Putting supply chain vulnerability on the corporate agenda