Global Procurement Risk and Resilience

Introduction and strategic context

Global procurement creates access to lower costs, specialized capabilities, innovation and geographically diverse supply. It also exposes the firm to disruptions that may originate far beyond the buying organization: port closures, sanctions, cyberattacks, insolvency, extreme weather, labour disputes, corruption, regulatory changes and geopolitical conflict. The strategic procurement question is therefore not simply “Which supplier offers the lowest price?” but “Which supply network delivers acceptable total value and resilience under plausible disruption?”

Procurement risk is the possibility that an event or condition will prevent purchasing objectives from being achieved. Those objectives include continuity, cost, quality, delivery, compliance, sustainability, innovation and reputation. Resilience is the capability to anticipate, absorb, adapt to and recover from disruption while maintaining critical performance. Resilience is not identical to redundancy. Inventory, multiple suppliers and spare capacity can absorb shocks, but resilience also depends on visibility, decision rights, substitution capability, collaboration and learning.

In international business, risk must be assessed at several levels:

• Supplier level: financial weakness, capacity, quality, labour practices and cyber maturity.
• Category and supply-network level: concentration, substitutability, tier-two and tier-three dependencies, logistics bottlenecks and common-mode exposure.
• Country and regional level: political instability, trade restrictions, infrastructure, climate hazards and legal institutions.
• Enterprise level: financial exposure, customer commitments, regulatory duties, brand value and recovery capability.

A mature procurement function connects risk analysis to sourcing decisions, contracts, inventory policy, supplier development, continuity planning and executive governance.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Classify operational, financial, cyber, compliance, climate, supplier and geopolitical procurement risks.
2. Quantify risk using heat maps, expected-loss analysis, FMEA, financial indicators and scenario methods.
3. Design proportionate due-diligence and traceability systems.
4. Evaluate multisourcing, inventory, substitution and contingency strategies.
5. Develop business-continuity and crisis-response arrangements.
6. Critically assess the trade-off between efficiency, resilience, cost and sustainability.

1. A systems view of procurement risk

A supply network is a set of interconnected firms, facilities, technologies, contracts, transport routes and information flows. Risk is often non-linear: a small disruption at a single-source supplier may stop an entire production line, while a larger disruption in a substitutable commodity may have little effect. Dependencies may also be hidden. A direct supplier can appear geographically diversified while buying the same semiconductor, chemical precursor or packaging material from one upstream source.

Risk analysis should distinguish four concepts:

• Hazard: a potential source of harm, such as flooding or fraud.
• Exposure: the extent to which the organization is connected to the hazard.
• Vulnerability: the likelihood that exposure will produce operational or financial damage.
• Impact: the consequence if the event occurs.

A useful conceptual relationship is:

This is a decision model rather than a natural law. It is most useful when likelihood and consequence are defined consistently and when risks are sufficiently independent for separate assessment. For correlated risks, such as a regional earthquake affecting several suppliers, aggregation requires scenario analysis rather than simple addition.

Risk taxonomy

The classification is analytical, not exclusive. A flood may cause an operational interruption, a financial loss, a compliance issue and a climate-related disclosure obligation simultaneously.

2. Risk identification, assessment and prioritization

The risk register

A risk register should record the risk statement, affected part or service, causes, controls, owner, indicators, likelihood, impact, response and review date. A well-formed statement uses the structure: “Because of [cause], [event] may occur, resulting in [effect].” This avoids vague entries such as “supplier risk.”

Identification methods include supplier workshops, process mapping, contract review, site audits, incident databases, external intelligence, transport mapping, bills of material, cyber assessments and interviews with engineering, finance, legal and operations. Mapping should extend beyond tier-one suppliers where critical inputs, minerals, data or regulatory obligations are involved.

Heat maps

A heat map usually plots likelihood against impact. An organization may score each from 1 to 5 and calculate an initial score:

Here, L_s is the likelihood score and I_s is the impact score for risk s. Both are ordinal ratings, not necessarily precise probabilities or monetary values. A score of 4 does not necessarily mean twice the risk of a score of 2. The scale definitions must be documented—for example, likelihood may refer to an estimated event frequency over twelve months, while impact may combine downtime, financial loss, safety and regulatory harm.

Controls reduce either likelihood, impact or both. Residual risk should be scored after considering prevention, detection, response and recovery controls. Heat maps are effective for communication and prioritization but can conceal uncertainty, interdependence and the difference between a rare catastrophic event and a frequent minor event.

Expected loss and risk appetite

Where probability and monetary impact can be estimated, expected loss is more informative:

EL is expected loss per assessment period, p_i is the probability of scenario i, C_i is its monetary consequence, and n is the number of mutually exclusive scenarios. Probabilities should refer to the same period and scenarios should not overlap. Expected loss is an average decision metric; it does not describe worst-case exposure. Therefore, stress scenarios, maximum foreseeable loss and recovery time must also be considered.

If a disruption has a 10% annual probability and an estimated consequence of $2 million, its annual expected loss is:

The calculation does not imply that the firm will lose $200,000 every year. It is a long-run average used alongside risk appetite, cash-flow capacity and strategic considerations.

3. Failure Mode and Effects Analysis in procurement

FMEA is a structured technique for examining how a process, component or supplier can fail. For each failure mode, the team assesses:

• Severity (S): consequence if failure occurs.
• Occurrence (O): likelihood or frequency of the cause.
• Detection (D): likelihood that existing controls will fail to detect the problem before harm occurs.

The traditional risk priority number is:

Scores commonly range from 1 to 10, with higher detection scores indicating poorer detectability. The method assumes that the scales are defined consistently and that multiplication is being used as a prioritization convention, not as a statistically validated probability model. A high-severity failure should not be ignored merely because its RPN is moderate; teams should review severity separately.

Worked procurement example

Suppose a single-source battery-cell supplier is assessed as follows: S = 9, O = 4, and D = 7. Then:

The response might include qualification of a second source, incoming electrical testing, supplier capacity verification and a contractual notification requirement. After controls, the scores are estimated as S = 9, O = 2, and D = 3:

Severity remains high because the consequence has not changed; likelihood and detectability have improved. The team should still maintain a contingency plan because a catastrophic single-source failure remains possible.

4. Financial and supplier-health analysis

A procurement team should not rely on a credit score alone. Financial due diligence combines audited statements, management information, payment behaviour, ownership, litigation, customer concentration, debt maturity, insurance and the supplier’s access to liquidity.

Important indicators include:

The current ratio indicates short-term balance-sheet coverage but may be distorted by obsolete inventory or uncollectible receivables. Debt-to-equity indicates leverage, but comparisons require awareness of industry accounting and lease treatment. Interest coverage indicates the buffer available to meet financing costs; a low or declining value can signal distress. EBIT means earnings before interest and tax.

Cash conversion is also relevant. A supplier may report profit while experiencing cash pressure because customers pay slowly, inventory is excessive or capital expenditure is high. Procurement should monitor overdue statutory filings, sudden requests for advance payment, reduced insurance, staff departures, delayed deliveries and unusual quality deterioration. Information must be obtained lawfully and handled confidentially.

Supplier financial analysis is not a prediction machine. Ratios are backward-looking, accounting policies differ, private-company data may be incomplete, and a financially healthy supplier can still fail because of a cyberattack or natural hazard.

5. Scenario analysis and stress testing

Scenario analysis asks how the network performs under coherent combinations of events. Examples include:

1. A six-week closure of a major port combined with a 20% freight-price increase.
2. A sudden export restriction on a critical mineral.
3. A ransomware attack that disables supplier scheduling for ten days.
4. A flood that closes a supplier site and affects its common raw-material source.
5. A sanctions change that makes a previously legal transaction impermissible.

A scenario should specify assumptions, time horizon, affected nodes, available responses and performance measures. Useful measures include days of supply, service level, time to detect, time to recover, lost contribution margin and cash requirement.

A basic inventory measure is:

The numerator should exclude obsolete, quarantined or unusable stock. Demand should be measured over a stated period and adjusted for seasonality where relevant. If usable inventory is 12,000 units and average daily demand is 800 units, days of supply are 15 days. This is not necessarily the recovery time: demand may rise, replenishment may be delayed, or inventory may be allocated among products.

Scenario analysis should test decision triggers. For example, a company may activate emergency sourcing when confirmed recovery time exceeds remaining days of supply, or when a country risk event changes the legal status of a transaction. Triggers need named owners, delegated authority and pre-approved communication protocols.

6. Due diligence, traceability and responsible procurement

Risk-based due diligence

Due diligence is a continuing process, not a one-time questionnaire. Its intensity should reflect the severity and likelihood of potential harm. A risk-based process normally includes:

1. Supplier identity, ownership and beneficial-owner verification.
2. Screening for sanctions, politically exposed persons, corruption and conflicts of interest.
3. Verification of licenses, certifications, insurance and capacity.
4. Assessment of labour, health, safety, environmental and human-rights practices.
5. Cybersecurity and data-protection review proportional to access and criticality.
6. Sub-tier mapping for critical materials, components and services.
7. Contractual obligations, audit rights, notification duties and remediation plans.
8. Ongoing monitoring using performance data and credible external information.

Self-assessment is useful but insufficient for high-risk categories. Evidence may include payroll records, worker interviews, permits, production records, chain-of-custody documents and independent audits. Audits also have limitations: they are periodic, may be announced, can create superficial compliance and may fail to detect retaliation or falsification.

Traceability

Traceability is the ability to follow the history, location, transformation and ownership of a product, material or data record. It may be:

• One step back: immediate source of supply.
• One step forward: immediate customer or use.
• Full chain traceability: relevant upstream and downstream stages.

The appropriate level depends on product criticality, law, human-rights exposure, recall risk and customer requirements. Digital tools such as supplier portals, serialization, secure data exchange, geospatial monitoring and distributed ledgers may support traceability, but technology cannot compensate for inaccurate source data or weak governance. “Garbage in, garbage out” remains a central control principle.

7. Designing resilience responses

Resilience design begins with criticality analysis. A critical input has high business consequence, limited substitutability, long replenishment time, high qualification cost or significant safety and regulatory implications. Responses should address the specific failure mechanism rather than applying redundancy indiscriminately.

Multisourcing and segmentation

Multisourcing can reduce dependence on one supplier, country or facility. It is most valuable when suppliers are genuinely independent. Two suppliers that share the same sub-tier producer or transport corridor do not provide full diversification. Allocation may be split by volume, geography, product family or customer segment. Qualification, tooling, minimum order quantities and loss of scale create costs; therefore, the incremental resilience benefit should be compared with its total cost.

A practical segmentation matrix considers supply risk and business impact. Strategic items require collaboration, executive oversight and continuity planning. Leverage items may be competitively sourced. Bottleneck items require substitution, inventory or supplier development. Routine items should be automated and governed efficiently. Segmentation is dynamic: a routine item can become strategic during a shortage or regulatory change.

Inventory and capacity buffers

Safety stock protects against demand and replenishment uncertainty. Under simplified assumptions of independent, approximately normally distributed demand during lead time and a specified service target, a common model is:

SS is safety stock in units, z is the standard-normal service factor, and σ_DLT is the standard deviation of demand during lead time. If daily demand and lead time are independent, with daily demand standard deviation σ_d, mean daily demand \bar d, and lead-time standard deviation σ_L, then:

Here \bar L is mean lead time in days. The formula assumes demand observations are independent across days and demand and lead time are independent. If they are correlated, the covariance term must be included; if demand is intermittent or highly skewed, simulation or a different distribution may be more appropriate.

Buffers can also be financial, contractual, technological or organizational. Examples include reserved production capacity, alternate tooling, emergency freight agreements, reciprocal stock arrangements and trained backup personnel.

Substitution and postponement

Engineering standardization, modular design and approved substitutes reduce recovery time. Postponement delays final customization until demand and supply conditions are clearer. These approaches require early cooperation between procurement, engineering, operations, quality and marketing.

Contracts and commercial mechanisms

Contracts should address service levels, quality, force majeure, allocation during shortages, audit rights, cyber obligations, data protection, sanctions compliance, change control, business continuity, subcontracting, termination assistance and recovery priorities. A contract cannot create physical capacity that does not exist. Clauses are effective only when responsibilities, evidence, remedies and escalation paths are clear.

8. Business continuity and crisis management

Business continuity planning translates risk analysis into action. A plan should identify critical processes, maximum tolerable period of disruption, recovery time objective and recovery point objective. The recovery time objective is the targeted time to restore a process. The recovery point objective is the maximum acceptable loss of data measured in time. These terms are especially relevant to procurement systems and supplier data.

A robust plan includes:

• incident detection and validated contact lists;
• crisis roles and decision rights;
• alternate suppliers, routes, sites and payment procedures;
• inventory allocation rules;
• manual workarounds for system outages;
• customer, regulator and employee communications;
• cyber isolation and recovery procedures;
• testing, lessons learned and plan maintenance.

Procurement should participate in enterprise exercises rather than maintain a document that is never tested. Tabletop exercises reveal ambiguity over who can approve premium freight, release confidential specifications, switch suppliers or communicate a suspected human-rights incident.

9. Cyber, climate and geopolitical risk

Cyber risk is a supply-chain risk because suppliers connect to ordering, forecasting, product-development, payment and logistics systems. Controls include least-privilege access, multifactor authentication, network segmentation, secure software practices, backups, incident notification and recovery testing. Supplier cyber requirements should be proportional: a packaging vendor receiving no sensitive data does not require the same controls as a cloud provider or design partner.

Climate analysis should distinguish acute hazards, such as floods and wildfires, from chronic changes, such as heat stress, water scarcity and sea-level rise. Site-level exposure mapping should be combined with supplier capacity, insurance, utilities and transport analysis. Adaptation may include relocation, flood protection, water recycling, alternative materials and seasonal inventory. Climate-related actions should not shift environmental or social harm to weaker communities.

Geopolitical analysis covers sanctions, export controls, tariffs, political violence, diplomatic restrictions, industrial policy and strategic competition. Compliance screening must occur at transaction time because ownership, destination and legal rules can change. Procurement must never treat commercial urgency as a justification for bypassing sanctions, customs or anti-bribery controls.

10. Governance, ethics and technology

Effective risk governance assigns accountability to business owners while preserving independent challenge from risk, legal, compliance, finance and internal audit. A three-line model is useful: operating teams own and manage risks; risk and compliance functions set standards and monitor; internal audit provides independent assurance.

Ethical procurement extends beyond legal compliance. Low prices may reflect forced labour, unsafe conditions, environmental destruction or coercive purchasing practices. Buyers should avoid unrealistic lead times, abusive payment terms and sudden order cancellations that transfer unreasonable risk to vulnerable suppliers. Remediation is often preferable to immediate disengagement when continued engagement can improve conditions and does not expose people to unacceptable harm.

Artificial intelligence can support anomaly detection, adverse-media review, demand-risk forecasting, contract analysis and network mapping. However, AI outputs may reproduce biased data, confuse allegations with facts, expose confidential information or generate false confidence. Human review, explainable evidence, access controls, validation and appeal mechanisms are essential. AI should prioritize investigation, not autonomously make irreversible supplier or sanctions decisions without accountable oversight.

11. Integrated performance measurement

Resilience should be measured with both leading and lagging indicators. Leading indicators include supplier financial deterioration, overdue corrective actions, cyber-control gaps, concentration ratios, forecast volatility, climate exposure and declining capacity confirmation. Lagging indicators include stockouts, downtime, recovery duration, quality escapes, premium freight, customer penalties and realized loss.

Useful dashboard questions include:

• What percentage of critical spend has verified sub-tier visibility?
• How many critical items have a qualified alternate source?
• What is the concentration of spend and physical capacity by country?
• How quickly can a supplier detect and report a cyber incident?
• How many continuity plans were tested and improved during the period?
• What is the cost of resilience relative to avoided or reduced exposure?

Metrics must not create perverse incentives. A buyer rewarded only for annual price reduction may increase single-source dependence. Balanced scorecards should include continuity, compliance, quality, sustainability and total cost.

Applied case: Meridian Medical Devices (illustrative)

Background

Meridian Medical Devices, a fictional multinational manufacturer, purchased a sterilization component from one supplier in a coastal industrial zone. The component represented only 1.5% of product cost but was required for regulatory approval, had a four-month qualification process and no immediately approved substitute. The supplier also depended on a single upstream resin producer.

Problem

A climate assessment identified flood exposure, while finance noted rising leverage and late deliveries. A geopolitical review showed that the supplier’s country could face export controls on a related chemical. Meridian’s initial heat map rated the item “medium” because annual spend was low. This understated business impact.

Analysis

The cross-functional team revised the assessment. Severity was scored 10 because a prolonged shortage could stop production of a regulated product. Occurrence was scored 4 for a major disruption, and detection was scored 8 because Meridian had limited sub-tier visibility. The initial FMEA priority number was:

Scenario analysis showed that a six-week supplier closure would exhaust available inventory after 18 days. The expected annual loss from a major closure was estimated at $1.2 million, using a 12% annual probability. This gave:

The figure excluded reputational and patient-safety consequences, so it was not treated as the sole decision criterion.

Approach and solution

Meridian took five actions. First, it qualified a second supplier in another region and approved a technically equivalent resin. Second, it required the incumbent to disclose relevant sub-tier dependencies and notify Meridian of capacity, ownership or regulatory changes. Third, it increased usable inventory from 18 to 35 days while qualification was completed. Fourth, it contracted alternate logistics capacity and established a crisis escalation protocol. Fifth, it introduced quarterly financial, climate and cyber reviews.

The second source was more expensive, and holding inventory increased working capital. Nevertheless, the board accepted the cost because the item’s criticality, long recovery time and regulatory constraints made low purchase price an unreliable optimization target.

Outcome and learning points

After implementation, Meridian reduced expected recovery time, improved visibility and reduced dependence on the original site. The risk was not eliminated: both suppliers still relied on regional transport and regulatory approval remained a bottleneck. The case demonstrates that procurement risk is determined by business consequence and recovery difficulty, not by spend percentage alone. It also shows why sub-tier mapping, scenario analysis and qualification lead time must be integrated into sourcing strategy.

Challenges and limitations

Risk quantification is inherently uncertain. Historical data may be sparse, probabilities may be subjective, and impacts may be difficult to monetize. Heat maps can encourage false precision; FMEA scores can reflect group politics; financial ratios can lag reality; supplier declarations can be incomplete; and scenario sets can omit unprecedented events. Correlation and common-mode failure are particularly difficult. A diversified portfolio of suppliers may still fail together because of one port, energy system, cloud platform or raw-material source.

Resilience also has opportunity costs. Extra inventory increases obsolescence and emissions; multisourcing may reduce scale economies; supplier audits consume resources; and localization may raise prices or transfer environmental burdens. The correct objective is not maximum redundancy but economically, ethically and strategically appropriate resilience.

Best-practice design principles

1. Link every critical risk to an accountable owner and decision trigger.
2. Assess total exposure, including sub-tier, logistics, cyber and regulatory dependencies.
3. Separate probability, consequence and uncertainty rather than hiding them in one score.
4. Use heat maps for communication, FMEA for failure analysis and scenarios for systemic shocks.
5. Combine financial indicators with operational and qualitative evidence.
6. Treat traceability as an information-control process, not merely a software purchase.
7. Design alternate sources before a crisis, including qualification and tooling requirements.
8. Test continuity plans and record corrective actions.
9. Integrate human rights, climate and anti-corruption considerations into commercial decisions.
10. Review risk after major changes in product design, geography, ownership, regulation or technology.

Chapter Summary

Global procurement risk arises from interconnected operational, financial, cyber, compliance, climate, supplier and geopolitical conditions. Effective management begins with a structured risk register, clear taxonomy and understanding of hazard, exposure, vulnerability and impact. Heat maps support prioritization, expected-loss analysis supports economic comparison, FMEA identifies failure modes, financial indicators reveal supplier weakness, and scenario analysis tests systemic disruption.

Resilience requires more than holding inventory. It may involve multisourcing, sub-tier visibility, substitution, supplier development, contractual protections, cyber controls, climate adaptation, geopolitical monitoring and tested business-continuity procedures. Quantitative tools are useful but contain assumptions and should not create false precision. Governance, ethical conduct, responsible due diligence and accountable human judgment are essential. The strategic procurement professional balances efficiency with recovery capability, legal compliance, sustainability and long-term stakeholder value.

Key Terms

Business continuity: Capability to continue or restore critical operations after disruption.

Concentration risk: Exposure created by dependence on one supplier, country, facility, route or sub-tier source.

Due diligence: Ongoing investigation and management of supplier, legal, ethical, environmental and operational risks.

Expected loss: Probability-weighted average consequence across defined scenarios.

FMEA: Failure Mode and Effects Analysis, a structured method for prioritizing potential process or component failures.

Heat map: Visual display of risk ratings using likelihood and impact dimensions.

Impact: Consequence of a risk event for operations, finance, people, compliance or reputation.

Likelihood: Estimated chance or frequency of a risk event within a specified period.

Multisourcing: Use of two or more qualified supply sources to reduce dependence.

Residual risk: Risk remaining after controls and responses are applied.

Resilience: Ability to anticipate, absorb, adapt to and recover from disruption.

Risk appetite: Amount and type of risk an organization is willing to accept.

Risk register: Controlled record of risks, causes, effects, ratings, controls, owners and actions.

Safety stock: Inventory held to protect against demand or replenishment uncertainty.

Scenario analysis: Examination of performance under coherent hypothetical conditions.

Sub-tier supplier: Supplier that provides inputs to a direct or indirect supplier.

Traceability: Ability to follow a product, material, transaction or record through relevant stages.

Vulnerability: Degree to which exposure can produce harm when a hazard occurs.

Review Questions

Short Answer Questions

1. Distinguish hazard, exposure, vulnerability and impact in procurement risk analysis.
2. What are the three dimensions used in traditional FMEA scoring?
3. Why can two suppliers fail to provide genuine diversification?
4. State two limitations of financial ratios in supplier-risk assessment.
5. What is the difference between a recovery time objective and a recovery point objective?

Long Answer Questions

1. Explain how a multinational organization should construct and govern a procurement risk register.
2. Compare heat maps, expected-loss analysis, FMEA and scenario analysis, including the strengths and limitations of each.
3. Discuss how due diligence and traceability can address human-rights, compliance and reputational risks.
4. Evaluate the strategic trade-offs among multisourcing, safety stock, substitution and supplier development.
5. Explain how climate, cyber and geopolitical risks should be integrated into business-continuity planning.

Analytical / Application Questions

1. A component has a 15% annual probability of a disruption costing $800,000. Calculate expected annual loss and explain why the result should not be treated as a guaranteed annual cost.
2. A supplier failure mode has severity 8, occurrence 6 and detection 5. Calculate its FMEA RPN, then propose two controls and explain which score each control should influence.
3. Design a response for a single-source medical component with a 90-day qualification period, 25 days of usable inventory, high regulatory impact and a financially weakening supplier. Justify the sequence of actions.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from redundancy?

A. Resilience is limited to holding extra inventory.

B. Resilience includes the ability to anticipate, absorb, adapt to and recover from disruption.

C. Redundancy eliminates all supply-chain risk.

D. Resilience applies only to cybersecurity.

Correct Answer: B. Resilience includes the ability to anticipate, absorb, adapt to and recover from disruption.

Question 2

A risk has a likelihood score of 4 and an impact score of 5. Using the chapter’s heat-map scoring convention, what is its score?

A. 1

B. 9

C. 20

D. 45

Correct Answer: C. 20

Question 3

A disruption has a 10% annual probability and a consequence of $2,000,000. What is its expected annual loss?

A. $20,000

B. $100,000

C. $200,000

D. $2,000,000

Correct Answer: C. $200,000

Question 4

In traditional FMEA, a higher detection score generally indicates:

A. A more severe consequence

B. A higher probability of occurrence

C. A lower likelihood that controls will detect the failure

D. A lower cost of prevention

Correct Answer: C. A lower likelihood that controls will detect the failure

Question 5

If FMEA scores are S = 9, O = 4 and D = 7, what is the RPN?

A. 20

B. 63

C. 252

D. 320

Correct Answer: C. 252

Question 6

Which condition most directly indicates concentration risk?

A. Purchasing routine stationery from several local vendors

B. Using two suppliers that share the same upstream producer

C. Reducing the number of purchase orders through automation

D. Negotiating a lower price for a standard item

Correct Answer: B. Using two suppliers that share the same upstream producer

Question 7

Which item should be excluded from usable inventory when calculating days of supply?

A. Inventory available for production

B. Inventory already allocated to confirmed demand

C. Quarantined inventory that cannot be used

D. Inventory stored at an approved warehouse

Correct Answer: C. Quarantined inventory that cannot be used

Question 8

Which is an appropriate use of AI in procurement-risk management?

A. Automatically imposing sanctions without human review

B. Replacing all supplier audits with generated summaries

C. Supporting anomaly detection while retaining accountable human oversight

D. Publishing confidential supplier data for transparency

Correct Answer: C. Supporting anomaly detection while retaining accountable human oversight

Question 9

Which financial indicator compares EBIT with interest expense?

A. Current ratio

B. Debt-to-equity ratio

C. Interest coverage

D. Inventory turnover

Correct Answer: C. Interest coverage

Question 10

Why is a low-spend component potentially a high procurement risk?

A. Low-spend components are always technologically complex

B. Spend percentage alone does not capture criticality, substitutability or recovery time

C. Low-spend components cannot be inspected

D. Low-spend components are exempt from regulation

Correct Answer: B. Spend percentage alone does not capture criticality, substitutability or recovery time