bought two quarters of a shortage that ran more than a year. So compute the figure that actually decides a reserve:

   T*  =  (loss × recovery fraction) / annual carry
       =  the interval between shocks at which the reserve breaks even

   recovery      T* on revenue     T* on profit
      15%           13.1 yr           1.6 yr
      40%           34.9 yr           4.2 yr
     100%           87.3 yr          10.5 yr

Four supply shocks of this kind in the 2011–2022 record — Tōhoku, the Thai floods, Naka, the pandemic — is an interval of 3.0 years, against a break-even of 4.2. On these assumptions the buffer pays, and the assumptions are the argument, which is why they are printed rather than described.

Seventh — and this is the honest negative — over-reserving loses, and loses badly.

A buffer earns less than the business it sits inside. Take a firm returning 12 percent on invested capital and a competitor holding 20 percent of its capital in cash at 2 percent:

   buffered growth  =  0.80 × 12%  +  0.20 × 2%  =  10.00%
   drag             =  2.00 percentage points per year
   over 20 years    =  1.12²⁰ = 9.646×   against   1.10²⁰ = 6.727×
   the lean firm ends 43.39% larger

Now make ruin absorbing, because it is, and solve for the annual probability of ruin at which the two are equal:

   (1−p)²⁰ × 9.646 = 6.727   →   1−p = 0.982143   →   p* = 1.7857% per year
                                          = once in 56.0 years

A 20 percent cash buffer is worth holding only if going without it would ruin the firm more often than once in fifty-six years. Below that frequency the unbuffered competitor wins — and it wins by compounding, the one mechanism that does not forgive a decade of caution. Every prudent treasurer should read that number and feel the ground move slightly, because it is the reason the market punishes prudence and the reason it is sometimes right to.

Eighth, Ulanowicz's window, handled as an instrument.

Robert Ulanowicz measured flow networks in ecosystems using information theory: ascendency A, the organised, efficient part of throughput; development capacity C, its upper bound; and a = A/C, the degree of order. Robustness is then modelled as R = −a·ln a, which is zero at both ends and peaks at a = 1/e = 0.367879.

Three things must be said carefully, and are usually not said at all.

One: 0.368 is a property of the chosen function, not a measurement. Any function that is zero at both extremes with a single interior maximum peaks somewhere; this one peaks at 1/e. The finding is the shape — that too much order is as fatal as too little — and the shape is robust. The coordinate is not.

Two: the peak is a plateau. Within 10 percent of maximum robustness, a may run anywhere from 0.216 to 0.544 — a band 0.328 wide, which is 0.89 times a* itself. Within 1 percent it still runs 0.317 to 0.421. Any prescription that a system should sit at 0.368 to three figures is reading precision the instrument does not carry.

Three: a moves when the analyst redraws the network. Flow diversity on k equal compartments is ln k — 0.6931 at two, 2.7726 at sixteen — so aggregation changes the denominator. Report a with its network resolution beside it, or do not report it.

What survives all three caveats is worth a great deal: an interior optimum exists. A system tuned entirely for efficiency is brittle, a system tuned entirely for redundancy is inert, and both failures are visible in the same curve. That is enough to build on and it is all the mathematics will bear.

---

DREAM

What becomes ordinary

In the firm that has understood this, the reserve is a line item with a stated purpose, a stated cost, and a stated return period. It is reviewed the way an insurance programme is reviewed — not should we have it but is it sized right this year — and the treasurer can say, in one sentence, what event it is against and how often that event has to arrive for the cost to be worth paying.

The finance function knows which of its buffers are dead and which are alive. The cash layer is dead: it earns the policy rate and costs the spread. The inventory layer is mostly dead, though held on somebody else's title, so cheaper. And the third layer — the one that did not use to be on any schedule — is alive: the soil under a supplier's fields, the skill in a workforce that was kept through a bad quarter, the maintenance habit that keeps a line running past its schedule, the relationship with a supplier who takes the call at six in the evening. These are reserves that earn their own return while standing by, and the whole art of the thing is moving buffer capacity from the first layer to the third.

Procurement has stopped asking suppliers only for price and started asking them for variance. A supplier's lead-time standard deviation is on the scorecard, because the buyer has done the arithmetic and knows that 96 percent of the buffer it carries is the supplier's variance, not its own. Suppliers who reduce it get paid for it, in a contract clause, because the buyer can compute exactly what a week of σ_L is worth in released working capital.

And reserves are held together where holding them apart would be absurd. Firms in the same region, drawing on the same scarce component, hold one pooled buffer and pay for the option on it rather than the thing itself — the way a mutual insurer works, the way a central bank's discount window works, the way a grain board has always worked. Nobody finds this remarkable, because nobody finds it remarkable that eleven households do not each own a fire engine.

The organisation still runs lean. This is not an argument for fat. It is an argument that lean was never the opposite of resilient — dead buffers were the opposite of resilient, because they were what lean could see and therefore what lean removed.

---

DESIGN

The structure that gets there

Reserve policy has four parts. Written down, in this order, it survives the person who wrote it.

1. Name the event, not the ratio. "Three months of cover" is not a policy; it is a number with no antecedent. "Cover for a twelve-week single-source semiconductor interruption, which our own record shows twice in eighteen years" is a policy, because it can be argued with and it can be repriced. Every reserve gets a named scenario, a named duration, and a named recovery fraction.

2. Compute the break-even return period and publish it. T = (loss × recovery) / annual carry. It is one line, every stakeholder understands it, and it converts a values conversation into a frequency conversation. If your organisation's own incident record shows the event more often than T, the reserve is cheap. If not, it is not — and saying so is what makes the rest of the policy credible.

3. Layer the reserve by its carrying cost, cheapest first.

Fill from the top. Layer 4 is the most expensive reserve available and it is usually the first one built, because it is the only one that looks like a reserve.

4. Rotate it, or it spoils. A reserve that is never drawn is a reserve nobody knows how to draw. The seed vault's credibility rests on the 2015 withdrawal. The SPR's rests on 2022. Grain boards rotate stock into the market annually and buy back. Write the drawdown drill into the policy and run it once a year on a small scale, because the failure mode of an untested reserve is not that it is empty — it is that nobody has the authority to open it in the eight hours when opening it would have mattered.

And the governance question that decides everything: who pays. The chip buffer's cost sits on a producer's balance sheet; its benefit sat in a buyer's driveway. That gap is not a market failure to be lamented — it is a design specification. Reserves that survive at scale are mandated (bank capital, EU gas storage), mutualised (reinsurance, a pooled regional buffer, a cooperative's shared reserve fund), or regenerative (soil, skill, a repairable product line, where the holder captures enough of the ordinary-year return to fund the extraordinary-year cover). If a proposed reserve is none of the three, it will be cut, and it will be cut by someone who is behaving rationally.

---

DESTINY

How it holds when you stop pushing

The enemy of a reserve is not a crisis. It is a good decade.

Every year that nothing happens, the buffer looks more like waste and the case for it gets weaker in exactly the way an insurance premium does — except that nobody cancels their fire insurance, because the policy document exists and the renewal is an event. An unwritten reserve has no renewal, so it is not cancelled. It erodes. One quarter it is trimmed for working capital, the next it is not replenished, and four years later it is a number in a policy nobody has read.

Three things keep it standing.

A named owner and a named event. Not "the treasurer"; a person, and a scenario with a date attached to the last time it happened. Attach the reserve to the firm's own incident history and the argument renews itself annually without anybody making a speech.

A published break-even. T* on the front page turns the annual attack into an annual arithmetic check, which is a fight the reserve usually wins and always survives. A reserve defended by conviction loses to the first CFO with a working capital target. A reserve defended by a return period does not.

A drill. Draw it down once a year, on purpose, at a small scale. It proves the authority chain, it refreshes the stock, and — in the case of the living layers — it is the only way anybody finds out whether the skill is still there.

Now the honest part. Here is where this fails. It fails when the reserve is sized on a normal tail and the world delivers a fat one, which is a sixth short before anything else goes wrong. It fails when the buffer is correlated with the shock it insures against — a dual-use living reserve is beautiful and it is on the same farm as the drought, in the same firm as the downturn, so the very correlation that makes it cheap is what makes it fail exactly when needed. It fails when a committed facility is drawn by everybody at once, as in March 2020, because a promise from a counterparty in a systemic event is not a reserve, it is a hope with a fee attached. And it fails, most often and most quietly, when the firm over-reserves against an event whose return period is 200 years and is overtaken in twenty by a competitor that did the arithmetic. The reserve is not virtuous. It is a priced instrument, and a priced instrument can be mispriced in both directions.

---

DELIGHT

What it feels like

There is a particular quality to a room where the reserve is adequate and everyone knows the number. The conversation changes temperature. People argue about the right things — the recovery fraction, the return period, whether last March counts as the event — and nobody argues about whether it is allowed to exist.

And there is the private pleasure of the drawdown itself. The day the buffer is used is the only day it is visible, and it is not a dramatic day. Somebody opens a store, somebody makes a call to the supplier who was kept, somebody runs a line for three weeks on material bought eleven months ago by a person who has since left. Nothing happens. That is the entire product: an ordinary week where an extraordinary one was available.

The deepest version of it is agricultural and it is worth feeling once. Walk a field where the organic matter is three points higher than the field next door. It holds 56 millimetres of rainfall equivalent more — eleven days of a summer crop's water. In an ordinary year you cannot see it. In the dry year you can see it from the road, and what you are looking at is a reserve that was earning its keep the entire time it was standing by.

---

OPERATIONALIZE THIS

At the level of finance

The instrument: a Standing Reserve Facility, layered by carrying cost, with a published break-even return period.

The structure. Three layers against one named scenario, each priced separately, sized so that the expensive layer is the residual rather than the default.

Layer 1 — the option on cash. A committed, undrawn revolving facility. On a $50m reserve requirement, holding the cash costs the ROIC-to-cash spread of ten points: $5.00m a year. The commitment fee at 37.5 basis points costs $0.188m a year — 26.7× cheaper. Price it at its reliability, not its fee: at an assumed 70 percent availability in a genuine systemic event it is still 18.7× cheaper, and in March 2020 corporates drew revolvers on the order of a quarter of a trillion dollars in weeks precisely because they doubted the lines would remain. This layer is cheap because it is a promise. Never let it be more than a layer.

Layer 2 — physical, on someone else's title. Consigned or vendor-managed stock. A 6 percent consignment fee on $50m is $3.00m a year against $12.50m to carry it yourself at 25 percent — 76 percent lower — and under IFRS 15 title has not passed, so it does not consolidate into working capital or touch the leverage covenant. That last point is usually the real objection, stated as a cost objection, and it is worth naming out loud in the room.

Layer 3 — the living layer. Soil organic matter, retained skill, maintained repairability, a supplier relationship funded above the cheapest bid. Its carrying cost is at or below zero because it produces in ordinary years: three points of organic matter is $620 per hectare in a drought year on the Rodale drought differential, and it raises the wet-year yield too. This is the only layer that scales, because its cost is already in another budget line.

Balance sheet treatment. Layer 1 is a disclosure, not a liability, until drawn. Layer 2 stays with the supplier under IFRS 15 and is priced into unit cost — get the covenant carve-out agreed in writing before, not after. Layer 4, your own inventory, is IAS 2 at the lower of cost and net realisable value, and a strategic buffer is still inventory: it will hit the working capital metric, so pre-agree its exclusion from the incentive measure or it will be cut by someone who is being paid to cut it.

The counterparty. For layer 2, the incumbent supplier first — they already hold the stock, and the fee is a margin conversation rather than a credit one. For a pooled buffer, the industry association or a captive vehicle with three to five members; for the mandated version, the regulator, which is a slower door but the only one that solves the free-rider problem permanently.

The number that decides it. One line, on the front page:

      loss the event would cause  ×  share of it this reserve prevents
  T* = ─────────────────────────────────────────────────────────────────
                        all-in annual carrying cost

  worked:   $180m × 0.45 / $3.188m  =  25.4 years

Hold the reserve if an event of that size arrives more often than once every twenty-five years. Then put the firm's own incident log beside it. If the log says twice in eighteen years, the argument is finished and it was finished numerically, which is the only way it stays finished.

The first ninety days on a page.

---

APPRECIATIVE QUESTIONS

Twelve, for a room

Discovery — what is already working

1. Think of a time this organisation absorbed a shock without anybody outside noticing. What absorbed it — and had anybody costed that thing before?
2. Which of our buffers has actually been drawn in the last five years, and what did we learn about our own authority chain on the day we drew it?
3. Where are we already holding a reserve that earns its own keep — a skill, a relationship, a piece of maintenance — and who has been quietly funding it?

Dream — what becomes possible

1. If our suppliers' lead-time variance were on our scorecard beside their price, what would we start paying for that we do not pay for now?
2. Imagine our reserve policy fitting on one page with a return period on it. What conversation would that let us stop having every quarter?
3. If three firms like ours held one pooled buffer, what could each of us stop holding alone — and what would we each need to trust?

Design — what we build

1. What is the event our largest reserve is actually against? Say it as a sentence with a duration in it.
2. Which of our buffers could move from our own balance sheet to a committed facility or a supplier's title this year, and what would that release?
3. What would a one-day drawdown drill look like here, and who would need the authority to run it without asking?

Destiny — how it holds

1. What would have to be true for this reserve to still exist after three good years in a row?
2. Who notices first if the buffer is quietly not being replenished, and how would they tell us?
3. If we are over-reserved, what is the signal we would trust — and are we willing to act on it as fast as we would act on being under-reserved?

---

WORKS CITED

Arrow, K. J., Harris, T. and Marschak, J. (1951). "Optimal Inventory Policy." Econometrica, 19(3), 250–272.

Edgeworth, F. Y. (1888). "The Mathematical Theory of Banking." Journal of the Royal Statistical Society, 51(1), 113–127.

Scarf, H. (1958). "A Min-Max Solution of an Inventory Problem." In Arrow, K. J., Karlin, S. and Scarf, H. (eds), Studies in the Mathematical Theory of Inventory and Production. Stanford University Press.

Hopp, W. J. and Spearman, M. L. (2011). Factory Physics, 3rd edn. Waveland Press.

Lee, H. L., Padmanabhan, V. and Whang, S. (1997). "Information Distortion in a Supply Chain: The Bullwhip Effect." Management Science, 43(4), 546–558.

Ohno, T. (1988). Toyota Production System: Beyond Large-Scale Production. Productivity Press.

Sheffi, Y. (2005). The Resilient Enterprise: Overcoming Vulnerability for Competitive Advantage. MIT Press.

Simchi-Levi, D., Schmidt, W. and Wei, Y. (2014). "From Superstorms to Factory Fires: Managing Unpredictable Supply-Chain Disruptions." Harvard Business Review, January–February.

Artzner, P., Delbaen, F., Eber, J.-M. and Heath, D. (1999). "Coherent Measures of Risk." Mathematical Finance, 9(3), 203–228.

Rockafellar, R. T. and Uryasev, S. (2000). "Optimization of Conditional Value-at-Risk." Journal of Risk, 2(3), 21–41.

Basel Committee on Banking Supervision (2019). Minimum Capital Requirements for Market Risk. Bank for International Settlements.

Holmström, B. and Tirole, J. (2011). Inside and Outside Liquidity. MIT Press.

Holling, C. S. (1973). "Resilience and Stability of Ecological Systems." Annual Review of Ecology and Systematics, 4, 1–23.

Ulanowicz, R. E., Goerner, S. J., Lietaer, B. and Gomez, R. (2009). "Quantifying Sustainability: Resilience, Efficiency and the Return of Information Theory." Ecological Complexity, 6(1), 27–36.

Zorach, A. C. and Ulanowicz, R. E. (2003). "Quantifying the Complexity of Flow Networks: How Many Roles Are There?" Complexity, 8(3), 68–76.

Ulanowicz, R. E. (2009). A Third Window: Natural Life Beyond Newton and Darwin. Templeton Press.

Peters, O. (2019). "The Ergodicity Problem in Economics." Nature Physics, 15, 1216–1221.

Taleb, N. N. (2012). Antifragile: Things That Gain from Disorder. Random House.

Ostrom, E. (1990). Governing the Commons: The Evolution of Institutions for Collective Action. Cambridge University Press.

Costanza, R., Pérez-Maqueo, O., Martinez, M. L., Sutton, P., Anderson, S. J. and Mulder, K. (2008). "The Value of Coastal Wetlands for Hurricane Protection." AMBIO, 37(4), 241–248.

Rodale Institute. Farming Systems Trial reports, 1981– .

United States Department of Agriculture, Natural Resources Conservation Service. Soil Health technical notes on organic matter and water-holding capacity.

OECD (2020). Job Retention Schemes During the COVID-19 Lockdown and Beyond. OECD Publishing.

AlixPartners (2021). Shortages Related to Semiconductors to Cost the Auto Industry $210 Billion in Revenues in 2021. 23 September.

Benigno, G., di Giovanni, J., Groen, J. J. J. and Noble, A. I. (2022). "The Global Supply Chain Pressure Index." Federal Reserve Bank of New York, Liberty Street Economics.

Drewry Shipping Consultants. World Container Index, weekly series.

United States Census Bureau. Manufacturing and Trade Inventories and Sales, monthly series.

United States Bureau of Labor Statistics. Consumer Price Index, used cars and trucks series.

General Motors Company. Annual Report on Form 10-K, 2019 and 2021.

European Union (2022). Regulation (EU) 2022/1032 on Gas Storage. Official Journal of the European Union.

Crop Trust and the Norwegian Ministry of Agriculture and Food. Svalbard Global Seed Vault, deposit and withdrawal records, 2008– .

Note on figures. Every number in this chapter is computed in lib/verify/III_10.py and printed there with its inputs, its units and its source. Parameters this chapter chose rather than measured — carrying rates, operating margins, recovery fractions, lead-time deviations, the reserve scenarios — are labelled ASSUMED in that module, and the results computed from them carry the label. The break-even return period T* is defined there and reused unchanged in the workbooks.