When it comes to your supply chain, do you lean more toward risk aversion or risk tolerance?

Either or both. The most important step for me is to be risk aware and visualize the risk in a way where business leaders can understand and use it for planning and decision making. 

I believe it is a matter of the situation and the complexities of the initiatives. As a rule, with technological advancements and more significant complexities within global supply chain operations, more companies are being "risk-tolerant." In some instances, it does necessitate being risk-averse. A mature risk management process and risk governance structure is essential to making these strategic decisions. 

Great dilemma, the CISO side would be risk aversion by means of security and continuity build-in (by-design). The operational day-2-day answer would be risk tolerance. My supplychain college will point out that the continuity of the supply chain would be his key KPI closely connected to the reputation of the company. Of course, de-risking parts of the supply chain is also his prerogative, but continuity is the way forward. 

Best starting advice is to bring al risks and weaknesses for the supply chain together and have periodically insiders but also people from other BU's, give their opinion of the risks and weaknesses listed.