Risk, Resilience, Ethics, and Governance

Introduction

Inventory control and vendor management are often presented as efficiency disciplines: reduce stock, negotiate lower prices, improve service, and accelerate replenishment. In practice, however, a supply network is also a system of dependencies, exposures, and obligations. A low-cost supplier may be financially fragile; a lean inventory policy may be highly vulnerable to transport disruption; a digitally integrated vendor may create cyber risk; and a technically compliant purchase may still involve forced labour, corruption, environmental harm, or misleading claims.

For entrepreneurial firms, these issues are strategic rather than merely operational. Young and growing firms commonly depend on a small number of suppliers, have limited bargaining power, lack specialist compliance staff, and face severe cash-flow consequences when inventory cannot be obtained or sold. Risk management therefore requires an integrated approach linking sourcing, inventory policy, supplier governance, ethics, information security, quality assurance, and business continuity.

This chapter develops that approach. It distinguishes threats from vulnerabilities and consequences; explains supplier due diligence and dependency management; examines fraud, quality, geopolitical, cyber, and financial risks; presents traceability and continuity methods; and considers responsible purchasing and regulatory compliance. The central argument is that resilience is not the elimination of all risk. It is the capability to anticipate, absorb, adapt to, and recover from disruption while preserving ethical and lawful conduct.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain major risk categories in inventory and vendor management.
2. Assess supplier dependency, disruption exposure, and expected loss.
3. Design proportionate due-diligence, traceability, and control systems.
4. Integrate quality, cybersecurity, fraud prevention, and financial monitoring into vendor governance.
5. Develop business-continuity and recovery strategies.
6. Evaluate ethical, regulatory, and sustainability implications of purchasing decisions.
7. Critically assess the limits of common resilience practices such as dual sourcing, safety stock, and supplier audits.

1. Risk as a supply-network phenomenon

Risk is commonly defined as the effect of uncertainty on objectives. In inventory and vendor management, the relevant objectives may include product availability, cost, quality, cash flow, legal compliance, customer safety, reputation, and environmental or social performance.

A useful analytical distinction is:

• Threat or hazard: a possible damaging event, such as a port closure, counterfeit shipment, ransomware attack, or supplier insolvency.
• Exposure: the extent to which the firm is connected to the threat, for example through geographic concentration or dependence on one supplier.
• Vulnerability: the weakness that allows the threat to cause harm, such as absent backups, weak specifications, or poor segregation of duties.
• Impact: the operational, financial, legal, ethical, or reputational consequence.
• Control: a measure intended to prevent, detect, contain, or recover from the event.
• Residual risk: the risk remaining after controls are implemented.

Risk is not located only inside the buying firm. It can propagate through several tiers of a network. A direct supplier may appear financially sound while relying on a sub-tier processor located in a politically unstable region. Similarly, a vendor may meet delivery targets while using unauthorized subcontractors that create labour or quality risks.

Risk categories

A mature risk system assesses these categories together. For example, moving supply to a cheaper distant country may reduce purchase price but increase geopolitical exposure, lead time, carbon emissions, working capital, and recovery difficulty.

2. Risk assessment and prioritization

A risk register converts broad concern into accountable management. A basic register records the risk statement, cause, event, consequence, owner, existing controls, indicators, treatment, and review date. Risk statements should be causal and specific. “Supplier risk” is weak; “A single overseas processor may be unable to supply the certified component for more than four weeks after a regional disruption” is more useful.

Probability-impact analysis

A common screening method assigns a probability score and an impact score. If p is the estimated probability of an event during a defined period and C is its financial consequence, expected monetary loss is:

Here, EMV is expected monetary value, measured in currency; p is a probability between 0 and 1; and C is the consequence if the event occurs. The calculation assumes that the probability and consequence are defined for the same time horizon and that the consequence estimate is meaningful. It is most useful for comparing risks, not for predicting a precise outcome. Rare events with catastrophic consequences may deserve attention even when their EMV is modest.

If there are mutually exclusive scenarios i = 1, 2, ..., n, the expected loss is:

where pᵢ is the probability of scenario i, Lᵢ is its loss, and the probabilities sum to 1. If scenarios are not mutually exclusive, simply adding their losses can double-count consequences; dependence and interaction must then be considered.

Illustrative example. A supplier disruption has an estimated probability of 0.12 over the next year. Lost contribution margin, emergency freight, and contractual costs are estimated at $180,000. The EMV is:

This does not mean the firm will lose exactly $21,600. It is a decision-support estimate. Management might compare the $21,600 expected loss with the annual cost of qualifying a second supplier and holding additional inventory.

Dependency metrics

Dependency should be examined through several lenses:

• Spend concentration: the proportion of category spend assigned to the largest supplier or region.
• Volume concentration: the proportion of physical supply obtained from one source.
• Switching time: the time required to qualify and activate an alternative.
• Switching cost: tooling, testing, certification, contractual, and technical conversion costs.
• Substitutability: the availability of technically acceptable alternatives.
• Recovery time objective (RTO): the maximum tolerable time before a process or supply capability is restored.
• Recovery point objective (RPO): the maximum tolerable amount of data or transaction history that may be lost after a disruption.

A concentration ratio can be calculated as:

where CR₁ is the largest-supplier concentration, Sₘₐₓ is spend or volume from the largest supplier, and Sₜₒₜₐₗ is total spend or volume in the defined category. It is a descriptive indicator, not a complete risk measure. A category with CR₁ = 0.80 may be acceptable if the item is readily substitutable and alternatives can be activated within days; it may be dangerous if qualification takes a year.

3. Supplier due diligence and governance

Due diligence is the structured process of learning about a supplier, assessing risks, verifying claims, and deciding whether and how to transact. It should be proportionate to the supplier’s criticality, geography, data access, product safety implications, and ethical exposure.

A risk-based due-diligence cycle

1. Classify the supplier. Determine whether it provides a critical component, regulated product, sensitive data, strategic service, or ordinary commodity.
2. Identify ownership and control. Verify legal identity, beneficial ownership where required, directors, associated entities, and conflicts of interest.
3. Assess capability. Review capacity, process controls, quality systems, maintenance, workforce, logistics, and business-continuity arrangements.
4. Assess financial resilience. Examine audited accounts where available, liquidity indicators, debt burden, payment history, insurance, and dependence on a few customers.
5. Screen legal and ethical exposure. Check sanctions and restricted-party requirements applicable to the transaction, litigation, regulatory actions, bribery allegations, labour conditions, environmental performance, and conflicts.
6. Validate evidence. Do not rely solely on supplier declarations. Use certificates, interviews, site visits, independent reports, product testing, and transaction records according to risk.
7. Contract and monitor. Translate requirements into measurable clauses, rights of audit, notification duties, corrective action, and termination provisions.
8. Reassess. Review periodically and when there is a material change in ownership, location, product, process, financial condition, or law.

Due diligence is not equivalent to collecting documents. A certificate may be expired, irrelevant to the product purchased, or obtained through an audit that failed to examine subcontracting. The quality of evidence depends on its independence, relevance, recency, completeness, and verifiability.

Governance architecture

Effective governance allocates authority and accountability. A useful model separates:

• Business owner: accountable for the commercial relationship and risk acceptance.
• Procurement: manages sourcing, competition, negotiation, and supplier performance.
• Quality and technical functions: approve specifications, testing, deviations, and change control.
• Finance: reviews credit exposure, payment controls, and financial health.
• Legal and compliance: interprets regulatory duties, sanctions, contractual protections, and investigations.
• Information security: evaluates system access, data handling, and cyber controls.
• Internal audit or independent assurance: tests whether controls operate effectively.

A board or senior risk committee should receive information about critical dependencies, severe incidents, overdue corrective actions, and accepted residual risks. Governance fails when responsibility is diffused or when commercial targets reward employees for bypassing controls.

4. Internal controls, fraud, and corruption prevention

Fraud risk arises when a person has motive or pressure, opportunity, and rationalization. Supply transactions are exposed to fictitious vendors, duplicate invoices, bribery, bid manipulation, conflicts of interest, counterfeit goods, unauthorized substitutions, and collusion between employees and suppliers.

Important preventive and detective controls include:

• independent supplier creation and approval;
• verification of bank-account changes through a trusted, separate channel;
• competitive quotations or documented single-source justification;
• segregation of requisition, approval, receipt, invoice approval, and payment;
• three-way matching of purchase order, receipt, and invoice;
• tolerance rules for price, quantity, and tax differences;
• duplicate-invoice and unusual-payment analytics;
• conflict-of-interest declarations;
• gifts, hospitality, and facilitation-payment rules;
• protected reporting channels and non-retaliation policies;
• periodic supplier master-data review;
• investigation and disciplinary procedures.

Controls must be designed around risk rather than applied mechanically. Three-way matching may not detect collusion if the receipt is falsely recorded. Conversely, excessive approvals can encourage informal workarounds. Control effectiveness requires both design adequacy and operating evidence.

A useful control principle is least privilege: employees and systems receive only the access necessary for their role. Another is maker-checker separation: the person who creates or changes a transaction should not be the sole person who approves it. Automated controls improve consistency but do not remove the need for governance, because poor data or poorly designed rules can automate error.

5. Quality, traceability, and product integrity

Quality risk is not limited to manufacturing defects. It includes incorrect labelling, contamination, specification drift, unauthorized process changes, poor storage, counterfeit inputs, and incomplete regulatory records. Quality requirements should therefore be expressed in measurable specifications: dimensions, tolerances, materials, performance, packaging, shelf life, test methods, acceptance criteria, and documentation.

Traceability

Traceability is the ability to follow the history, application, location, and relevant transformations of an item, batch, or lot. A robust system links:

supplier and facility → purchase order → shipment and transport record → receipt → lot or serial number → storage location → production or customer allocation → return, recall, or disposal.

Traceability has two directions:

• Backward traceability: identifying the source of an item or material.
• Forward traceability: identifying where an item was used or delivered.

The level of traceability should match risk. Lot-level tracking may be adequate for a stable commodity; serial-level tracking may be necessary for safety-critical equipment. Records should be accurate, timely, protected from unauthorized alteration, and retained for the legally or operationally required period.

Technologies such as barcodes, radio-frequency identification, supplier portals, distributed ledgers, and Internet-of-Things sensors can improve visibility. They do not automatically create trustworthy traceability. A blockchain containing inaccurate entries remains inaccurate; sensors require calibration; and data sharing raises privacy and cybersecurity issues. The governing question is whether the data are complete, validated, accessible to authorized users, and useful for a decision.

Nonconformance and corrective action

When a defect is found, the firm should contain potentially affected stock, preserve evidence, determine scope, notify appropriate parties, investigate root causes, and decide on disposition. Corrective action should address the cause rather than merely replace the defective batch. A supplier’s repeated failure to close corrective actions is a governance signal even if individual shipments pass inspection.

6. Business continuity and resilience design

Business continuity concerns the ability to continue critical activities at an acceptable level during disruption. Resilience includes preparation, response, adaptation, and recovery. A continuity plan should begin with a business impact analysis (BIA) that identifies critical products and processes, dependencies, maximum tolerable downtime, minimum service levels, and recovery priorities.

Continuity strategies

Redundancy uses more than one supplier, facility, route, or system. It lowers dependence but may increase qualification, coordination, and fixed costs.

Buffer inventory protects against uncertainty in demand and replenishment. It is appropriate when the item is valuable, stable, non-obsolete, and difficult to replace. It is less suitable for perishable or rapidly obsolete products.

Postponement delays final configuration, packaging, or customization until demand becomes clearer. It can reduce the risk of holding the wrong finished product.

Substitution and standardization make it easier to use alternative components or suppliers. Design choices that reduce unique parts often improve resilience.

Flexible contracts may include volume bands, allocation rules, emergency capacity, information-sharing requirements, and agreed escalation procedures.

Geographic diversification reduces exposure to a single local event but does not guarantee resilience. Suppliers in different countries may share the same upstream raw material, logistics corridor, cloud provider, or geopolitical exposure.

Recovery planning specifies roles, communication paths, alternate processes, data restoration, customer prioritization, and return to normal operations. Plans should be tested through simulations, not merely stored in a document.

Inventory resilience must be evaluated economically. If annual demand is D, unit cost is c, and the firm adds Q units of buffer, the cash tied up is approximately:

This simple relationship assumes all added units are usable and excludes carrying, insurance, deterioration, and obsolescence costs. The actual decision should compare total resilience cost with avoided disruption loss and service benefits.

7. Geopolitical, financial, and cyber risk

Geopolitical and regulatory risk

Political instability, sanctions, export controls, tariffs, customs restrictions, conflict, and diplomatic change can interrupt supply or make a transaction unlawful. Risk assessment should examine not only the supplier’s country but also ownership, transit routes, origin of critical materials, subcontractors, and the legal regimes governing both parties.

The firm should maintain current product classification, origin documentation, screening processes, contract representations, escalation procedures, and records supporting compliance. Because laws change, “we have always imported this product” is not evidence of continuing legality. Legal counsel or specialist compliance support is appropriate for complex transactions.

Financial risk

Supplier financial distress may appear first as late deliveries, quality deterioration, requests for unusual prepayment, staff turnover, or reduced maintenance. Monitoring can include financial statements, credit information, payment behaviour, concentration of customer revenue, insurance, and dependence on a single lender or facility. The buyer should avoid creating unnecessary fragility through excessive payment delays, unrealistic price pressure, or abrupt volume changes.

Currency and commodity volatility can be managed through pricing clauses, alternative specifications, inventory policies, or financial hedging where the firm has the expertise and governance to use it. Hedging is not a substitute for understanding the underlying exposure.

Cybersecurity and third-party risk

Vendor cyber risk includes unauthorized access to enterprise systems, compromise of software or firmware, ransomware, theft of personal or commercial data, and manipulation of inventory records. Controls should cover:

• risk classification based on data and system access;
• identity verification and multi-factor authentication;
• least-privilege access and timely removal of inactive accounts;
• network segmentation and secure interfaces;
• encryption appropriate to the data and transmission context;
• vulnerability management and patching;
• tested backups and recovery procedures;
• incident notification and coordinated response;
• secure software-development and change-management practices where relevant;
• evidence of independent testing or recognized security controls.

A supplier’s cybersecurity certification may provide evidence but does not eliminate the buyer’s responsibility to assess whether the control scope matches the services purchased.

8. Ethics, responsible purchasing, and compliance

Responsible purchasing recognizes that buying power can affect workers, communities, consumers, and the environment. Ethical procurement is not simply a reputational exercise. It is connected to product safety, continuity, legal exposure, employee dignity, and long-term supplier capability.

Core principles include:

• respect for human rights and prohibition of forced and child labour;
• fair treatment, health, safety, and lawful working conditions;
• anti-bribery and fair competition;
• environmental responsibility and pollution prevention;
• privacy and responsible data use;
• accurate sustainability claims;
• non-discrimination and accessibility where relevant;
• fair, transparent, and proportionate supplier selection.

A supplier code of conduct should be supported by contracts, training, grievance channels, risk-based verification, and remediation. Immediate termination may be necessary for severe abuse, but automatic termination can also hide harm and remove leverage for remedy. A sophisticated program distinguishes between zero-tolerance conduct, remediable deficiencies, supplier capability gaps, and buyer-caused problems such as impossible lead times or pricing that encourages unsafe practices.

Regulatory obligations vary by jurisdiction and sector. They may include product safety, consumer protection, environmental reporting, labour and modern-slavery requirements, anti-corruption law, competition law, privacy and cybersecurity law, customs, sanctions, tax, record retention, and industry-specific licensing. Compliance should be mapped to the actual jurisdictions, products, data, and activities of the enterprise. A generic “compliance certificate” is not a substitute for legal analysis.

9. Measurement, monitoring, and continuous improvement

Risk management requires indicators that reveal changing conditions before a major failure. Useful leading indicators include:

• percentage of critical suppliers with current due diligence;
• concentration by supplier, country, facility, and sub-tier;
• overdue corrective actions;
• supplier financial or delivery deterioration;
• percentage of critical items with qualified alternatives;
• successful continuity-test rate;
• percentage of receipts with complete lot or serial records;
• unauthorized access attempts and unresolved vulnerabilities;
• unusual payment or invoice patterns;
• grievance cases and remediation progress.

Lagging indicators include stockout hours, rejected lots, recall events, fraud losses, regulatory breaches, cyber incidents, and recovery duration. Indicators should have owners, thresholds, data definitions, and escalation rules. Measuring many indicators without decision rights creates reporting theatre.

Audits are valuable but limited. Announced audits can encourage preparation without revealing normal conditions; social audits may miss informal labour; financial data may be delayed; and self-assessments may be biased. Combining document review, worker voice, data analytics, site observation, product testing, and independent investigation produces stronger assurance.

10. Technology and artificial intelligence

Digital procurement and inventory systems can support supplier scoring, anomaly detection, demand sensing, document extraction, and scenario analysis. AI may identify unusual invoice patterns, predict late delivery, classify regulatory documents, or simulate disruption scenarios. However, model outputs are not facts. They depend on data quality, historical stability, feature selection, and governance.

Controls for AI-enabled risk management should include documented purpose, human review for high-consequence decisions, validation against representative data, monitoring for drift and bias, access control, audit logs, explainability appropriate to the decision, and protection of confidential supplier information. A model that penalizes small suppliers because they have less historical data can undermine responsible procurement and competition. AI should augment, not replace, professional judgment, supplier dialogue, and legal accountability.

11. Illustrative case: Northstar Devices

Background

Northstar Devices, an illustrative medium-sized producer of environmental sensors, grew rapidly through an online channel. It sourced a specialized microcontroller from one overseas supplier and used a logistics broker that integrated directly with Northstar’s inventory system. The purchasing team valued the supplier’s low price and stable historical delivery.

Problem

A regional political crisis closed the supplier’s export route. At the same time, the supplier’s production site experienced a ransomware incident. Northstar had only three weeks of component inventory, while qualification of an alternative component was estimated at four months. The logistics broker also retained excessive system privileges. During the disruption, fraudulent bank-account change instructions were sent to Northstar’s accounts-payable team.

Analysis

Northstar’s risk register had recorded “supplier delay” but had not assessed sub-tier dependence, route concentration, cyber access, or switching time. The firm had high supplier concentration and low substitutability. It also lacked lot-level traceability for components used in finished sensors. The probability of a combined geopolitical and cyber event had been judged low, but the consequence was severe and the exposure was poorly understood.

Approach and solution

Northstar created a cross-functional incident team involving procurement, operations, engineering, finance, information security, legal, and customer service. It froze the suspicious payment request and independently verified all bank changes. It segmented the broker’s system access, reset credentials, and initiated forensic review.

Operationally, Northstar prioritized customers supplying essential monitoring services, negotiated allocation with the existing supplier, and used approved inventory from a distributor. Engineering tested a functionally compatible component and began accelerated but controlled qualification. The firm then redesigned its sourcing policy: a second qualified source would be maintained for critical components, and product design would favor more standard interfaces. Contracts were amended to require incident notification, subcontractor disclosure, continuity information, audit rights, and traceability records.

Northstar also introduced quarterly critical-supplier reviews, annual continuity exercises, bank-change callbacks, multi-factor authentication, and a formal RTO for its inventory platform. It did not simply terminate the original supplier. Instead, it required a corrective-action plan, independent cybersecurity evidence, and transparent disclosure of affected lots.

Outcome

Northstar experienced allocation and expedited-freight costs but avoided a complete customer shutdown. The new controls increased procurement and qualification costs. Management judged the increase justified because it reduced switching time, improved visibility, and protected customer safety and revenue. The case also revealed that resilience depended on product engineering, finance, cybersecurity, and ethics—not procurement alone.

Learning points

1. Historical delivery performance does not prove future resilience.
2. Low probability does not make high-consequence exposure unimportant.
3. Supplier, logistics, technology, and payment risks can interact.
4. Redundancy is effective only when alternatives are qualified and usable.
5. Ethical remediation and transparency may be better than reflexive termination.
6. Governance requires defined authority, evidence, testing, and escalation.

12. Challenges and critical limitations

First, resilience is costly. Multiple suppliers, safety stock, audits, testing, and secure systems may reduce short-term margins. Managers must distinguish economically justified resilience from indiscriminate duplication.

Second, risk probabilities are uncertain. Historical frequencies may be unavailable or irrelevant to unprecedented events. Scenario analysis and stress testing should supplement numerical scoring.

Third, transparency can be incomplete. Suppliers may not know their own sub-tier sources, and contractual rights may be difficult to enforce across jurisdictions.

Fourth, auditing can produce false confidence. A passing audit is evidence at a point in time, not a guarantee of ongoing performance.

Fifth, ethical requirements can conflict with continuity. Exiting a supplier may protect the buyer’s reputation while harming workers who lose income. Responsible action requires severity assessment, leverage analysis, stakeholder consultation, and credible remediation.

Finally, optimization may create fragility. Just-in-time replenishment, single-platform integration, highly customized products, and aggressive cost reduction can perform well under stable conditions but fail under disruption. Graduate-level managerial judgment requires evaluating the system across multiple scenarios rather than maximizing one metric.

Best-practice framework

An integrated program can be organized into ten practices:

1. Map critical products, processes, suppliers, facilities, routes, systems, and sub-tiers.
2. Maintain a risk register with owners, indicators, controls, and review dates.
3. Segment suppliers by criticality and exposure, not only annual spend.
4. Apply evidence-based, risk-proportionate due diligence.
5. Build specifications, quality assurance, and traceability into contracts and systems.
6. Design fraud, payment, access, and data controls using segregation and least privilege.
7. Test continuity plans and measure actual recovery performance.
8. Monitor financial, geopolitical, cyber, ethical, and operational signals continuously.
9. Use remedies, incentives, and responsible disengagement rather than relying only on punishment.
10. Report material residual risks to senior decision-makers and review assumptions after every incident.

Chapter Summary

Inventory and vendor risk is a multidimensional governance problem involving disruption, dependency, quality, fraud, finance, geopolitics, cyber threats, ethics, and regulation. Effective analysis distinguishes threats, exposure, vulnerability, impact, controls, and residual risk. Expected monetary value can support prioritization, but rare and catastrophic events require scenario analysis and judgment.

Supplier due diligence should verify identity, capability, financial condition, legal status, ethical performance, cybersecurity, and sub-tier exposure. Governance must allocate responsibility across procurement, operations, quality, finance, legal, information security, and independent assurance. Internal controls such as segregation of duties, three-way matching, least privilege, and protected reporting reduce fraud opportunities, but require testing.

Quality and traceability connect suppliers to lots, production, customers, and recalls. Business continuity combines alternative sources, buffer inventory, postponement, standardization, flexible contracts, data recovery, and tested response plans. Resilience has costs and should be evaluated against avoided disruption and service consequences.

Responsible purchasing treats human rights, environmental performance, anti-corruption, privacy, and product safety as integral to commercial governance. Technology and AI can improve visibility and detection but require data governance, human oversight, and bias controls. Ultimately, resilient vendor management is a strategic capability: it protects continuity while preserving legality, trust, accountability, and ethical responsibility.

Key Terms

Business continuity: The capability to continue critical activities during and after disruption.

Business impact analysis: A structured assessment of process importance, dependencies, downtime tolerance, and recovery priorities.

Control: A preventive, detective, corrective, or recovery measure addressing risk.

Dependency: Reliance on a supplier, location, system, route, material, or capability.

Due diligence: Investigation and verification undertaken before and during a business relationship.

Expected monetary value: Probability-weighted estimate of a possible financial consequence.

Exposure: The extent to which an organization is connected to a threat.

Fraud: Intentional deception for unauthorized gain or to cause loss.

Geopolitical risk: Risk arising from political, diplomatic, conflict, trade, or regulatory conditions.

Least privilege: Granting only the access necessary for an authorized role.

Lot traceability: Ability to track a defined batch through supply, storage, use, and distribution.

Residual risk: Risk remaining after controls are applied.

Resilience: Capacity to anticipate, absorb, adapt to, and recover from disruption.

Recovery point objective: Maximum acceptable amount of data or transaction loss after an incident.

Recovery time objective: Maximum acceptable time for restoring a process or capability.

Risk register: A documented record of risks, causes, consequences, owners, controls, and treatments.

Segregation of duties: Separation of incompatible responsibilities to reduce error and fraud.

Supplier concentration: The degree to which spend or supply is assigned to a small number of sources.

Traceability: Ability to follow the history, location, transformation, and use of an item.

Vulnerability: A weakness that increases the likelihood or impact of a threat.

Review Questions

Short Answer Questions

1. Distinguish a threat, exposure, vulnerability, impact, and residual risk.
2. What information should a risk register contain?
3. Explain backward and forward traceability.
4. Why is segregation of duties important in purchasing and payment?
5. State two limitations of supplier audits.

Long Answer Questions

1. Explain how a firm can design a risk-based supplier due-diligence program.
2. Compare redundancy, buffer inventory, postponement, and standardization as resilience strategies.
3. Discuss the relationship between ethical purchasing and operational resilience.
4. Analyze how geopolitical, financial, cyber, and quality risks can interact in a supply network.
5. Evaluate the role and limitations of AI in vendor-risk management.

Analytical / Application Questions

1. A critical supplier has a 0.10 estimated probability of annual disruption and a potential loss of $250,000. Calculate the expected monetary value and explain why management should not treat it as a guaranteed loss.
2. A firm obtains 75% of a critical component from one supplier, but an alternative can be qualified in two weeks. Another category has four suppliers but requires nine months to qualify a replacement. Which category may be more operationally vulnerable, and what additional evidence would you collect?
3. Design a response plan for a supplier suspected of using forced labour while the supplier is currently the only source of a safety-critical component. Address continuity, worker welfare, investigation, remediation, communication, and future sourcing.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes vulnerability from exposure?

A. Vulnerability is the consequence, while exposure is the control.

B. Vulnerability is a weakness that permits harm, while exposure describes connection to a threat.

C. Vulnerability is the probability of an event, while exposure is its financial loss.

D. Vulnerability and exposure are identical terms.

Correct Answer: B. Vulnerability is a weakness that permits harm, while exposure describes connection to a threat.

Question 2

A disruption has probability 0.08 and a consequence of $100,000. What is its expected monetary value?

A. $800

B. $8,000

C. $80,000

D. $108,000

Correct Answer: B. $8,000

Question 3

Which control most directly reduces the risk of one employee creating and paying a fictitious supplier invoice?

A. Increasing buffer inventory

B. Using a longer payment term

C. Segregating supplier creation, receipt confirmation, invoice approval, and payment

D. Using a single-source contract

Correct Answer: C. Segregating supplier creation, receipt confirmation, invoice approval, and payment

Question 4

Forward traceability enables a firm primarily to identify:

A. The original purchase price only

B. Where a lot or serial-numbered item was used or delivered

C. The probability of supplier insolvency

D. The employee who negotiated the contract

Correct Answer: B. Where a lot or serial-numbered item was used or delivered

Question 5

Which statement about dual sourcing is most accurate?

A. It always eliminates disruption risk.

B. It is effective only when the alternative source is qualified and usable.

C. It necessarily reduces total cost.

D. It removes the need for supplier monitoring.

Correct Answer: B. It is effective only when the alternative source is qualified and usable.

Question 6

The recovery time objective specifies:

A. The maximum acceptable time to restore a process or capability

B. The maximum amount of inventory that may be purchased

C. The time required to negotiate a contract

D. The age of the oldest supplier record

Correct Answer: A. The maximum acceptable time to restore a process or capability

Question 7

Why may a supplier certificate fail to provide sufficient assurance?

A. Certificates are never useful.

B. The certificate may be outside its scope, expired, or unrelated to the purchased product or process.

C. Certificates always increase fraud.

D. Certificates cannot be stored electronically.

Correct Answer: B. The certificate may be outside its scope, expired, or unrelated to the purchased product or process.

Question 8

Which practice best reflects the principle of least privilege?

A. Giving every supplier administrator access to all systems

B. Allowing employees permanent access after role changes

C. Granting users only the system access necessary for their authorized duties

D. Removing all access controls during a disruption

Correct Answer: C. Granting users only the system access necessary for their authorized duties

Question 9

Why should rare, high-consequence risks not be ranked solely by expected monetary value?

A. Their probabilities are always zero.

B. The calculation may understate strategic, ethical, safety, or survival consequences.

C. Expected value cannot use currency.

D. High-consequence events are never manageable.

Correct Answer: B. The calculation may understate strategic, ethical, safety, or survival consequences.

Question 10

Which response is most consistent with responsible purchasing when a serious supplier labour issue is discovered?

A. Ignore it if the supplier is inexpensive.

B. Immediately hide the issue from customers and workers.

C. Assess severity, protect affected people, investigate, pursue credible remediation, and consider responsible disengagement.

D. Transfer the issue to a different supplier without investigation.

Correct Answer: C. Assess severity, protect affected people, investigate, pursue credible remediation, and consider responsible disengagement.