Trade, Supply and Geopolitical Risk Governance

Introduction

International sourcing creates access to lower costs, specialised capabilities, scarce materials and new markets. It also exposes organisations to risks that are outside the direct control of purchasing departments. A port closure, currency crisis, export restriction, cyberattack, sanctions designation, supplier fraud or political conflict can interrupt supply, increase landed cost and damage an organisation’s licence to operate.

Risk governance is therefore more than identifying hazards. It is the system through which an organisation establishes risk appetite, assigns accountability, obtains reliable information, selects controls, monitors exposures and makes timely decisions. In international trade, effective governance connects procurement, finance, logistics, legal and compliance, information security, operations and senior management.

The central managerial challenge is not to eliminate all risk. Such elimination is impossible and may destroy the benefits of international sourcing. The objective is to understand exposure, reduce avoidable vulnerability, prepare credible responses and ensure that residual risk is consciously accepted at the appropriate level.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Distinguish major country, currency, commodity, logistics, cyber, sanctions, fraud, disruption and supplier-continuity risks.
2. Construct and interpret a qualitative and quantitative international supply-risk map.
3. Apply scenario analysis, stress testing and expected-loss reasoning.
4. Design diversification, buffer, contractual, financial and business-continuity responses.
5. Establish governance controls, escalation rules and assurance mechanisms.
6. Evaluate the ethical, legal and strategic limitations of risk mitigation.

1. The Nature of International Trade Risk

International supply risk arises when an event or condition can adversely affect the organisation’s objectives. The effect may concern cost, quality, delivery, revenue, safety, reputation, regulatory compliance or strategic capability.

A useful distinction is between hazard, exposure, vulnerability, event and consequence:

• Hazard is a potentially damaging condition, such as political instability or malware.
• Exposure is the organisation’s connection to that hazard, such as dependence on one country or supplier.
• Vulnerability is the degree to which exposure can be converted into harm, for example, the absence of alternate tooling.
• Event is the occurrence that activates the hazard, such as a border closure.
• Consequence is the resulting operational, financial, legal or reputational effect.

Risk is often represented as a combination of likelihood and consequence. This is useful for prioritisation but should not be treated as a precise law. Rare events with extreme consequences may be underestimated by historical frequencies, and correlated events may invalidate simple multiplication.

A supply network is especially vulnerable when it has high concentration, low substitutability, long replenishment time, limited visibility, weak contractual remedies or tightly coupled production. Modern networks also contain systemic risk: disruption at a shared port, cloud provider, semiconductor plant or logistics corridor can affect many apparently independent suppliers simultaneously.

2. Categories of Risk in International Sourcing

2.1 Country and geopolitical risk

Country risk includes political instability, regime change, civil unrest, expropriation, corruption, weak institutions, trade-policy changes and restrictions on capital movement. Geopolitical risk includes interstate conflict, strategic competition, military escalation, territorial disputes and the use of trade, technology or commodities as instruments of state policy.

The relevant question is not simply whether a country is “safe”. Managers should examine the specific product, location, route, ownership structure and legal relationship. A politically stable country may still present high risk for a dual-use technology subject to export controls. Conversely, a higher-risk country may be manageable for a low-value, easily substitutable item with multiple approved sources.

2.2 Currency risk

Currency risk occurs when exchange-rate movements change purchase cost, sales value, cash flow or the value of foreign assets and liabilities. Three forms are commonly distinguished:

• Transaction exposure: a contracted foreign-currency payable or receivable.
• Translation exposure: conversion of foreign subsidiary accounts into the reporting currency.
• Economic exposure: longer-term effects of exchange rates on competitiveness, demand and supplier economics.

For a foreign-currency payable, an approximate sensitivity is:

Here, Q_foreign is the payable amount in foreign currency, R is the domestic-currency price of one unit of foreign currency, and ∆ denotes a change. The relationship assumes the foreign-currency quantity is fixed and ignores taxes, transaction costs and nonlinear derivative effects. Units are domestic currency because foreign currency is multiplied by domestic currency per foreign currency.

A forward contract, natural hedge, currency option or pricing clause may be used, but each carries cost, counterparty, accounting and governance implications.

2.3 Commodity and price risk

Commodity exposure concerns changes in the price or availability of metals, energy, agricultural inputs and other traded materials. Price volatility may result from weather, inventories, sanctions, production concentration, speculative activity, transport constraints or industrial demand.

Responses include indexed contracts, fixed-price periods, collars, futures or swaps, material substitution, recycling, design changes and strategic inventory. A procurement team must distinguish price hedging from physical security: a financial hedge can offset price movement but cannot deliver material during a shortage.

2.4 Logistics and infrastructure risk

Logistics risk includes port congestion, canal or strait closure, labour disputes, carrier failure, customs delays, damaged cargo, inadequate cold-chain performance and cyber disruption of transport systems. Infrastructure risk extends to electricity, telecommunications, warehousing, roads, railways and water.

The total exposure should include more than freight rates. A delay can create production downtime, premium freight, contractual penalties, lost sales and quality deterioration. Route diversity is not genuine diversity if all routes depend on the same port, canal, transshipment hub or customs regime.

2.5 Cyber and information risk

International supply chains exchange forecasts, designs, bills of material, bank details, credentials and customs documentation. Attackers may target suppliers with weaker controls to reach a buying organisation. Risks include ransomware, business-email compromise, intellectual-property theft, manipulation of master data and denial of service.

Controls include multi-factor authentication, least-privilege access, network segmentation, secure backups, supplier security requirements, incident reporting, phishing resistance, software-patch governance and tested recovery. Cyber risk should be integrated into supplier qualification rather than treated as an information-technology issue alone.

2.6 Sanctions, export controls and trade compliance

Sanctions may target countries, entities, individuals, sectors, vessels, banks or specific transactions. Export controls may restrict products, software, technology, end users or end uses. Liability can arise through direct shipment, re-export, indirect financing, transshipment or dealings with an owned or controlled entity.

A sound compliance programme uses risk-based screening, beneficial-ownership checks, product classification, end-use review, licence management, record retention and escalation of potential matches. Screening tools are not sufficient by themselves: poor data quality, transliteration differences and rapidly changing lists create false positives and false negatives.

2.7 Fraud and integrity risk

Fraud can involve fictitious suppliers, duplicate invoices, altered bank details, overbilling, counterfeit materials, bribery, collusion, cargo diversion and false certificates of origin. International transactions increase complexity because documentation, languages, intermediaries and legal jurisdictions differ.

Segregation of duties, supplier due diligence, independent bank-detail verification, three-way matching, approved master-data changes, audit rights and whistleblowing channels are foundational controls. Excessive urgency, unusual payment requests, resistance to inspection and unexplained ownership changes are warning indicators, not proof of misconduct.

2.8 Disruption and supplier-continuity risk

Disruption risk includes fire, flood, earthquake, epidemic, industrial action, insolvency, utility failure, quality crisis and loss of key personnel. Supplier-continuity risk is amplified by single sourcing, common sub-tier dependencies, proprietary tooling and long qualification cycles.

Continuity planning should identify critical products and processes, minimum service levels, alternate sources, emergency logistics, tooling ownership, recovery time objectives and communication protocols. A second supplier is not an effective backup if it uses the same sub-tier, geographic cluster or constrained raw material.

3. A Risk-Governance Architecture

Risk management becomes unreliable when ownership is unclear. A practical architecture has three levels:

1. Operational ownership: buyers, planners, logistics managers and supplier managers identify exposures, operate controls and report indicators.
2. Functional challenge: finance, legal, compliance, security, quality and internal risk functions test assumptions and advise on treatment.
3. Executive oversight: a risk committee or senior executive sets appetite, approves major residual risks and allocates resilience investment.

The board or governing body should receive information that is decision-useful rather than merely voluminous. Reports should show critical exposures, trend changes, control failures, incidents, recovery readiness and decisions required.

A risk register should contain at least:

Risk appetite should be translated into operational thresholds. For example, an organisation may tolerate moderate price volatility but have zero tolerance for prohibited transactions, unsafe materials or falsification of origin documents. “Zero tolerance” should refer to the prohibited behaviour or outcome, not to the unrealistic expectation that screening will never produce an alert.

4. Risk Identification and Mapping

A robust assessment begins with a multi-tier supply-chain map. It should connect the material or service to the supplier, beneficial owner, manufacturing site, sub-tier inputs, transport route, border crossings, financial institutions and customer requirements.

A risk map can use two dimensions:

• Likelihood: probability or credible frequency within a defined time horizon.
• Impact: financial, operational, safety, legal, reputational and strategic consequence.

A simple score is:

where S is the prioritisation score, L is a defined likelihood rating and I is a defined impact rating. If both scales run from 1 to 5, the score ranges from 1 to 25. This ordinal score ranks risks; it is not a monetary expected loss and should not be compared across organisations without calibration.

A better assessment separates dimensions rather than hiding them in one number. A low-probability event with severe safety or sanctions consequences may require immediate treatment despite a modest aggregate score.

Early-warning indicators may include supplier financial deterioration, late shipment frequency, country-risk index movement, port dwell time, currency volatility, unusual changes in bank accounts, cyber vulnerabilities, sanctions-list alerts, quality escapes and declining inventory coverage.

5. Quantitative Analysis, Stress Testing and Scenario Planning

5.1 Expected loss

When probabilities and consequences are credible, expected loss can support prioritisation:

where p_i is the probability of scenario i, C_i is its monetary consequence, and the scenarios are mutually exclusive and collectively exhaustive for the modelled outcome. Expected loss is an average over repeated comparable situations; it does not predict the loss that will occur in one period. It also requires consequences to be measured on a consistent basis.

If a disruption has a 10% annual probability and a modelled consequence of $2 million, its expected annual loss is $200,000. This does not mean that the organisation will lose $200,000 every year. It may lose nothing for several years and then incur $2 million.

5.2 Monte Carlo and sensitivity analysis

For complex exposures, organisations may simulate exchange rates, demand, lead times, commodity prices and recovery times. The output should be interpreted as a range of possible outcomes, not as objective truth. Results depend on distributions, correlations and data quality. Sensitivity analysis should test which assumptions drive the result.

5.3 Stress testing

Stress testing deliberately examines severe but plausible conditions. Examples include a 30-day port closure, a 20% currency depreciation, loss of the largest supplier, a sanctions change affecting a key component, or a simultaneous cyberattack and demand surge.

A stress test should specify:

1. scenario assumptions;
2. starting inventory and open orders;
3. affected suppliers, routes and customers;
4. operational and financial impacts;
5. available response capacity;
6. decision triggers; and
7. lessons and investment actions.

Stress tests are most useful when they lead to decisions, such as pre-qualifying a second source or increasing critical-component inventory.

5.4 Time-based continuity metrics

Two important continuity concepts are:

• Recovery time objective (RTO): the maximum acceptable time before a process or service is restored.
• Recovery point objective (RPO): the maximum acceptable amount of data loss measured in time.

For physical supply, a related concept is the time-to-survive: how long operations can continue with available inventory and substitute capacity. If usable inventory is 12,000 units and average daily consumption is 800 units, ignoring safety-stock policy and demand variation:

This calculation is valid only for the stated constant-consumption assumption. It does not include replenishment, defective stock, demand changes or production yield.

6. Risk Treatment Strategies

6.1 Avoidance and reduction

Avoidance may involve discontinuing a prohibited route, redesigning a product to remove a restricted input or refusing an unacceptable intermediary. Reduction lowers likelihood or impact through inspection, security, dual sourcing, inventory, route changes or stronger specifications.

6.2 Diversification and redundancy

Diversification may involve multiple suppliers, countries, ports, carriers, technologies or materials. It reduces concentration but can increase qualification cost, coordination complexity and total spend. A “China-plus-one” or “two-supplier” policy is not automatically resilient; the second source must have sufficient capacity, independence and tested quality.

Useful questions include:

• Are suppliers exposed to the same sub-tier?
• Can both suppliers ramp up during a crisis?
• Is tooling portable?
• Are approvals transferable?
• Does geographic diversity create regulatory or quality problems?
• What is the cost of maintaining dormant capacity?

6.3 Inventory and capacity buffers

Buffers absorb delay and demand variation. They should be targeted at items with high criticality, long replenishment time, low substitutability and high disruption impact. Excess inventory creates obsolescence, working-capital and insurance costs. Buffer design should therefore consider total cost, not only service protection.

6.4 Contractual allocation and financial transfer

Contracts may allocate responsibilities for delivery, quality, force majeure, sanctions compliance, audit, change notification, business continuity, cybersecurity, intellectual property and termination. Insurance, letters of credit, guarantees, hedging and contractual damages may transfer parts of financial exposure, but they do not restore lost production or reputation automatically.

6.5 Collaboration and capability building

Resilience often depends on collaboration. Buyers can share forecasts, support supplier cybersecurity, conduct joint continuity exercises, maintain common emergency contacts and develop alternative specifications. Collaboration should not become dependency on an informal promise; commitments should be documented and tested.

7. Business Continuity and Crisis Response

A business-continuity plan should be based on a business-impact analysis. It should identify critical products, processes, people, facilities, systems and suppliers, together with acceptable interruption periods.

A practical response sequence is:

1. Detect and validate the incident.
2. Protect people, legal position, data and product integrity.
3. Activate the crisis team and define incident leadership.
4. Establish facts and suppress rumours.
5. Prioritise customers, products and scarce capacity.
6. Execute alternate sourcing, routing or production.
7. Communicate with regulators, customers, suppliers and employees.
8. Monitor recovery and document decisions.
9. Conduct a post-incident review and close corrective actions.

Plans should be exercised. Tabletop exercises test decisions and communication; operational exercises test actual alternate suppliers, data restoration, emergency freight and production changeovers. A plan that exists only as a document is not demonstrated capability.

8. Governance Controls Across the Source-to-Pay Cycle

Controls should be embedded in processes rather than added only after an incident.

Internal audit should assess whether controls are designed and operating effectively. External assurance may be appropriate for financial, quality, sustainability or information-security claims, but certificates should not replace direct risk assessment.

9. Technology, Data and Artificial Intelligence

Digital platforms can provide supplier mapping, sanctions screening, shipment visibility, anomaly detection and scenario dashboards. Artificial intelligence may classify news, detect unusual invoices, identify supplier relationships and forecast delays. However, AI outputs may reproduce biased data, confuse similarly named entities, miss emerging threats or create false confidence.

Governance should require documented data sources, human review for high-consequence decisions, model validation, access controls, audit trails, explainability appropriate to the decision and procedures for correcting errors. Sensitive engineering and supplier data should not be uploaded to unapproved systems. Technology improves visibility; it does not create resilience unless managers act on its findings.

10. Illustrative Case: Meridian Components Ltd.

Background

Meridian Components Ltd., a fictional industrial-equipment manufacturer, purchases a specialised power-control module from one supplier in Country A. The module represents only 4% of unit cost but is required for final assembly. Its lead time is 14 weeks, the supplier uses a single semiconductor sub-tier, and the shipping route passes through one major transshipment port.

Problem

A regional political crisis creates the possibility of export licensing delays and port disruption. At the same time, the buyer’s currency depreciates by 12%. Meridian has 18 days of module inventory, while average consumption is 600 modules per day. The supplier offers no tested alternate site.

Analysis

The exposure is high because the component has low cost share but high operational criticality. The apparent supplier-level relationship conceals sub-tier and route concentration. Inventory provides only:

The inventory therefore covers 18 days under constant consumption, not the 14-week replenishment period. A currency hedge could control price volatility but would not solve physical unavailability. A country score alone would also be inadequate because product classification and port dependence are central to the exposure.

Approach and solution

Meridian establishes a cross-functional risk cell. It obtains sub-tier disclosure, classifies the module for export-control purposes, confirms beneficial ownership and requests a continuity plan. It then:

• qualifies a supplier in Country B using the same design;
• purchases and transfers duplicate tooling;
• approves a technically equivalent module where possible;
• reserves an alternate route and tests customs documentation;
• negotiates a price-adjustment formula and a partial currency hedge;
• increases temporary inventory while avoiding indefinite overstock;
• adds sanctions, cyber, continuity and change-notification clauses;
• conducts a tabletop exercise involving procurement, engineering, logistics, finance and legal.

Outcome

The alternate supplier initially passes laboratory tests but fails a production-ramp trial. Meridian therefore retains the incumbent while correcting the alternate supplier’s process controls. The exercise reveals that engineering approval, rather than procurement contracting, is the true bottleneck. Management funds additional validation capacity and defines an escalation trigger when inventory falls below 35 days of demand.

Learning points

The case demonstrates that resilience is multidimensional. Low purchase-price share does not imply low risk; financial hedging cannot replace physical continuity; second sourcing requires demonstrated capacity; and governance must include sub-tier visibility, technical qualification and decision triggers.

11. Critical Limitations and Ethical Issues

Risk maps can create false precision. Ratings may reflect managerial opinion, outdated data or inconsistent scales. Diversification can shift risk to poorer labour, environmental or human-rights conditions. Supplier exit may protect one organisation while transferring harm to workers or communities. Aggressive localisation may also increase cost and reduce access to essential capabilities.

Ethical sourcing requires attention to forced labour, unsafe working conditions, discrimination, environmental damage, privacy and corruption. Due diligence should be proportionate but meaningful, and contractual standards should be accompanied by remediation and responsible disengagement. Confidential commercial information must be protected while still enabling legitimate audit and regulatory reporting.

Legal requirements differ across jurisdictions. Organisations should obtain qualified legal advice on sanctions, export controls, competition law, anti-bribery rules, data protection, customs valuation and contractual enforceability. A compliance programme should never be designed to evade the law by routing goods or payments through intermediaries.

12. Best-Practice Principles

1. Map beyond the immediate supplier to critical sub-tiers, owners, routes and dependencies.
2. Separate likelihood, impact, vulnerability and control effectiveness.
3. Use risk appetite to define operational thresholds and escalation rules.
4. Combine qualitative maps with financial analysis and severe-but-plausible stress tests.
5. Treat sanctions, export controls and human-rights due diligence as continuing processes.
6. Test alternate suppliers, routes, data recovery and communication channels.
7. Link inventory and redundancy decisions to criticality and time-to-survive.
8. Verify bank details and supplier identity independently.
9. Use technology with human oversight, traceability and data governance.
10. Review risks after geopolitical, organisational, product or route changes.
11. Measure resilience outcomes, not merely the number of assessments completed.
12. Learn systematically from incidents, near misses and exercises.

Chapter Summary

International sourcing exposes organisations to interconnected country, geopolitical, currency, commodity, logistics, cyber, sanctions, fraud, disruption and supplier-continuity risks. Effective governance begins by distinguishing hazard, exposure, vulnerability, event and consequence. It then maps the multi-tier network, assigns ownership, establishes risk appetite and monitors early-warning indicators.

Risk scores support prioritisation but are not substitutes for judgement. Expected-loss analysis, sensitivity analysis and stress testing help managers understand uncertainty and severe outcomes. Mitigation may involve avoidance, diversification, alternate capacity, inventory, contractual allocation, financial hedging, cyber controls and business-continuity planning. Each measure has costs and limitations, and physical resilience cannot be created solely through financial instruments or written plans.

A mature governance system integrates procurement with finance, legal, compliance, logistics, quality, information security, engineering and executive oversight. It uses tested controls, transparent escalation and responsible ethical practice. The strategic objective is not risk elimination but informed resilience: the capability to continue, adapt and recover while protecting stakeholders and complying with law.

Key Terms

Hazard: A condition with potential to cause harm.

Exposure: The organisation’s connection to a risk source.

Vulnerability: The susceptibility of an exposure to adverse consequences.

Country risk: Risk arising from political, economic, legal or institutional conditions in a country.

Geopolitical risk: Risk arising from international power relations, conflict or strategic state action.

Transaction exposure: Exchange-rate exposure created by a contracted foreign-currency payment or receipt.

Commodity risk: Risk from changes in the price or availability of traded materials.

Concentration risk: Dependence on a limited number of suppliers, countries, routes or facilities.

Systemic risk: Risk transmitted across many organisations through shared infrastructure or dependencies.

Sanctions: Legal restrictions imposed on specified countries, entities, persons, sectors or activities.

Export control: Regulation of exports, re-exports, technology, end users or end uses.

Beneficial owner: The person or entity that ultimately owns or controls an organisation.

Business continuity: The capability to continue critical operations during and after disruption.

Recovery time objective: Maximum acceptable time for restoring a process or service.

Recovery point objective: Maximum acceptable period of data loss.

Time-to-survive: Period operations can continue using available resources after supply interruption.

Stress test: Analysis of performance under severe but plausible conditions.

Residual risk: Risk remaining after controls and treatments.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Three-way match: Comparison of purchase order, goods receipt and supplier invoice before payment.

Review Questions

Short Answer Questions

1. Distinguish hazard, exposure and vulnerability in an international sourcing context.
2. What is the difference between transaction exposure and economic exposure?
3. Why is a second supplier not automatically an effective continuity measure?
4. Define recovery time objective and recovery point objective.
5. State two controls that can reduce international supplier fraud.

Long Answer Questions

1. Explain how a risk-governance architecture should allocate responsibilities among operational, functional and executive levels.
2. Discuss the relationship between country risk, geopolitical risk and supply-chain concentration.
3. Evaluate the advantages and limitations of inventory, diversification and contractual risk treatment.
4. Explain how sanctions and export-control compliance should be integrated into the source-to-pay cycle.
5. Describe how an organisation should design, conduct and learn from a supply-chain stress test.

Analytical / Application Questions

1. A company has 24 days of inventory and consumes 750 units per day. Its main supplier has a 10-week replenishment lead time. Calculate the inventory quantity and explain why the buffer may still be inadequate.
2. Design a risk map for a critical imported component involving one supplier, one port and a volatile foreign currency. Identify at least six indicators and four treatments.
3. Using the Meridian Components case, recommend a governance dashboard for senior management and justify the escalation thresholds you would include.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes exposure from vulnerability?

A. Exposure is the consequence; vulnerability is the probability.

B. Exposure is the connection to a hazard; vulnerability is susceptibility to harm.

C. Exposure is a control; vulnerability is a risk appetite statement.

D. Exposure is always financial; vulnerability is always operational.

Correct Answer: B. Exposure is the connection to a hazard; vulnerability is susceptibility to harm.

Question 2

A foreign-currency payable is 500,000 units and the exchange rate rises by $0.08 per unit. Ignoring other effects, the approximate domestic-currency cost increase is:

A. $6,250

B. $40,000

C. $400,000

D. $540,000

Correct Answer: B. $40,000

Question 3

Which risk cannot be solved directly by a financial commodity hedge?

A. A change in the quoted commodity price

B. A budget variance caused by price movement

C. Physical unavailability of the material

D. A fixed-price procurement exposure

Correct Answer: C. Physical unavailability of the material

Question 4

Expected loss is most appropriately interpreted as:

A. The exact loss that will occur next year

B. An average modelled loss across repeated comparable situations

C. The maximum legally permitted loss

D. The supplier’s guaranteed liability

Correct Answer: B. An average modelled loss across repeated comparable situations

Question 5

Which is an example of a recovery time objective?

A. Maximum acceptable time to restore a critical ordering system

B. Maximum acceptable percentage price increase

C. Number of suppliers approved in a category

D. Amount of inventory held at a warehouse

Correct Answer: A. Maximum acceptable time to restore a critical ordering system

Question 6

Which control most directly addresses altered supplier bank details?

A. Increasing safety stock

B. Independent verification of bank-detail changes

C. Changing the product specification

D. Purchasing a currency option

Correct Answer: B. Independent verification of bank-detail changes

Question 7

Why can route diversification fail to reduce risk?

A. Different routes always have identical costs.

B. All routes may depend on the same port, canal or transshipment hub.

C. Route diversification eliminates customs requirements.

D. A second route automatically increases sanctions risk.

Correct Answer: B. All routes may depend on the same port, canal or transshipment hub.

Question 8

Which statement about risk scores such as S = L × I is correct?

A. They are always monetary expected-loss estimates.

B. They prove that rare catastrophic risks are unimportant.

C. They are prioritisation tools whose scales require definition and calibration.

D. They eliminate the need for management judgement.

Correct Answer: C. They are prioritisation tools whose scales require definition and calibration.

Question 9

In the illustrative case, why was the alternate supplier not immediately accepted as a complete solution?

A. It refused to use electronic invoices.

B. It failed a production-ramp trial despite passing laboratory tests.

C. It was located in the same country as the incumbent.

D. It offered a lower price than the incumbent.

Correct Answer: B. It failed a production-ramp trial despite passing laboratory tests.

Question 10

Which governance principle is most appropriate for high-consequence AI-supported sanctions screening?

A. Accept every automated match without review.

B. Remove audit trails to protect confidentiality.

C. Use human review, validated data and documented decision records.

D. Delegate all compliance responsibility to the software vendor.

Correct Answer: C. Use human review, validated data and documented decision records.