3. Risk and Resilience Theories, Standards and Frameworks

Introduction and Context

Global supply chains are exposed to disruptions that differ in cause, speed, duration and geographical reach. A supplier’s financial failure, a cyberattack on a logistics platform, a port closure, a quality recall, a geopolitical restriction or a flood may all interrupt the flow of materials and information. Yet disruption alone does not determine performance. The consequences depend on how the supply chain is designed, governed and prepared to respond.

Risk management is concerned with understanding uncertainty, selecting appropriate treatments and monitoring exposure. Resilience extends this concern by asking how a supply chain can absorb disturbance, continue critical operations, recover performance and adapt after the event. These ideas are related but not identical. Risk management often emphasizes anticipation and control; resilience emphasizes response capacity, recovery and renewal. Effective supply chain governance requires both.

This chapter examines the principal theories, standards and frameworks used to make these ideas actionable. ISO 31000 and COSO ERM provide governance and risk-management architectures. SCOR offers a process-oriented supply chain reference model. Business continuity standards focus on maintaining and recovering prioritized activities. Resource-based theory, transaction cost theory, high-reliability theory and dynamic capabilities explain why organizations differ in their ability to prevent and manage disruption. Their value lies not in using one framework in isolation, but in combining them for a particular supply chain decision.

Learning Objectives

After studying this chapter, students should be able to:

1. Distinguish supply chain risk, vulnerability, disruption, robustness, resilience and recovery.

2. Apply ISO 31000 and COSO ERM to supply chain risk governance.

3. Use SCOR and business continuity principles to examine processes and recovery priorities.

4. Explain how major organizational theories inform sourcing, coordination and resilience decisions.

5. Evaluate trade-offs among efficiency, redundancy, flexibility, visibility and control.

6. Design an integrated approach to a supply chain risk decision and assess its limitations.

Core Concepts: From Exposure to Resilience

Supply chain risk is the effect of uncertainty on supply chain objectives. Objectives may include cost, service, quality, safety, compliance, sustainability and continuity. Risk is not synonymous with probability. A low-probability event can be strategically important if its impact is severe and recovery is slow. Conversely, frequent minor variation may require operational controls rather than emergency planning.

Several concepts should be separated. Exposure describes the extent to which a supply chain is subject to a hazard. Vulnerability is the susceptibility of a node, process or network to harm. Disruption is an event that interrupts expected supply chain flows or performance. Robustness is the ability to withstand disturbance without significant change in performance. Resilience is the broader ability to absorb, respond, recover and adapt. Recovery time is the period required to restore an agreed level of operation, while recovery point concerns the acceptable amount of data, inventory or operational capability that may be lost.

Risk is also multidimensional. Operational risk may arise from forecasting, production, quality or transport failures. Strategic risk may result from excessive dependence on one geography, technology or supplier. Financial risk includes insolvency, foreign-exchange exposure and commodity-price volatility. Compliance, cyber, environmental and reputational risks increasingly overlap with conventional logistics risks. For example, a cyber incident may stop warehouse automation, breach personal data, delay shipments and create regulatory exposure at the same time.

A useful analytical distinction is between vulnerabilities created by the structure of a network and vulnerabilities created by its management. Concentrating purchases with one supplier may reduce unit cost but increase structural dependence. Poor data governance, delayed escalation or unclear authority may convert a manageable event into a major disruption. Resilience therefore cannot be purchased solely through more inventory. It is a design and governance capability.

ISO 31000: A General Architecture for Risk Management

ISO 31000 presents principles, a framework and a process for managing risk. It is not a certification standard and does not prescribe one universal risk appetite or one risk register format. Its central message is that risk management should be integrated, structured, inclusive, dynamic and tailored to the organization’s context.

The ISO 31000 process normally includes defining scope, context and criteria; identifying risks; analyzing and evaluating them; treating risks; communicating and consulting; monitoring and reviewing; and recording and reporting. In a supply chain, the context should include network structure, critical products, supplier markets, transport corridors, regulatory obligations, customer commitments and dependencies on information systems.

Risk identification should go beyond listing events. Managers should identify sources, causes, events, consequences and existing controls. A bow-tie analysis, for example, can connect causes of a port closure to preventive controls, the event itself, mitigating controls and consequences. Risk analysis may use qualitative scales, historical data, scenario analysis, simulation or financial models. Evaluation compares the analyzed risk with criteria such as risk appetite, service requirements or safety thresholds.

Treatment options include avoiding an activity, reducing likelihood, reducing consequences, sharing or transferring exposure, retaining the risk by informed decision, and exploiting beneficial uncertainty where relevant. In supply chains, treatment may involve dual sourcing, supplier development, insurance, contractual allocation, inventory positioning, alternative transport routes, cyber controls or product redesign. A treatment is not automatically effective because it is expensive. Its value depends on the reduction in exposure relative to cost and residual risk.

ISO 31000 is especially useful for establishing a common language across procurement, operations, finance, information technology and senior management. Its limitation is deliberate generality. It does not provide detailed supply chain process metrics, continuity procedures or a specific method for calculating resilience. Organizations must therefore connect it with operational and continuity frameworks.

COSO ERM and the Governance of Enterprise Risk

The COSO Enterprise Risk Management framework links risk with strategy, performance and governance. Its emphasis is not merely on protecting assets but on considering risk while setting objectives and making decisions. The framework is commonly organized around governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting.

For supply chain leaders, COSO ERM helps clarify accountability. The board and senior executives establish oversight and risk appetite. Business units own operational risks. Procurement, logistics, quality, cybersecurity and finance provide specialist challenge and assurance. Internal audit evaluates the effectiveness of governance and controls rather than owning operational risk.

COSO is valuable when a sourcing decision has enterprise-wide consequences. A low-cost offshore sourcing strategy may improve short-term margin while increasing geopolitical, continuity, working-capital and reputational risks. COSO encourages management to assess these effects against strategic objectives and performance targets. It also supports the use of key risk indicators, such as supplier financial stress, capacity utilization, lead-time volatility, cyber-control deficiencies and concentration ratios.

The distinction between risk appetite and risk capacity is important. Risk appetite is the type and amount of risk an organization is willing to pursue or retain. Risk capacity is the maximum risk it can absorb without threatening viability or critical obligations. A firm may have a low appetite for product-safety risk but a higher appetite for controlled delivery-time variability. Decisions should also recognize risk velocity: a rapidly developing cyberattack requires a different control and escalation mechanism from a slowly emerging capacity shortage.

COSO’s strength is strategic integration. Its limitation is that it can become compliance-oriented if risk registers and control reports are prepared without challenging assumptions or supporting decisions. A mature system connects governance information with actual procurement, inventory, routing and supplier-management choices.

SCOR as a Supply Chain Process Lens

The Supply Chain Operations Reference model, commonly known as SCOR, provides a process-oriented vocabulary for examining supply chain performance. Its traditional process categories include Plan, Source, Make, Deliver and Return; contemporary versions also recognize enabling activities and broader orchestration requirements. SCOR can be used to map processes, assign metrics, compare capabilities and identify where a disruption will affect performance.

SCOR is useful because risk is often hidden within process interfaces. A supplier may deliver on time, but inaccurate specifications may create defects at Make. A warehouse may have adequate stock, but poor Deliver processes may prevent customer service. Mapping Plan, Source, Make, Deliver and Return helps managers identify dependencies and control points rather than treating the supply chain as a single undifferentiated system.

SCOR metrics traditionally group performance into attributes such as reliability, responsiveness, agility, cost and asset management efficiency. These attributes expose trade-offs. A highly efficient network may have low inventory and low cost but weak agility. A resilient design may increase cost or assets while improving responsiveness and continuity. The correct decision depends on product criticality, customer requirements and the organization’s risk appetite.

SCOR does not itself constitute a risk-management standard. It should be combined with risk identification, scenario analysis and continuity planning. Its main contribution is operational translation: it converts abstract resilience objectives into processes, owners and performance measures.

Business Continuity Standards and Recovery Priorities

Business continuity management focuses on the ability to continue delivering products and services at an acceptable level during and after disruption. The ISO 22301 family provides a recognized management-system approach to business continuity. Its logic includes understanding organizational context, leadership, planning, support, operation, performance evaluation and continual improvement.

A central tool is business impact analysis. The analysis identifies critical activities, dependencies, maximum tolerable period of disruption, minimum acceptable service level and recovery requirements. In supply chains, it should examine not only internal activities but also key suppliers, logistics providers, utilities, technology platforms, data, people and facilities.

Continuity planning differs from emergency response. Emergency response protects life, assets and immediate control. Continuity planning determines how priority operations will be sustained. Recovery planning restores facilities, systems, suppliers and normal operating capacity. A plan should define decision rights, communication channels, alternate processes, escalation triggers and exercises. Plans that exist only as documents are weak; exercises reveal unrealistic assumptions, unavailable contacts and conflicts among departments.

Continuity standards encourage organizations to identify dependencies and test recovery capability. However, continuity planning can become excessively inward-looking. A firm may restore its own warehouse while a critical supplier, port or cloud provider remains unavailable. Supply chain continuity therefore requires coordinated planning, contractual visibility and mutual assistance across organizational boundaries.

Theoretical Foundations of Resilience Decisions

Resource-Based Theory

Resource-based theory argues that sustained advantage depends on valuable, rare, difficult-to-imitate and organizationally embedded resources and capabilities. In supply chain resilience, relevant resources include supplier knowledge, qualified alternate sources, inventory expertise, trusted logistics relationships, data quality, technical skills and crisis leadership.

The theory explains why two firms facing the same disruption may perform differently. One may possess the capability to qualify an alternate supplier rapidly, while another lacks technical approval capacity. Resilience is therefore not only a network property; it is also an organizational capability. Managers should invest in resources that are strategically important and difficult to replicate, rather than copying visible practices without developing the underlying competence.

A limitation is that resource-based analysis may understate external dependence and transaction costs. A firm can possess valuable capabilities yet remain vulnerable if a critical raw material is controlled by a concentrated market.

Transaction Cost Theory

Transaction cost theory examines the costs of using markets, contracts and organizational hierarchies. These costs include searching for suppliers, negotiating, monitoring performance, adapting contracts and resolving disputes. Asset specificity, uncertainty and frequency influence the choice between market purchasing, long-term contracting, partnerships and vertical integration.

In uncertain supply markets, a spot-market strategy may offer flexibility but expose the buyer to availability and price risk. A long-term contract may secure capacity but create rigidity or dependence. Vertical integration can improve control over critical activities but requires capital and may reduce access to specialized external expertise. The appropriate choice depends on the nature of the uncertainty and the cost of governing the relationship.

Transaction cost theory helps explain why resilience investments may involve closer collaboration rather than simply adding suppliers. A large supplier base can increase coordination and monitoring costs. The objective is not maximum fragmentation but an economically and strategically appropriate governance structure.

High-Reliability Theory

High-reliability theory studies organizations that operate in hazardous or complex environments while maintaining a low rate of catastrophic failure. Its lessons for supply chains include preoccupation with failure, reluctance to simplify, sensitivity to operations, commitment to resilience and deference to expertise.

Preoccupation with failure means treating small anomalies as possible signals rather than dismissing them. Sensitivity to operations requires awareness of actual conditions at warehouses, plants, ports and suppliers. Deference to expertise means that decision authority can move toward the person with the most relevant knowledge during an incident, even if that person is not the most senior manager.

These principles support near-miss reporting, cross-functional control rooms, escalation discipline and realistic drills. High-reliability practices are particularly relevant to pharmaceuticals, aerospace, energy, food safety and other sectors where a supply failure may threaten life or public welfare. Their limitation is that they can be resource-intensive and difficult to sustain in organizations that reward silence or short-term efficiency.

Dynamic Capabilities

Dynamic capabilities refer to the ability to sense changes, seize opportunities or responses, and transform resources and routines. In supply chain resilience, sensing may involve monitoring supplier signals, geopolitical developments, demand changes and cyber threats. Seizing may involve reallocating inventory, activating alternate capacity or changing transport modes. Transforming may involve redesigning the network, products, contracts or digital architecture after experience has revealed a weakness.

Dynamic capabilities emphasize that resilience is not a static asset. A contingency plan suitable for one market may become ineffective after a regulatory change or technological shift. Learning after disruptions, exercising scenarios and updating supplier qualification processes help embed adaptive capacity. The challenge is avoiding constant change that creates instability and excessive cost.

Integrating the Frameworks for Decision-Making

The frameworks answer different questions. ISO 31000 asks how risk should be identified, assessed, treated and reviewed. COSO ERM asks how risk should be connected with strategy, governance and performance. SCOR asks where processes and performance dependencies exist. Business continuity standards ask which activities are critical and how they will continue or recover. The theories explain why particular organizational designs and capabilities support resilience.

An integrated decision sequence can be applied to a critical sourcing decision:

1. Map the relevant SCOR processes and network dependencies.

2. Define objectives, context, risk criteria and risk appetite using ISO 31000 and COSO principles.

3. Identify scenarios, causes, consequences, existing controls and residual exposure.

4. Conduct a business impact analysis for critical products and activities.

5. Compare treatments such as redundancy, flexibility, collaboration, inventory, insurance, redesign or integration.

6. Evaluate governance and transaction costs, including monitoring and coordination burdens.

7. Test whether the organization possesses the resources and dynamic capabilities required to execute the treatment.

8. Establish indicators, escalation rules, exercises and review dates.

This sequence prevents a common error: selecting a visible solution before understanding the risk. For example, dual sourcing may reduce concentration but introduce quality variation, intellectual-property exposure and higher qualification costs. A strategic decision should compare total risk-adjusted value, not merely supplier count.

Illustrative Case: Resilience in a Medical-Device Supply Chain

Background

The following is an illustrative case. MedPro Instruments, a manufacturer of diagnostic devices, depends on a specialized molded component supplied by one approved producer. The component represents a small proportion of product cost but is essential to final assembly. Qualification requires testing, regulatory documentation and customer approval.

Situation and Problem

A severe regional power interruption forces the supplier to suspend production. MedPro has four weeks of component inventory, while qualification of a new source normally takes six months. The procurement team proposes immediate spot purchasing from an unapproved supplier. Quality and regulatory managers warn that unverified material could create safety and compliance failures.

Analysis

SCOR mapping shows that the vulnerability is located in Source but affects Make, Deliver and Return because defective components could create recalls. ISO 31000 analysis identifies interruption, quality failure and regulatory non-compliance as linked risks. The consequence of an unsafe component is substantially greater than the cost of temporary production delay. COSO analysis classifies the issue as a strategic and operational risk requiring executive oversight.

Business impact analysis identifies diagnostic-device production as a critical activity and establishes a minimum acceptable service level. Resource-based theory highlights MedPro’s limited internal qualification capacity. Transaction cost theory shows that a second supplier would require significant qualification and monitoring costs, but dependence on one supplier creates high adaptation costs during disruption. High-reliability principles support escalation of the weak signal—the supplier’s earlier reports of power instability—and deference to quality expertise. Dynamic capabilities require both immediate response and redesign of the sourcing model.

Approach and Solution

MedPro establishes a cross-functional incident team. It protects remaining inventory for priority customers, shares demand and technical data with the supplier, and arranges temporary power support where legally and operationally feasible. It does not bypass regulatory approval. Instead, it accelerates validation of a second source using a pre-agreed emergency qualification protocol. It also reviews component design, adds supplier business-continuity requirements, introduces power-disruption indicators and conducts a joint simulation.

For the longer term, MedPro adopts a segmented resilience policy. It holds strategic inventory for the component, qualifies a second source, and negotiates transparent capacity and notification clauses. It accepts a moderate increase in cost because the component’s criticality and long recovery time justify the investment.

Outcome and Learning Points

The case demonstrates that resilience is not equivalent to buying the cheapest backup. The appropriate response combines continuity, quality governance, supplier collaboration, inventory, technical capability and learning. Important lessons include:

• Criticality should be assessed by consequence and recovery time, not purchase spend alone.
• A risk treatment must preserve safety and regulatory integrity.
• Early-warning information is useful only when escalation and authority are clear.
• Redundancy is valuable when alternate capacity is qualified and accessible.
• Resilience investments should be reviewed after changes in product design, regulation or supplier structure.

Challenges, Limitations and Governance Considerations

Frameworks can create false confidence. A complete risk register does not guarantee resilience, and a certified management system does not ensure effective behavior. Risks may be underestimated because managers rely on historical data that excludes unprecedented events. Probability-impact matrices can also hide differences in uncertainty, speed and interdependence.

Another common mistake is optimizing individual functions. Procurement may reduce price while increasing continuity risk; logistics may select a fast route that creates customs exposure; finance may reduce inventory without considering recovery time. Cross-functional governance is therefore essential.

Ethical and professional responsibilities are significant. Organizations must not shift unacceptable safety, labor or environmental risks to suppliers with less bargaining power. Risk transfer through contracts or insurance does not eliminate responsibility. Supplier audits should respect confidentiality and human rights, while data sharing should follow privacy, cybersecurity and competition-law requirements. Business continuity priorities should also consider vulnerable customers and essential goods, not only profitable accounts.

Digital technologies improve visibility but introduce new dependencies. Control towers, supplier portals, Internet of Things sensors, predictive analytics and artificial intelligence can detect anomalies and support scenario analysis. AI may help predict delays or identify patterns in supplier data, but models can reproduce biased data, generate false alerts or fail under unprecedented conditions. Human judgment, data governance, access controls, model validation and fallback procedures remain necessary. A digitally visible supply chain is not automatically a resilient supply chain.

Current Developments and Best Practices

Contemporary resilience practice is moving from isolated risk registers toward network-level visibility, scenario-based planning and continuous sensing. Climate exposure, geopolitical fragmentation, cyber-physical threats, critical-mineral dependence and stricter sustainability expectations are encouraging firms to evaluate several tiers of the supply network. Resilience is also increasingly linked with sustainability: a local redesign may reduce emissions and transport exposure, while an emergency shift to air freight may protect service but increase environmental impact.

Useful practices include:

• Segment suppliers, products and lanes by criticality, substitutability and recovery time.
• Combine quantitative data with expert judgment and external intelligence.
• Maintain current maps of tier-one and strategically important lower-tier dependencies.
• Define risk appetite, escalation thresholds and decision rights before a crisis.
• Test continuity plans through realistic exercises involving suppliers and logistics partners.
• Measure recovery time, service restoration, near misses, concentration and adaptive capacity, not only cost.
• Review contracts for notification, information sharing, audit, continuity and ethical obligations.
• Treat lessons from incidents as inputs to redesign rather than merely explanations of past failure.

Chapter Summary

Supply chain risk concerns uncertainty affecting objectives, while resilience concerns the capacity to absorb disruption, continue critical activity, recover and adapt. ISO 31000 provides a general process for context-setting, identification, analysis, evaluation, treatment and review. COSO ERM connects risk with governance, strategy, performance and accountability. SCOR translates supply chain activity into processes and performance attributes. Business continuity standards prioritize critical activities and establish recovery requirements.

Resource-based theory explains resilience through valuable organizational capabilities; transaction cost theory clarifies choices among markets, contracts, partnerships and integration; high-reliability theory emphasizes sensitivity to weak signals, expertise and disciplined operations; and dynamic capabilities explain how organizations sense, respond and transform. Their combined use supports better decisions concerning sourcing, inventory, visibility, continuity and network design. The central managerial lesson is that resilience is a governed capability, not a single asset or checklist.

Key Terms

Risk: The effect of uncertainty on objectives.

Supply chain vulnerability: Susceptibility of a supply chain node, process or network to disruption.

Disruption: An event that interrupts expected supply chain operations or performance.

Robustness: Ability to withstand disturbance with little change in performance.

Resilience: Ability to absorb, respond to, recover from and adapt after disruption.

Risk appetite: Amount and type of risk an organization is willing to pursue or retain.

Risk capacity: Maximum level of risk an organization can absorb without threatening viability.

Residual risk: Exposure remaining after controls or treatments are applied.

ISO 31000: A principles-based framework and process for managing risk.

COSO ERM: An enterprise framework linking risk with governance, strategy and performance.

SCOR: A process reference model for analyzing and improving supply chain activities.

Business impact analysis: Assessment of disruption consequences and recovery priorities.

Maximum tolerable period of disruption: Longest period a critical activity can be unavailable before unacceptable consequences arise.

Resource-based theory: Theory explaining advantage through valuable, rare and difficult-to-imitate resources and capabilities.

Transaction cost theory: Theory explaining governance choices through the costs of market exchange and coordination.

High-reliability theory: Study of organizations that maintain safe performance in complex, hazardous conditions.

Dynamic capabilities: Abilities to sense change, seize responses and transform resources or routines.

Risk velocity: Speed at which a risk develops or affects the organization.

Key risk indicator: A measure that signals changing risk exposure or control effectiveness.

Review Questions

Short Answer Questions

1. Distinguish robustness from resilience in a supply chain.

2. What is the purpose of a business impact analysis?

3. Explain the difference between risk appetite and risk capacity.

4. Identify the principal process categories associated with SCOR.

5. What does deference to expertise mean in high-reliability theory?

Long Answer Questions

1. Explain how ISO 31000 can be applied to a global sourcing decision.

2. Compare the contributions of COSO ERM and SCOR to supply chain risk management.

3. Discuss how resource-based theory and dynamic capabilities explain differences in organizational resilience.

4. Analyze the role of transaction cost theory in deciding between dual sourcing, partnership and vertical integration.

5. Explain why business continuity planning must include external suppliers and logistics providers.

Analytical / Application Questions

1. A manufacturer has one low-cost supplier in a politically unstable region and limited inventory. Use ISO 31000, COSO ERM and SCOR to design an assessment and treatment plan.

2. A firm proposes adding three suppliers to reduce concentration risk. Analyze the proposal using transaction cost theory, quality governance and resilience principles.

3. Following a cyberattack on a logistics platform, develop an integrated response and learning plan using business continuity, high-reliability and dynamic-capabilities perspectives.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from robustness?

A. Robustness concerns financial risk, whereas resilience concerns operational risk.

B. Robustness withstands disturbance with limited performance change, while resilience also includes response, recovery and adaptation.

C. Robustness applies only to suppliers, whereas resilience applies only to manufacturers.

D. Robustness requires redundancy, whereas resilience requires eliminating all risk.

Correct Answer: B. Robustness withstands disturbance with limited performance change, while resilience also includes response, recovery and adaptation.

Question 2

Under ISO 31000, which activity should generally occur before selecting a risk treatment?

A. Eliminating all suppliers from the risk register

B. Evaluating the analyzed risk against established criteria

C. Auditing internal financial statements only

D. Purchasing insurance regardless of exposure

Correct Answer: B. Evaluating the analyzed risk against established criteria

Question 3

A board asks whether a proposed offshore sourcing strategy is consistent with corporate objectives and risk appetite. Which framework is most directly suited to this question?

A. COSO ERM

B. SCOR only

C. High-reliability theory only

D. Business impact analysis only

Correct Answer: A. COSO ERM

Question 4

What is the primary contribution of SCOR to resilience management?

A. It provides a legal contract for supplier relationships.

B. It replaces the need for risk appetite statements.

C. It maps supply chain processes and connects them with performance and control points.

D. It guarantees that a supply chain will recover after disruption.

Correct Answer: C. It maps supply chain processes and connects them with performance and control points.

Question 5

A company identifies a critical activity, its dependencies, minimum service level and maximum tolerable downtime. This is most closely associated with:

A. Business impact analysis

B. Transaction cost analysis

C. Supplier price benchmarking

D. Resource rarity analysis

Correct Answer: A. Business impact analysis

Question 6

Which decision is most consistent with transaction cost theory under high uncertainty and highly specific assets?

A. Ignoring monitoring costs because the market is always efficient

B. Considering closer contractual governance or integration to control exchange and adaptation costs

C. Increasing the number of suppliers without qualification

D. Selecting the supplier with the lowest quoted price only

Correct Answer: B. Considering closer contractual governance or integration to control exchange and adaptation costs

Question 7

A control-room manager treats repeated minor delivery anomalies as possible indicators of a major failure. Which high-reliability principle is illustrated?

A. Preoccupation with failure

B. Risk transfer

C. Asset specificity

D. Inventory minimization

Correct Answer: A. Preoccupation with failure

Question 8

Which sequence best represents dynamic capabilities?

A. Source, make, deliver

B. Plan, audit, insure

C. Sense changes, seize responses, transform resources or routines

D. Contract, outsource, withdraw

Correct Answer: C. Sense changes, seize responses, transform resources or routines

Question 9

A firm qualifies a second supplier but discovers that it lacks internal technical capacity to approve the alternative quickly. Which theory most directly highlights this internal weakness?

A. Resource-based theory

B. Transaction cost theory only

C. SCOR only

D. Contingency insurance theory

Correct Answer: A. Resource-based theory

Question 10

Why is adding suppliers not automatically an effective resilience treatment?

A. More suppliers always reduce quality to zero.

B. Supplier diversification may introduce coordination, qualification, monitoring and intellectual-property costs.

C. Resilience requires using only one strategic supplier.

D. ISO 31000 prohibits supplier diversification.

Correct Answer: B. Supplier diversification may introduce coordination, qualification, monitoring and intellectual-property costs.