Supply Chain Risk, Resilience and Continuity

Introduction and strategic context

Modern supply chains are interconnected networks rather than linear sequences. They link suppliers, manufacturers, logistics providers, information systems, financial institutions, regulators and customers across multiple jurisdictions. This connectivity creates efficiency, but it also creates exposure. A disruption at a port can interrupt production several countries away; a cyberattack can stop physical distribution; a drought can reduce both agricultural supply and hydroelectric power; and a financially distressed supplier can fail without much warning.

Supply chain risk management is therefore a strategic discipline concerned with understanding uncertainty, reducing unacceptable exposure and preparing the organisation to respond when preventive controls fail. Resilience extends this discipline by asking how quickly and effectively the supply chain can absorb, adapt to and recover from disruption. Business continuity provides the organised capability to maintain critical operations during an incident, while recovery planning focuses on restoring or redesigning normal performance.

The objective is not to eliminate all risk. Absolute elimination is usually impossible and may be economically irrational. The objective is to make informed decisions about which risks to avoid, reduce, transfer, accept or exploit, while preserving the organisation’s ability to fulfil critical customer and stakeholder commitments.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Distinguish supply chain risk, vulnerability, disruption, resilience and continuity.
2. Identify operational, supplier, geopolitical, cyber, climate and other disruption risks.
3. Construct and interpret a risk register and risk map.
4. Apply qualitative and quantitative risk-assessment techniques.
5. Use scenario analysis, stress testing and business-impact analysis.
6. Select appropriate risk treatments and resilience capabilities.
7. Develop continuity, crisis-response and recovery arrangements.
8. Evaluate governance, ethical, technological and implementation issues.

1. Foundations and terminology

Risk, uncertainty and disruption

Risk refers to the effect of uncertainty on objectives. In supply chain management, the objectives may include service level, cost, quality, safety, compliance, revenue, sustainability and reputation. A risk event is a possible occurrence, whereas a disruption is an event that has actually interrupted or materially degraded operations.

Uncertainty may be aleatory, arising from inherent variability such as fluctuating demand, or epistemic, arising from incomplete knowledge such as uncertainty about a supplier’s cyber controls. The distinction matters: variability may be managed through buffers and forecasting, while lack of knowledge may require investigation, auditing or improved information sharing.

A useful causal chain is:

Hazard → exposure → vulnerability → disruption → impact → response → recovery

A hazard is a potentially damaging condition, such as flooding or malware. Exposure describes what is located in the hazard’s path, such as a warehouse in a floodplain. Vulnerability describes how susceptible the exposed asset or process is. Impact is the resulting effect on objectives.

Resilience and continuity

Resilience is the capability of a supply chain to prepare for disruptive events, absorb their effects, adapt its configuration and recover acceptable performance. Resilience is broader than redundancy. A second supplier may provide redundancy, but resilience also includes visibility, flexible production, substitution, collaboration, skilled people, financial strength and rapid decision-making.

Business continuity is the capability to continue delivering critical products or services at acceptable predefined levels during and after a disruption. Continuity planning normally identifies critical activities, minimum resource requirements, alternative procedures, decision authority and communication arrangements.

Recovery is the process of restoring, rebuilding or transforming operations after an incident. A resilient supply chain may not return to its exact previous state. It may recover by redesigning its network, changing suppliers or adopting a different operating model.

Important terminology

• Threat: A source or cause of potential harm.
• Event: An occurrence that may or may not produce consequences.
• Control: A measure that prevents, detects or responds to risk.
• Critical supplier: A supplier whose failure could materially affect priority operations.
• Single point of failure: A component whose loss can interrupt a system because no viable substitute exists.
• Time to survive (TTS): The period for which a supply chain can continue before a disruption causes unacceptable failure.
• Recovery time objective (RTO): The target time for restoring an activity or service.
• Recovery point objective (RPO): The maximum tolerable period of data loss, relevant especially to information systems.
• Maximum tolerable period of disruption (MTPD): The longest period an activity can be unavailable before unacceptable consequences occur.
• Residual risk: Risk remaining after controls are applied.

2. The supply chain risk landscape

Risk identification should consider the entire value network, not merely the focal organisation. A practical classification is shown below.

Risks may be independent, correlated or cascading. For example, extreme heat may reduce crop yields, increase electricity demand, damage transport infrastructure and weaken supplier finances simultaneously. Treating each risk in isolation can therefore underestimate aggregate exposure.

Network perspective

Supply chain mapping should identify tier-one suppliers and, where material, deeper tiers, logistics nodes, information dependencies, substitution possibilities and geographic concentrations. Mapping should answer five questions:

1. What are the critical products, services and flows?
2. Which nodes, routes, systems and people enable those flows?
3. Where are dependencies concentrated?
4. Which alternatives could be activated?
5. What information would be needed during a disruption?

A map is not merely a diagram. It is a decision instrument that should be maintained as products, suppliers, routes and technologies change.

Figure: The bow-tie model links risk causes and consequences with preventive and mitigating controls.

3. Risk assessment and prioritisation

Risk identification

Identification methods include process walk-throughs, supplier assessments, interviews, historical incident analysis, audits, horizon scanning, failure mode and effects analysis (FMEA), hazard studies, cyber assessments and workshops. Effective identification includes “what if?” questions and considers low-frequency, high-consequence events rather than relying only on historical data.

A risk register records the risk statement, cause, event, consequence, owner, existing controls, inherent rating, treatment, target rating, indicators and review date. A well-written risk statement separates cause, event and effect: “Because the organisation depends on one overseas source for a certified component, an export restriction could interrupt production for eight weeks, causing customer backorders.”

Qualitative risk scoring

A common screening method scores likelihood and impact on ordinal scales. If likelihood is represented by L and impact by I, a simple score is:

Here, R is the risk score, L is the selected likelihood rating and I is the selected impact rating. The method assumes that the organisation has defined consistent scales and that multiplication is being used only as a prioritisation convention, not as a measured probability of loss. Ordinal scores do not possess precise ratio properties; therefore, a score of 12 is not necessarily twice as serious as a score of 6.

For example, if a disruption is rated L = 4 and I = 5 on five-point scales, then R = 20. The organisation may classify this as high risk according to its approved risk appetite. A matrix should support judgement, not replace it. Two risks with the same score may require different treatments because one is frequent and recoverable while the other is rare but catastrophic.

Expected loss and uncertainty

Where probabilities and monetary consequences are sufficiently credible, expected loss can support economic comparison:

where EL is expected loss per analysis period, pᵢ is the probability of scenario i, Cᵢ is the consequence cost of scenario i, and the probabilities across the defined mutually exclusive scenarios sum to 1. The formula assumes that consequences are expressed in comparable monetary units and that the probability estimates are decision-useful. Expected loss can conceal extreme downside, so it should be supplemented by worst-case, percentile or stress analysis.

If a risk has a 10% annual probability and a consequence of £2,000,000, its expected annual loss is £200,000. This does not mean that £200,000 will be lost every year; it is a long-run probability-weighted estimate.

FMEA and criticality

FMEA examines how a process or component can fail, the effects of failure, possible causes, existing controls and recommended actions. Traditional risk priority numbers often multiply ratings for severity, occurrence and detectability. However, these ratings are ordinal and multiplication can create misleading equivalence. FMEA should therefore be treated as a structured discussion tool, with high-severity failures reviewed even when their composite score is modest.

Dependency and concentration metrics

Concentration may be assessed using a supplier share metric. If supplier j provides share sⱼ of a required input, where shares are expressed as decimals and sum to 1, the Herfindahl–Hirschman Index is:

A higher HHI indicates greater concentration. For two equally sized suppliers, HHI = 0.5² + 0.5² = 0.5; for four equally sized suppliers, HHI = 4 × 0.25² = 0.25. This metric does not determine risk by itself: suppliers may share the same factory, port, region or raw-material source, creating hidden common-mode dependence.

4. Scenario analysis and stress testing

Scenario analysis explores plausible combinations of conditions rather than predicting a single future. Scenarios should be challenging, coherent and decision-relevant. Examples include:

• a six-week closure of a major port combined with carrier capacity reduction;
• a ransomware attack that makes the enterprise resource planning system unavailable;
• a drought that reduces a key material by 30% while energy prices rise;
• simultaneous failure of a critical supplier and its alternative supplier.

A scenario workshop normally defines assumptions, maps affected processes, estimates time-phased impacts, identifies decisions and tests available responses. A scenario is not a forecast. Its value lies in revealing vulnerabilities, triggers and options.

Stress testing pushes selected variables beyond normal experience. A useful exercise asks: What happens if demand increases by 40%, a supplier lead time doubles, or data recovery takes 72 hours? Sensitivity analysis then identifies which assumptions most affect service, cost or cash flow.

Business-impact analysis

Business-impact analysis (BIA) ranks activities according to the consequences of interruption. It identifies dependencies, minimum acceptable service, MTPD, RTO, RPO, staffing, facilities, technology, suppliers and information requirements. The MTPD should not be confused with the RTO: the RTO is a target chosen within the maximum tolerable period.

For example, if customer-order processing has an MTPD of 48 hours, an RTO of 24 hours may be established to provide recovery margin. If the system’s RPO is four hours, backups must allow restoration with no more than four hours of transaction data loss, subject to the organisation’s technical design.

5. Risk treatment and resilience design

Risk treatment should be proportionate to risk appetite, legal obligations, customer commitments and cost. The principal choices are:

Treatment should address both likelihood and consequence. Preventive controls act before an event; detective controls identify deterioration; corrective and recovery controls limit consequences after the event.

Resilience capabilities

Visibility and sensing. Organisations need reliable information about inventory, orders, transport status, supplier capacity, financial health, geopolitical exposure and environmental conditions. Visibility should be risk-based: deeper-tier visibility is most valuable for critical and concentrated dependencies.

Redundancy. Multiple suppliers, alternative facilities, spare equipment and safety stock provide options. Redundancy has carrying cost and may reduce economies of scale. It also fails if alternatives are exposed to the same disruption.

Flexibility. Flexible manufacturing, modular product design, interchangeable materials, cross-trained employees and adaptable transport contracts permit substitution. Flexibility is often more valuable than static excess capacity because it supports several disruption types.

Collaboration. Joint contingency plans, shared forecasts, escalation contacts and supplier-development programmes improve response. Collaboration must be supported by appropriate confidentiality, competition-law and data-governance controls.

Financial resilience. Liquidity, realistic payment terms and balanced commercial relationships reduce the chance that a viable supplier fails because of temporary cash pressure. Aggressive cost reduction can transfer risk into the network.

Recovery learning. After incidents, organisations should conduct blameless reviews, identify control weaknesses, update playbooks and verify that corrective actions have owners and deadlines.

Inventory and time-to-survive

Inventory can buffer a disruption, but its value depends on demand, lead time, substitution and shelf life. For a simple deterministic case with constant daily demand d and usable inventory Q, the inventory-only survival time is:

T is survival time in days, Q is usable units and d is average daily demand in units per day. The formula assumes no replenishment, constant demand, no deterioration and complete usability. If Q = 12,000 units and d = 800 units per day, T = 15 days. In practice, safety stock, rationing, demand changes and inventory accuracy must be included.

A more complete decision compares the cost of resilience with avoided disruption loss. It should include holding cost, obsolescence, qualification cost, supplier-development cost, emergency freight, lost margin and customer consequences. The cheapest normal-state supply chain is not necessarily the lowest total-cost supply chain.

6. Business continuity, crisis response and recovery

A continuity management system should connect governance, risk assessment, BIA, plans, training, exercises, incident management and continual improvement. Plans should be usable under pressure rather than lengthy documents that no one can execute.

Continuity architecture

A practical continuity structure includes:

1. Crisis leadership: Sets priorities, approves exceptional decisions and communicates with stakeholders.
2. Incident management: Confirms facts, coordinates actions and maintains an incident log.
3. Operations teams: Protect people, maintain critical flows and activate alternatives.
4. Technology recovery: Restores systems, connectivity, data and cyber controls.
5. Supplier and logistics coordination: Confirms capacity, reroutes flows and manages scarce resources.
6. Communications: Provides accurate, timely and appropriately confidential information.
7. Recovery and improvement: Returns to stable operations and captures learning.

The first priority is protection of life and safety. This is followed by legal and regulatory obligations, critical customer and public-service commitments, preservation of assets and financial recovery. Plans should define authority because ambiguity causes delay.

Response stages

Preparedness includes mapping, risk treatment, training, exercises, contracts, backups and pre-approved alternatives.

Alert and assessment confirms the event, estimates scope, protects people and activates the appropriate level of response.

Stabilisation prevents further harm, preserves critical operations and establishes a reliable information rhythm.

Continuity operations use manual workarounds, alternative suppliers, alternate sites, prioritised customers or rationed inventory.

Recovery and transition restores systems and capacity, resolves backlog, validates quality and decides whether to return to the original design or adopt a better configuration.

Exercises should include discussion-based tabletop exercises, technical recovery tests and operational simulations. A plan that has never been exercised is an untested hypothesis.

7. Cyber, technology and artificial intelligence

Cyber risk is a supply chain risk because suppliers, carriers, platforms and customers share systems and credentials. Important controls include asset inventories, least-privilege access, multifactor authentication, network segmentation, secure backups, patch management, supplier security requirements, incident reporting and tested restoration. Cybersecurity is not only an information-technology issue: a compromised scheduling system can create physical shortages, unsafe shipments or fraudulent payments.

Digital twins, control towers, internet-of-things sensors and analytics can improve early warning, but they also create additional attack surfaces and data dependencies. Artificial intelligence can support anomaly detection, supplier monitoring, scenario generation and prioritisation. It should not be treated as an autonomous source of truth. Models may amplify biased data, generate false alerts, miss novel events or expose confidential information. Human accountability, model validation, access controls and documented escalation remain essential.

8. Governance, ethics and regulation

Risk ownership should sit with managers who can influence the exposure, while senior leadership sets appetite, allocates resources and challenges optimistic assumptions. The board or equivalent governing body should receive information about critical dependencies, residual risk, major scenarios, exercise results and overdue treatments.

Ethical supply chain resilience includes worker safety, responsible purchasing, fair treatment of suppliers, human rights due diligence and environmental stewardship. A continuity strategy that protects customer delivery by forcing unsafe work or transferring unreasonable risk to small suppliers is not responsible resilience. Modern slavery, forced labour, unsafe conditions and environmental damage can create both moral harm and operational disruption.

Contracts should define service expectations, notification duties, data protection, audit rights, continuity obligations, subcontracting, recovery priorities and termination or transition assistance. Legal review is important because information sharing, sanctions, export controls, competition law, privacy law and sector-specific regulation may constrain response options.

9. Illustrative case: Northstar Medical Devices

Background

Northstar Medical Devices is an illustrative manufacturer of sterile diagnostic cartridges. It sources a specialised polymer from Supplier A in one country and uses a contract sterilisation facility near a major port. Northstar holds 18 days of finished-goods inventory and has no approved alternative polymer because qualification requires six months.

Problem

A severe storm closes the port, while a ransomware incident makes Northstar’s planning system unavailable. At the same time, Supplier A reports that its own electricity supply is unstable. The combined event threatens production, order visibility and customer communication.

Analysis

The risk register identifies three linked exposures: geographic concentration, single-source material dependency and system vulnerability. The BIA classifies hospital orders as critical, with an MTPD of seven days. The current inventory survival estimate is 18 days under normal demand, but rationing and quality checks may reduce usable coverage. The storm and cyberattack are correlated operationally because both affect information and physical flows, so treating them as separate low-probability events would be misleading.

Response and solution

The crisis team first confirms employee safety and isolates affected technology. It activates tested offline order records and establishes a manual priority-allocation process for critical hospitals. Inventory is allocated according to clinical urgency rather than commercial margin. Logistics staff identify an alternative airport route and a second sterilisation provider, subject to regulatory approval. Supplier A provides daily capacity updates through a secure channel.

Northstar informs customers honestly about allocation rules and expected service. It does not promise quantities that cannot be supported. Cyber specialists restore clean systems from a tested backup, validate master data and reconnect suppliers gradually. Quality and regulatory teams approve any temporary process before shipment.

After stabilisation, Northstar qualifies a second polymer source, introduces geographic diversity in sterilisation, increases offline operating capability and revises its supplier-continuity clauses. It also changes its exercise programme to include simultaneous cyber and physical disruption.

Outcome and learning points

Northstar avoids a complete stockout, although non-critical orders are delayed. The case demonstrates that resilience depends on prioritisation, usable information, pre-approved alternatives, regulatory discipline and ethical allocation—not simply on holding more inventory. It also shows why continuity planning must test compound events and why cyber recovery must be integrated with physical operations.

10. Measurement and continuous improvement

Useful indicators should measure both exposure and capability. Examples include the percentage of critical suppliers with validated continuity plans, time to detect an incident, time to activate an alternative, recovery time achieved versus RTO, inventory accuracy, concentration by region, backup restoration success, overdue treatments and exercise findings closed on time.

A resilience dashboard should avoid vanity metrics. “Number of suppliers” is less informative than the number of independently viable sources for a critical input. “Backup completed” is less informative than successful restoration within the required RPO. Metrics should have definitions, owners, data sources, reporting frequency and thresholds that trigger action.

Post-incident reviews should distinguish immediate cause, contributing conditions and systemic weaknesses. Blaming an individual for following an ambiguous process prevents learning. Corrective actions should be prioritised, funded and verified. The Plan–Do–Check–Act cycle is useful: plan controls, implement them, test performance and improve based on evidence.

Challenges and limitations

Risk assessment is limited by incomplete data, changing conditions and cognitive bias. Managers may underestimate rare events, anchor on recent experience, confuse confidence with accuracy or avoid reporting bad news. Risk matrices can create false precision, and expected-value calculations can undervalue catastrophic outcomes. Supplier self-assessments may be optimistic, while deeper-tier information can be difficult to obtain.

Resilience also has trade-offs. Redundancy can increase cost and emissions; regionalisation may reduce geopolitical exposure while increasing unit cost; stockpiling can create obsolescence; monitoring can threaten privacy; and aggressive transparency can reveal commercially sensitive information. Resilience decisions should therefore be evaluated across cost, service, safety, environmental and social dimensions.

Finally, no plan remains valid indefinitely. Network changes, mergers, new regulations, emerging pathogens, climate conditions and technology changes require periodic review. The quality of resilience is demonstrated not by the existence of a document but by the organisation’s ability to make sound decisions under pressure.

Best-practice implementation sequence

An organisation beginning or strengthening its programme can proceed as follows:

1. Establish executive sponsorship, risk appetite and clear ownership.
2. Map critical products, processes, suppliers, routes, systems and dependencies.
3. Conduct a BIA and define MTPD, RTO, RPO and minimum service levels.
4. Identify and assess risks using workshops, data, audits and scenario analysis.
5. Prioritise single points of failure and correlated concentrations.
6. Select treatments using cost, consequence, feasibility and stakeholder impact.
7. Build continuity plans, contracts, alternatives, buffers and recovery procedures.
8. Train personnel and exercise compound scenarios.
9. Monitor leading indicators and maintain current contact and dependency data.
10. Review incidents, tests and environmental changes to improve the system.

Chapter Summary

Supply chain risk management addresses uncertainty that may prevent achievement of service, cost, quality, safety, compliance and sustainability objectives. Effective analysis distinguishes hazards, exposure, vulnerability, disruption and consequence, and recognises that risks can cascade across interconnected networks. Risk registers, risk maps, FMEA, expected-loss analysis, concentration measures, scenario analysis and business-impact analysis provide complementary perspectives rather than a single perfect answer.

Risk treatment includes avoidance, reduction, transfer, acceptance and, in some circumstances, exploitation. Resilience is developed through visibility, diversification, redundancy, flexibility, collaboration, financial strength, skilled people and learning. Business continuity converts these capabilities into prioritised procedures for preparedness, response, stabilisation, continuity operations and recovery. Cybersecurity, climate adaptation, ethical sourcing and regulatory governance must be integrated because physical, digital and social risks increasingly interact.

The central managerial lesson is that resilience is a strategic investment. It requires balancing efficiency with options, using credible information without false precision, testing plans under compound scenarios and making responsible decisions that protect people and essential stakeholders.

Key Terms

Risk: The effect of uncertainty on objectives.

Disruption: An event that interrupts or materially degrades supply chain operations.

Vulnerability: The susceptibility of an exposed asset, process or network to harm.

Resilience: The capability to prepare for, absorb, adapt to and recover from disruption.

Business continuity: The capability to maintain critical operations at acceptable predefined levels during disruption.

Recovery time objective (RTO): The target time for restoring an activity or service.

Recovery point objective (RPO): The maximum tolerable period of data loss.

Maximum tolerable period of disruption (MTPD): The longest acceptable interruption before consequences become intolerable.

Time to survive (TTS): The period a supply chain can operate before disruption causes unacceptable failure.

Risk register: A controlled record of identified risks, controls, owners, treatments and reviews.

Risk appetite: The level and type of risk an organisation is willing to pursue or retain.

Residual risk: Risk remaining after controls and treatments are applied.

Single point of failure: A dependency whose loss can interrupt the system because no viable substitute exists.

Scenario analysis: Examination of plausible future conditions and their effects on decisions or performance.

Stress testing: Deliberate examination of system performance under severe assumptions.

Business-impact analysis: Assessment of the consequences, priorities and resource requirements associated with interruption.

Redundancy: The availability of additional capacity, sources or components that can substitute for failed resources.

Concentration risk: Exposure created by excessive dependence on one supplier, region, route, technology or resource.

Bow-tie model: A framework linking causes and preventive controls to an event, consequences and mitigating controls.

Control tower: An integrated capability for monitoring, analysing and coordinating supply chain flows and exceptions.

Review Questions

Short Answer Questions

1. Distinguish between a hazard, vulnerability, disruption and impact.
2. Why is resilience broader than redundancy?
3. What information should a supply chain risk register contain?
4. Define RTO, RPO and MTPD.
5. Why should compound scenarios be included in continuity exercises?

Long Answer Questions

1. Explain how operational, supplier, geopolitical, cyber and climate risks can interact in a global supply chain.
2. Discuss the advantages and limitations of qualitative risk matrices and expected-loss analysis.
3. Evaluate the principal resilience capabilities of visibility, redundancy, flexibility and collaboration.
4. Describe how a business-impact analysis should inform continuity and recovery planning.
5. Discuss the ethical and governance responsibilities involved in supply chain resilience.

Analytical / Application Questions

1. A company depends on one supplier for 70% of a critical component and two suppliers for the remaining 30%. Identify the likely vulnerabilities, propose a risk assessment approach and recommend treatments.
2. A distribution centre has 12,000 usable units and average daily demand of 800 units. Calculate its inventory-only survival time using T = Q ÷ d, state the assumptions and explain why actual survival may differ.
3. Design a tabletop exercise for a simultaneous ransomware attack and port closure. Specify the critical decisions, information requirements, stakeholders, continuity measures and post-exercise improvements.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from redundancy?

A. Resilience concerns only holding extra inventory.

B. Resilience includes preparation, absorption, adaptation and recovery, while redundancy is one possible capability.

C. Redundancy eliminates all supply chain risk.

D. Resilience applies only to information technology.

Correct Answer: B. Resilience includes preparation, absorption, adaptation and recovery, while redundancy is one possible capability.

Question 2

A risk has a likelihood rating of 4 and an impact rating of 5 on defined five-point ordinal scales. Using R = L × I, what is its screening score?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 3

What is the primary purpose of a business-impact analysis?

A. To calculate supplier market share

B. To identify interruption consequences, priorities and resource requirements

C. To replace all continuity exercises

D. To determine employee salaries

Correct Answer: B. To identify interruption consequences, priorities and resource requirements

Question 4

Which treatment stops an activity or dependency because its exposure is unacceptable?

A. Acceptance

B. Transfer

C. Avoidance

D. Exploitation

Correct Answer: C. Avoidance

Question 5

If usable inventory is 12,000 units and daily demand is 800 units, what is inventory-only survival time under the stated simple assumptions?

A. 8 days

B. 12 days

C. 15 days

D. 20 days

Correct Answer: C. 15 days

Question 6

What does RPO primarily measure?

A. The target time to restore a process

B. The maximum tolerable period of data loss

C. The number of alternative suppliers

D. The maximum inventory holding cost

Correct Answer: B. The maximum tolerable period of data loss

Question 7

Why can a supplier-count metric give a misleading impression of resilience?

A. All suppliers always have identical costs.

B. Multiple suppliers may share the same factory, region or upstream source.

C. Supplier counts cannot be recorded.

D. More suppliers always reduce flexibility.

Correct Answer: B. Multiple suppliers may share the same factory, region or upstream source.

Question 8

Which is an example of a preventive control in the bow-tie model?

A. Post-incident customer compensation

B. Emergency product allocation after a stockout

C. Supplier qualification and cyber-access controls before an incident

D. Recovery of a damaged warehouse

Correct Answer: C. Supplier qualification and cyber-access controls before an incident

Question 9

Why should expected loss not be used as the sole basis for risk decisions?

A. It cannot use monetary values.

B. It always overstates rare events.

C. It may conceal extreme downside and depends on credible probability estimates.

D. It is applicable only to cyber risks.

Correct Answer: C. It may conceal extreme downside and depends on credible probability estimates.

Question 10

Which action best demonstrates responsible resilience governance?

A. Hiding disruption information from affected customers

B. Prioritising critical medical orders using transparent, safety-based criteria

C. Transferring all continuity costs to small suppliers

D. Using an untested AI forecast as the sole crisis decision-maker

Correct Answer: B. Prioritising critical medical orders using transparent, safety-based criteria