4. Supply Chain Risk Identification and Mapping

Introduction and Context

Supply chain resilience begins with the ability to see risk before it becomes disruption. Organisations cannot protect what they have not identified, and they cannot prioritise what they have not mapped across the network. Risk identification and mapping therefore provide the analytical foundation for continuity planning, supplier development, inventory strategy, insurance, crisis response and strategic redesign.

A contemporary supply chain is rarely a simple linear sequence. It is a network of suppliers, contract manufacturers, logistics providers, ports, warehouses, technology platforms, financial institutions, regulators and customers. A disruption at a lower-tier supplier may affect several first-tier suppliers simultaneously. Similarly, a single port, cloud platform, transport corridor or raw-material source may create a concentration risk that is invisible in conventional supplier lists.

Risk mapping is consequently more than compiling a register of hazards. It involves connecting sources of uncertainty with affected nodes, flows, processes, stakeholders and outcomes. The purpose is not to predict every event, but to develop a structured understanding of exposure, vulnerability, interdependence and potential consequences.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the meaning, scope and importance of supply chain risk identification and mapping.

2. Construct a multidimensional taxonomy of supply chain risks.

3. Distinguish hazards, vulnerabilities, events, impacts and controls.

4. Map risks across suppliers, processes, logistics routes, infrastructure and multiple tiers.

5. Apply qualitative and quantitative methods for prioritising risk.

6. Evaluate the uses and limitations of risk registers, heat maps, network maps and scenario analysis.

7. Recommend managerial, technological and governance practices for improving risk visibility.

The Logic of Supply Chain Risk

Supply chain risk may be understood as the possibility that an uncertain event or condition will adversely affect the achievement of supply chain objectives. These objectives include cost, quality, service, speed, flexibility, safety, compliance, sustainability and reputation. Risk is therefore not restricted to physical interruption. A regulatory penalty, cyberattack, product-quality failure, labour dispute, demand collapse or loss of customer trust may be equally significant.

A useful analytical distinction is between five elements:

• Source: the underlying condition that can generate uncertainty, such as dependence on one supplier or exposure to flooding.
• Hazard: a potentially damaging condition or force, such as fire, malware, political conflict or contamination.
• Event: the occurrence that activates the hazard, such as a factory fire or border closure.
• Vulnerability: the degree to which a supply chain is susceptible to harm, including lack of substitutes, low inventory or weak cyber controls.
• Impact: the consequences for operations, finance, customers, employees, society or the environment.

Risk is often represented conceptually as a function of likelihood and consequence. However, this simple expression can be misleading. Low-frequency events may have catastrophic consequences, while highly probable events may be absorbed through routine controls. A mature assessment therefore considers probability, severity, duration, speed of onset, detectability, recoverability and the number of connected entities affected.

Risk also has a dual character. Some risks are negative threats, while others arise from uncertainty surrounding strategic opportunities. Entering a new market, outsourcing production or adopting a new technology may create exposure but also generate competitive advantage. Managers must therefore avoid treating resilience as the elimination of all risk. The appropriate objective is informed risk-taking within defined tolerance levels.

A Taxonomy for Supply Chain Risk

A taxonomy provides a common language for collecting and comparing risks. No single taxonomy is universally correct; categories should reflect the organisation, industry and decision being examined. The following structure is sufficiently broad for global supply chains.

Supplier and sourcing risk

Supplier risk includes financial distress, inadequate capacity, poor quality, weak process maturity, labour violations, intellectual-property leakage, delivery unreliability and dependence on a single source. Risk can exist at the first tier or several tiers below it. A direct supplier may appear financially sound while relying on a fragile sub-supplier for a critical component.

Important indicators include supplier concentration, capacity utilisation, lead-time variability, defect rates, audit findings, payment delays, ownership changes and exposure to common geographic hazards.

Demand and commercial risk

Demand risk arises from forecasting error, volatile customer preferences, product substitution, seasonality, promotional distortion, cancellation, market decline and inaccurate sales information. Bullwhip effects amplify relatively small changes in end-customer demand as they move upstream. Commercial risk also includes customer concentration, contractual penalties and dependence on a small number of markets.

Process and operational risk

Process risk results from failures in procurement, production, maintenance, quality assurance, packaging, order processing, inventory control or product design. It may arise from inadequate standardisation, human error, equipment failure, poor change control or insufficient workforce capability. Process mapping helps reveal how one failure can propagate across activities.

Logistics and transportation risk

Logistics risk includes carrier failure, route interruption, port congestion, customs delays, theft, cargo damage, temperature excursion, fuel-price volatility and inadequate visibility. Intermodal handovers and cross-border documentation are frequent points of vulnerability. A route that is efficient under normal conditions may be highly exposed to strikes, conflict or extreme weather.

Infrastructure and utility risk

Supply chains depend on roads, ports, airports, railways, telecommunications, electricity, water, fuel and warehousing. Infrastructure risk is often shared by many firms and can therefore create systemic disruption. A supplier may have business-continuity plans but still be unable to operate when the local power grid or transport corridor fails.

Financial risk

Financial risks include exchange-rate movements, interest-rate changes, inflation, commodity-price volatility, credit restrictions, customer insolvency and supplier bankruptcy. Cash-flow stress may convert a manageable operational problem into a severe disruption. Financial mapping should examine both direct exposure and indirect dependencies, such as a logistics provider whose viability depends on a major customer.

Geopolitical and regulatory risk

Trade sanctions, tariffs, export controls, civil unrest, armed conflict, border restrictions, changes in local content rules and regulatory divergence can alter the viability of a sourcing or distribution arrangement. Political risk is not limited to countries considered unstable; sudden policy changes can occur in mature markets as well.

Environmental and climate risk

Environmental risk includes floods, storms, drought, wildfire, earthquakes, heat stress, water scarcity, pollution incidents and biodiversity loss. Climate-related risk has both physical and transition dimensions. Physical risk affects assets and flows directly, while transition risk results from changes in carbon regulation, energy systems, technology or consumer expectations.

Social and human-rights risk

Social risk encompasses unsafe working conditions, forced or child labour, discrimination, community conflict, strikes, skills shortages, public-health emergencies and reputational harm. These risks may be difficult to observe through conventional performance data and require responsible-sourcing audits, worker voice mechanisms and grievance systems.

Technological and cyber risk

Technological risk includes system failure, software defects, cyber intrusion, ransomware, data corruption, weak access controls, technology obsolescence and dependence on a single platform provider. Digital integration improves visibility but creates interconnected points of failure. Cyber risk should therefore be assessed across suppliers, third-party logistics providers and software vendors, not only within the focal organisation.

These categories overlap. A geopolitical event may create logistics, financial and demand consequences; a cyberattack may interrupt production and damage regulatory compliance. The taxonomy is a starting structure, not a set of isolated compartments.

From Supply Chain Description to Risk Map

Risk mapping normally begins with a representation of the supply chain. The map should identify physical flows of materials and products, information flows, financial flows and contractual relationships. It should also record locations, capacities, lead times, ownership, responsibilities and alternative paths.

A practical mapping process consists of the following stages.

Define scope and objectives

The organisation first determines whether the assessment concerns a product, business unit, region, customer segment, critical material or end-to-end network. Scope must be sufficiently narrow to permit analysis but sufficiently broad to capture important dependencies. The objective may be regulatory compliance, business continuity, new-product introduction, supplier rationalisation or climate adaptation.

Identify critical products, services and processes

Not every item deserves equal analytical effort. Criticality can be judged by customer importance, safety implications, revenue contribution, substitution difficulty, regulatory significance, recovery time and strategic value. Process mapping techniques such as SIPOC, value-stream mapping and business-impact analysis help identify essential activities and resources.

Discover network nodes and relationships

The assessment should identify direct suppliers, sub-suppliers, manufacturing sites, logistics providers, ports, warehouses, utilities, technology providers and customers. Data sources may include enterprise-resource-planning systems, bills of material, purchase records, supplier questionnaires, contracts, audit reports, customs data, transport records and external intelligence.

Assess tier visibility

Tier-one visibility is often relatively strong because contractual relationships are direct. Visibility weakens at tiers two, three and beyond. Organisations should focus first on critical components, bottleneck materials and suppliers with high concentration or geographic exposure. Where exact data are unavailable, assumptions should be documented and confidence levels assigned rather than hidden.

Locate dependencies and concentrations

Mapping should reveal common suppliers, shared facilities, single ports, dominant carriers, common software platforms, constrained raw materials and geographic clustering. A network with many suppliers may still be fragile if they all depend on one sub-supplier or corridor.

Link risks to consequences and controls

Each identified risk should be connected to affected nodes, processes, customers and performance measures. Existing preventive and corrective controls should be recorded, including dual sourcing, safety stock, contractual clauses, backup systems, inspections, insurance, alternative routes and emergency procedures.

Validate with stakeholders

Maps should be reviewed by procurement, operations, logistics, finance, information technology, quality, legal, sustainability and relevant suppliers. Workshops frequently reveal informal dependencies that are absent from databases, such as a specialist technician, undocumented manual process or local transport broker.

Analytical Tools and Frameworks

Risk registers

A risk register records the risk description, cause, event, consequence, owner, likelihood, impact, existing controls, treatment action, due date and status. It creates accountability but should not become a static compliance document. A useful register links each entry to a process, site, supplier or network relationship.

Risk heat maps

Heat maps display likelihood against consequence. They are effective for communication and initial prioritisation, but their categories can create false precision. Two risks placed in the same high-high cell may have very different time horizons, detectability or recovery requirements. Heat maps should therefore be supplemented by narrative analysis and scenario testing.

Failure Mode and Effects Analysis

FMEA examines potential failure modes, their effects, causes and existing controls. Traditional scoring often uses severity, occurrence and detectability ratings. The method is particularly useful for manufacturing and process risks, but scores should be calibrated across teams to reduce subjectivity.

Bow-tie analysis

Bow-tie analysis places a major event at the centre. Preventive barriers appear on the left between causes and the event; mitigating barriers appear on the right between the event and consequences. This helps managers distinguish controls that prevent disruption from those that reduce its impact.

Network analysis

Network analysis represents suppliers, facilities and transport links as nodes and edges. Measures such as degree centrality, betweenness centrality and clustering can indicate dependence on particular nodes or corridors. A node with high betweenness may not be the largest supplier but may connect otherwise separate parts of the network. Network models are valuable for identifying systemic exposure and testing the effect of node failure.

Scenario analysis and stress testing

Scenario analysis explores plausible combinations of events, such as a cyberattack occurring during a port closure and peak demand. Stress testing asks whether the network can meet service requirements under severe but credible conditions. Scenarios should specify assumptions, duration, affected locations, recovery constraints and management decisions.

Quantitative prioritisation

Where data permit, expected loss may be estimated as the probability of an event multiplied by its financial or operational consequence. More advanced models use Monte Carlo simulation, Bayesian updating, reliability analysis and real-options reasoning. Quantification should not obscure uncertainty. Ranges, confidence intervals and sensitivity analysis are often more informative than a single point estimate.

Mapping Across Multiple Tiers

Multi-tier mapping is one of the most difficult tasks in global supply chain risk management. Firms may lack contractual authority, data standards or commercial incentives to obtain information beyond direct suppliers. Nevertheless, several approaches improve visibility.

First, prioritise by criticality rather than attempting to map every relationship simultaneously. A critical component with no substitute deserves deeper investigation than a low-value standard item. Second, require structured disclosure through supplier contracts, onboarding and periodic certification. Third, use collaboration: focal firms, suppliers and industry associations can share information without unnecessarily exposing confidential commercial data. Fourth, combine internal information with external data, including trade records, corporate reports, sanctions databases, hazard maps, weather intelligence and cyber-threat feeds.

The map should distinguish known facts from estimates. A supplier location may be verified, while its sub-tier dependency may be inferred. Recording data provenance and confidence prevents managers from treating assumptions as certainty. Mapping should also be refreshed after mergers, product changes, geopolitical developments, new contracts and major incidents.

Practical Application: From Map to Decision

A map becomes managerial value only when it changes decisions. If a critical component depends on one supplier in a flood-prone region, possible responses include qualifying a second source, redesigning the product, holding strategic inventory, relocating production, improving flood protection, negotiating capacity reservations or accepting the risk with a documented contingency plan. The best response depends on cost, lead time, customer requirements, risk tolerance and the reversibility of the decision.

Managers should distinguish between avoidance, reduction, transfer, sharing and acceptance. Avoidance may involve exiting a market or eliminating a hazardous process. Reduction may involve dual sourcing or stronger controls. Transfer may involve insurance or contractual allocation, although contracts cannot eliminate physical or systemic consequences. Sharing may involve collaborative inventory or joint emergency capacity. Acceptance is appropriate when exposure is understood and consistent with approved tolerance.

Risk ownership should be assigned at the level capable of taking action. A procurement manager may own supplier qualification, while technology leadership owns cyber controls and executive management owns strategic concentration decisions. Escalation criteria should be explicit, especially for risks affecting safety, legal compliance, human rights or enterprise survival.

Illustrative Case: Mapping a Pharmaceutical Cold Chain

Background

The following is an illustrative case. MedicaNova, a pharmaceutical company, distributes temperature-sensitive vaccines across several countries. It purchases active ingredients from one region, contracts manufacturing to a second region and uses third-party logistics providers for international and domestic distribution.

Situation and problem

The company’s supplier dashboard showed acceptable first-tier performance. Nevertheless, deliveries were becoming unreliable, and one shipment experienced a temperature excursion. Management initially suspected carrier negligence. A broader mapping exercise was commissioned before the next high-demand season.

Analysis

The team mapped material, information and financial flows from active-ingredient suppliers to hospitals. It discovered that two apparently independent contract manufacturers used the same specialist packaging supplier. Both depended on a single airport for temperature-controlled exports. The logistics provider relied on one data platform for shipment monitoring, while local distributors used manual temperature records. A heat-wave scenario showed that the approved transport time was insufficient if aircraft delays exceeded twelve hours.

The risk register identified several linked risks: sub-tier concentration, airport dependency, inadequate monitoring redundancy, extreme heat, weak data integrity and unclear responsibility for excursion decisions. A bow-tie analysis showed that preventive controls existed for packaging quality but not for airport closure or monitoring-platform failure.

Approach and solution

MedicaNova qualified an alternative packaging supplier, negotiated priority handling with two airports, established a regional buffer stock and introduced validated passive cooling containers. It added a second monitoring platform and required electronic temperature records from distributors. Contracts clarified escalation responsibilities and product-disposition authority. Suppliers were asked to report critical sub-tier changes and business-continuity tests.

Outcome

The exercise did not eliminate all risk, but it changed the company’s understanding of exposure. Investment shifted from investigating carrier performance after incidents to reducing shared dependencies before disruption. The company also introduced quarterly reviews of critical sub-tier and infrastructure risks.

Learning points

The case demonstrates that first-tier visibility may conceal systemic concentration, that physical and digital flows must be mapped together, and that resilience decisions should address both prevention and recovery. It also shows why risk ownership must be shared across procurement, quality, logistics, information technology and commercial functions.

Challenges, Limitations and Common Mistakes

Risk identification is affected by incomplete, outdated or biased information. Suppliers may underreport weaknesses because of commercial concerns; internal teams may protect their budgets; and managers may focus on familiar risks while overlooking emerging ones. Risk registers can become excessively long, producing administrative activity without prioritisation.

Other common mistakes include treating likelihood-impact scores as objective facts, ignoring low-probability high-impact events, mapping only tier-one suppliers, overlooking shared infrastructure, separating cyber risk from operational risk, and failing to test assumptions. Another error is confusing visibility with resilience. Knowing that a supplier is exposed to flood does not ensure that the organisation can respond effectively.

Data quality also presents a technical limitation. Corporate databases may contain inconsistent supplier names, inaccurate addresses and incomplete bills of material. Network models can therefore produce misleading results unless records are cleansed and relationships are verified. Finally, risk maps may create a false sense of control if they are not connected to investment, governance and response exercises.

Governance, Ethics and Professional Responsibility

Risk mapping involves commercial, personal and sometimes sensitive geopolitical information. Data collection should follow principles of necessity, proportionality, confidentiality and lawful use. Organisations should avoid using risk assessments to impose unfair burdens on smaller suppliers or to conceal exploitative labour practices behind contractual distance.

Responsible mapping includes human-rights due diligence, worker safety, environmental responsibility and transparent escalation. Suppliers should understand what data are requested, why they are required and how information will be protected. Decisions should not rely exclusively on automated risk scores, especially where they may discriminate against suppliers from particular regions without considering evidence and context.

Governance should establish risk appetite, reporting thresholds, ownership, review frequency and independent assurance. Critical risks should be reported to senior leadership and, where appropriate, the board. Regulatory obligations relating to sanctions, data protection, product safety, environmental disclosure and supply-chain due diligence must be integrated into the mapping process.

Digital Tools, Analytics and Emerging Developments

Digital supply chain control towers combine enterprise data, transport events, supplier information and external signals. Geographic information systems can overlay facilities and routes with flood, wildfire, earthquake, political or climate data. Graph databases are useful for representing complex multi-tier relationships, while machine-learning models can identify unusual lead-time, quality or payment patterns.

Artificial intelligence may support document extraction, supplier-risk classification, demand anomaly detection and scenario generation. Its output requires human validation because historical data may be incomplete, biased or unable to represent unprecedented events. Cybersecurity, access control, model governance and explainability are essential when risk intelligence informs procurement or continuity decisions.

Emerging practice is moving toward continuous risk sensing rather than annual assessment. Organisations increasingly combine internal operational data with satellite observations, weather feeds, sanctions updates, financial indicators, news analysis and supplier-submitted evidence. Climate scenario analysis, digital twins and collaborative industry platforms are also expanding. These tools improve speed and breadth, but they do not replace managerial judgement, supplier relationships or physical verification.

Best Practices for Effective Risk Mapping

Effective organisations generally:

• map critical products and processes before attempting complete network coverage;
• distinguish hazards, events, vulnerabilities, impacts and controls;
• include material, information, financial and digital dependencies;
• investigate common suppliers, shared infrastructure and geographic concentration;
• record data sources, assumptions, confidence and update dates;
• combine workshops, audits, analytics and external intelligence;
• test maps through scenarios, simulations and exercises;
• assign owners and link risks to funded treatment plans;
• review risks after strategic, regulatory, technological or supplier changes; and
• treat resilience as a cross-functional and multi-tier responsibility.

Chapter Summary

Supply chain risk identification and mapping provide the foundation for resilient decision-making. Risk must be understood as a relationship among sources, hazards, events, vulnerabilities, controls and consequences. A comprehensive taxonomy should cover supplier, demand, process, logistics, infrastructure, financial, geopolitical, environmental, social and technological risks, while recognising that these categories interact.

Mapping begins with scope, critical products and process analysis, then extends through nodes, relationships, tiers, flows, concentrations and controls. Risk registers, heat maps, FMEA, bow-tie analysis, network analysis, scenario testing and quantitative methods each offer different forms of insight. None is sufficient alone. Effective practice combines structured data with stakeholder knowledge, distinguishes fact from assumption and converts findings into decisions concerning sourcing, inventory, design, contracts, infrastructure and contingency planning.

Multi-tier visibility, data quality, cyber dependence, ethical responsibilities and dynamic external conditions remain major challenges. Digital tools and AI can improve continuous sensing, but human judgement, governance and responsible use of information remain essential. The ultimate purpose of mapping is not to produce a visually attractive diagram; it is to improve preparedness, prioritisation and the capacity to absorb, adapt to and recover from disruption.

Key Terms

Supply chain risk: The possibility that uncertainty will adversely affect supply chain objectives.

Risk source: An underlying condition capable of generating uncertainty or harm.

Hazard: A potentially damaging condition or force.

Risk event: The occurrence through which a hazard becomes active.

Vulnerability: The susceptibility of a supply chain to disruption or loss.

Impact: The operational, financial, social, environmental or reputational consequence of an event.

Risk taxonomy: A structured classification system for organising risks.

Risk register: A controlled record of risks, causes, impacts, controls, owners and treatments.

Risk heat map: A visual display comparing risks according to likelihood and consequence.

Multi-tier visibility: Knowledge of supply chain relationships beyond direct, first-tier suppliers.

Concentration risk: Exposure created by dependence on a common supplier, location, route, platform or resource.

Criticality: The importance of an item, process or node to supply chain objectives.

FMEA: A method for evaluating potential failure modes, their effects, causes and controls.

Bow-tie analysis: A framework linking causes and preventive barriers to an event, consequences and mitigating barriers.

Network analysis: The study of nodes and relationships to identify dependencies and systemic exposure.

Scenario analysis: The examination of plausible conditions and their effects on supply chain performance.

Risk appetite: The amount and type of risk an organisation is willing to pursue or retain.

Control tower: A digital capability that integrates data to provide supply chain visibility and coordination.

Bullwhip effect: The amplification of demand variation as information moves upstream.

Review Questions

Short Answer Questions

1. Distinguish between a hazard, a risk event, vulnerability and impact.

2. Why is mapping beyond the first supplier tier important?

3. What types of exposure are revealed by network analysis?

4. State two limitations of a risk heat map.

5. Why should digital and physical dependencies be mapped together?

Long Answer Questions

1. Explain a comprehensive taxonomy for identifying global supply chain risks, using examples.

2. Describe the stages involved in constructing a multi-tier supply chain risk map.

3. Compare FMEA, bow-tie analysis and scenario analysis as risk assessment methods.

4. Discuss the relationship between supply chain visibility, concentration risk and resilience.

5. Examine the governance, ethical and data-quality challenges associated with risk mapping.

Analytical / Application Questions

1. A manufacturer has three direct suppliers, but all three use the same raw-material processor and port. Analyse the hidden risks and recommend a mapping and mitigation approach.

2. Design a risk assessment for a temperature-sensitive product moving through two international transport hubs. Specify the data, tools, stakeholders and scenarios you would use.

3. A supplier-risk algorithm assigns a high-risk score to a small supplier located in a developing economy. Explain how managers should validate the score and make an ethically defensible decision.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes vulnerability from a hazard?

A. A vulnerability is the event that activates a hazard

B. A vulnerability is the supply chain’s susceptibility to harm

C. A vulnerability is the financial consequence of disruption

D. A vulnerability is a preventive control

Correct Answer: B. A vulnerability is the supply chain’s susceptibility to harm

Question 2

A firm has many first-tier suppliers, but all depend on one specialist sub-supplier. What risk is most directly revealed?

A. Demand seasonality

B. Supplier concentration risk

C. Product obsolescence

D. Customer diversification

Correct Answer: B. Supplier concentration risk

Question 3

What is the principal purpose of a bow-tie analysis?

A. To calculate inventory turnover

B. To compare supplier prices

C. To connect causes and preventive barriers with consequences and mitigating barriers

D. To forecast customer demand

Correct Answer: C. To connect causes and preventive barriers with consequences and mitigating barriers

Question 4

Which mapping practice most improves the reliability of risk assessments?

A. Treating all assumptions as verified facts

B. Recording data sources, assumptions and confidence levels

C. Using only historical disruption data

D. Excluding suppliers from validation workshops

Correct Answer: B. Recording data sources, assumptions and confidence levels

Question 5

A risk has a low probability but could stop a global product line for several months. Which approach is most appropriate?

A. Exclude it because its probability is low

B. Assess it only through a routine heat map

C. Use scenario or stress testing alongside probability assessment

D. Transfer it entirely through insurance

Correct Answer: C. Use scenario or stress testing alongside probability assessment

Question 6

Which example represents infrastructure risk rather than ordinary supplier-quality risk?

A. A supplier produces components with excessive defects

B. A factory loses access to electricity because of grid failure

C. A customer changes product preferences

D. A buyer negotiates a lower price

Correct Answer: B. A factory loses access to electricity because of grid failure

Question 7

Why can a control tower fail to create resilience by itself?

A. Visibility automatically eliminates all hazards

B. Digital systems cannot record any supply chain information

C. Information is valuable only when connected to decisions, controls and response capabilities

D. Control towers apply only to financial risk

Correct Answer: C. Information is valuable only when connected to decisions, controls and response capabilities

Question 8

In the illustrative pharmaceutical case, what hidden dependency was identified?

A. Both contract manufacturers used the same packaging supplier and airport dependency

B. Hospitals used different vaccine formulations

C. Demand was completely stable

D. The company had no logistics providers

Correct Answer: A. Both contract manufacturers used the same packaging supplier and airport dependency

Question 9

Which action is an example of risk reduction rather than risk acceptance?

A. Documenting the exposure without further action

B. Qualifying an alternative supplier for a critical component

C. Ignoring a low-frequency event

D. Removing the risk from the register

Correct Answer: B. Qualifying an alternative supplier for a critical component

Question 10

Why should AI-generated supplier-risk scores be reviewed by managers?

A. AI outputs are always legally invalid

B. Historical data may be incomplete or biased and may not represent unprecedented events

C. Algorithms cannot process structured data

D. Human review makes external information unnecessary

Correct Answer: B. Historical data may be incomplete or biased and may not represent unprecedented events