Procurement Risk, Resilience, and Continuity

Introduction

Procurement risk is the possibility that an organisation cannot obtain the goods, services, information, or supplier performance required to achieve its objectives. In contemporary supply networks, procurement risk is no longer limited to late delivery or price increases. A supplier may fail because of insolvency, cyberattack, political conflict, environmental disruption, regulatory action, defective production, or dependence on a single sub-tier source. Since procurement connects external markets with internal operations, risk decisions influence cost, revenue, customer service, safety, reputation, and strategic flexibility.

Resilience is the capability of a supply network to prepare for disruption, absorb its effects, recover, and adapt. Continuity is the organised ability to maintain or restore critical activities within an acceptable time and at an acceptable level of performance. Effective procurement risk management therefore combines prevention, preparedness, response, recovery, and learning.

The central managerial challenge is not to eliminate all risk. Complete elimination is usually impossible and economically inefficient. The challenge is to understand exposure, determine which risks are material, design proportionate controls, and preserve the organisation’s ability to serve customers under adverse conditions.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish procurement risk, resilience, continuity, vulnerability, and criticality.
2. Identify supply, financial, operational, geopolitical, cyber, quality, compliance, and concentration risks.
3. Construct and interpret a procurement risk map and risk register.
4. Apply quantitative measures such as expected loss, risk priority, supplier concentration, and recovery-time analysis.
5. Select mitigation strategies involving qualification, contracts, inventory, capacity, visibility, collaboration, and alternate sourcing.
6. Design business-continuity and supplier-continuity arrangements.
7. Use scenario analysis and stress testing to evaluate procurement decisions.
8. Integrate ethics, governance, technology, and sustainability into risk decisions.

1. The Risk–Resilience–Continuity Relationship

Risk has three related dimensions. Probability concerns how likely an event is; impact concerns the consequences if it occurs; and exposure concerns the organisation’s susceptibility, including its dependence on a supplier, location, material, process, or information system. A low-probability event can be strategically important when its impact is catastrophic and recovery is slow.

Vulnerability is the degree to which a supply system is susceptible to disruption. Criticality is the importance of a purchased item, supplier, process, or service to safety, revenue, compliance, or essential operations. A low-cost component can be highly critical if its absence stops production. Conversely, an expensive item may be readily replaceable and therefore less critical.

Resilience has both defensive and adaptive dimensions. Defensive resilience reduces the likelihood or immediate impact of disruption through controls, redundancy, qualification, and monitoring. Adaptive resilience enables rapid substitution, redesign, rerouting, or process change after conditions have changed.

Continuity management is more specific. It identifies essential activities, defines minimum acceptable service, establishes recovery priorities, assigns responsibilities, and rehearses responses. A continuity plan that has never been tested is an intention rather than a demonstrated capability.

2. Major Categories of Procurement Risk

Supply and capacity risk

Supply risk includes supplier failure, shortages, long lead times, inaccurate forecasts, raw-material scarcity, transport interruption, and insufficient production capacity. It may arise upstream from a supplier’s supplier. Tier-one visibility is therefore insufficient for critical inputs. Lead-time variability is often more damaging than average lead time because it undermines production scheduling and inventory policy.

Financial risk

Financial exposure includes supplier insolvency, liquidity stress, currency volatility, commodity-price movements, inflation, interest-rate changes, and buyer payment failure. A supplier with weak liquidity may reduce maintenance, quality assurance, or inventory before formally defaulting. Financial analysis should therefore examine trends rather than rely only on a single credit score.

Operational and logistics risk

Operational risks include equipment breakdown, labour disruption, poor process capability, inadequate maintenance, warehouse failure, transportation bottlenecks, and dependence on a port, carrier, or route. Outsourcing may lower direct cost while increasing dependence on external operational capabilities.

Geopolitical and external-event risk

Trade restrictions, sanctions, war, civil unrest, export controls, tariffs, border closures, natural disasters, pandemics, and political instability can interrupt supply or make a transaction unlawful. Geopolitical risk is dynamic: a supplier may remain operational while the buyer loses legal permission to purchase from it.

Cyber and information risk

Procurement depends on enterprise-resource-planning systems, supplier portals, electronic data interchange, payment platforms, product specifications, and shared forecasts. Ransomware, credential theft, malicious software, data manipulation, and availability failures can interrupt supply even when physical facilities remain intact. Cyber risk also includes unauthorised access to commercially sensitive prices, designs, and customer data.

Quality and product-safety risk

Defects may result from inadequate specifications, process drift, counterfeit materials, poor change control, weak testing, or unapproved sub-tier sourcing. The effects may include recalls, injury, regulatory action, warranty cost, and reputational damage. Quality risk is especially serious where purchased components affect safety or regulated performance.

Compliance, legal, ethical, and sustainability risk

Procurement may violate anti-bribery laws, sanctions, competition law, labour standards, data-protection requirements, environmental obligations, or modern-slavery legislation. Sustainability risks include carbon exposure, water scarcity, ecosystem damage, and unsafe working conditions. Treating these matters as merely reputational is inadequate: they can cause legal prohibition, supply interruption, financial loss, and loss of stakeholder legitimacy.

Concentration and dependency risk

Concentration exists when a large share of spend, volume, capability, geography, technology, or information is dependent on one source or a small group. Concentration can create economies of scale but reduces bargaining flexibility and increases the consequences of failure. It should be analysed not only at supplier level, but also by country, plant, transport lane, raw material, and ownership group.

3. Risk Identification and Mapping

Risk identification combines internal data, supplier engagement, external intelligence, and structured analysis. Useful sources include purchase orders, delivery performance, defect records, contract terms, financial statements, audit findings, incident databases, sanctions lists, weather data, cyber assessments, and supplier questionnaires. Interviews and site visits remain valuable because formal data may conceal informal dependencies.

A risk register normally records the risk event, cause, affected category or supplier, likelihood, impact, existing controls, risk owner, early-warning indicators, mitigation actions, contingency actions, due date, and residual risk.

A simple risk score is:

Here, P is a probability rating and I is an impact rating. If both are ordinal scores from 1 to 5, R ranges from 1 to 25. This is a prioritisation device, not a probability estimate in the strict statistical sense. Scores are meaningful only when rating definitions are consistent. A 5 for impact should have a documented meaning, such as severe safety, legal, or operational consequences.

Where monetary data are credible, expected loss is more informative:

Here, p_i is the probability of scenario i, L_i is the monetary loss under that scenario, and the probabilities across mutually exclusive scenarios should sum to 1. The measure assumes the scenarios are adequately specified and that losses are measured on a comparable basis. Expected loss does not describe extreme outcomes; a low expected loss may coexist with a ruinous worst case.

Risk maps commonly plot likelihood against impact. The map should not be used mechanically. A risk in a “green” zone may still require treatment if it concerns safety, human rights, sanctions, or legal compliance. In addition, risk interactions matter. A cyberattack may simultaneously cause production stoppage, quality failures, data loss, and regulatory exposure.

A useful prioritisation logic is to assess three quantities separately:

• inherent risk before controls;
• control effectiveness, including prevention and detection; and
• residual risk after controls.

Controls should have named owners and measurable evidence. “Supplier monitored” is weak documentation; “monthly financial review with escalation when current liabilities exceed current assets” is more testable, although the exact threshold must be justified for the industry.

4. Quantitative Assessment for Procurement Decisions

Expected disruption cost

For a disruption with probability p, direct loss C_d, recovery cost C_r, and consequential loss C_c, an illustrative expected disruption cost is:

All cost terms must use the same currency and time basis. The expression is useful for comparing mitigation alternatives, but it can understate uncertainty when costs are nonlinear or when disruption probabilities are poorly estimated.

Concentration measurement

The Herfindahl–Hirschman Index can describe supplier concentration:

Here, s_i is supplier i’s share of spend or volume expressed as a decimal, and the shares sum to 1. A single supplier has HHI = 1, while ten equal suppliers produce HHI = 0.10. HHI is a descriptive indicator, not a universal procurement threshold. Two suppliers in the same flood-prone region may provide less effective diversification than two suppliers in different regions.

Safety stock under variable demand and lead time

For a simple continuous-review system with independent, approximately normal demand and lead time, safety stock may be estimated as:

Here, z is the standard-normal service factor and σ_LT is the standard deviation of demand during lead time, measured in units. If daily demand has mean d̄ and standard deviation σ_d, and lead time has mean L̄ days and standard deviation σ_L, an often-used approximation is:

This assumes demand and lead time are independent, demand variation is suitably represented by a normal approximation, and the chosen service factor corresponds to the desired cycle-service probability. If demand and lead time are correlated, an additional covariance term is required; the simple formula should not then be treated as exact. Inventory is only one resilience mechanism and may not protect against regulatory prohibition, unique-tool failure, or complete supplier shutdown.

Recovery-time analysis

A continuity plan should specify the maximum tolerable period of disruption, often called the maximum tolerable downtime (MTD), and the recovery time objective (RTO). The RTO is the target time to restore a process or service. A credible plan requires:

RTO ≤ MTD

The recovery point objective (RPO) specifies the maximum acceptable amount of data loss measured in time. For example, an RPO of four hours means that, after recovery, no more than four hours of transactions should be missing. RTO concerns restoration time; RPO concerns recoverable data history. They are not interchangeable.

Worked example: evaluating dual sourcing

A manufacturer buys a critical component from one supplier. A disruption has an estimated probability of 0.08 per year. If disruption occurs, direct and recovery costs are estimated at $400,000 and consequential customer-service losses at $600,000. The current expected disruption cost is:

EDC = 0.08 × ($400,000 + $600,000) = $80,000

A second qualified supplier would cost an additional $35,000 annually in qualification, administration, and less favourable unit pricing. Management estimates that dual sourcing would reduce disruption probability to 0.02, while the loss if disruption occurs would remain $1,000,000. The residual expected disruption cost is:

0.02 × $1,000,000 = $20,000

The annual expected benefit is therefore $60,000, and the net expected benefit after the additional annual cost is $25,000. On these assumptions, dual sourcing is economically attractive. The decision still requires analysis of quality equivalence, intellectual-property exposure, capacity availability, qualification time, and whether both suppliers share the same vulnerable sub-tier source. Expected value supports judgment; it does not replace it.

5. Mitigation and Resilience Strategies

Avoidance and design change

Avoidance removes the exposure, for example by eliminating a hazardous material, redesigning a product around commonly available components, or discontinuing a legally inaccessible source. Design for supply resilience includes standardisation, modularity, common specifications, substitutable materials, and engineering approval processes that allow rapid change without compromising safety.

Reduction through supplier management

Supplier qualification should assess technical capability, capacity, financial health, quality systems, cyber controls, compliance, location, business-continuity arrangements, and sub-tier dependencies. Qualification is not a one-time event. Risk changes with ownership, demand, geography, financial conditions, and process changes.

Supplier development may include technical assistance, process improvement, joint forecasting, maintenance support, and shared continuity exercises. Collaboration is especially valuable where the buyer has influence but cannot efficiently replace the supplier.

Transfer and contractual allocation

Contracts can allocate responsibilities through warranties, service-level agreements, insurance requirements, liquidated damages, audit rights, notification duties, change-control clauses, force-majeure language, disaster-recovery obligations, cybersecurity requirements, and termination or step-in rights. Contractual transfer is limited when the supplier lacks the financial capacity to perform or when the event affects the entire market. A clause does not create physical capacity.

Redundancy and diversification

Dual or multiple sourcing reduces dependence, while geographic diversification reduces common-location exposure. However, redundancy can increase unit cost, reduce volume leverage, complicate quality management, and create intellectual-property risks. Effective diversification requires independent capacity, not merely multiple supplier names.

Buffering and flexibility

Inventory, reserved capacity, flexible logistics, alternative tooling, cross-trained personnel, and cash liquidity provide buffers. Buffers should be targeted at critical items and calculated against disruption scenarios. Excess inventory can become obsolete, conceal poor supplier performance, and increase working-capital cost.

Visibility and early warning

Leading indicators may include supplier cash-flow stress, overdue maintenance, abnormal defect trends, workforce turnover, extended payment requests, cyber vulnerabilities, port congestion, weather alerts, sanctions changes, and unexplained order delays. Monitoring should trigger predefined escalation, not simply produce dashboards.

6. Business Continuity and Supplier Continuity

Business-continuity planning begins with a business-impact analysis. The organisation identifies critical products and processes, dependencies, minimum acceptable outputs, maximum tolerable downtime, recovery priorities, resources, and responsible decision-makers. Procurement must be integrated with operations, finance, quality, legal, information security, logistics, communications, and executive leadership.

A procurement continuity plan should include:

1. A list of critical goods, services, suppliers, facilities, systems, and sub-tier dependencies.
2. Contact details and authority levels for normal and emergency conditions.
3. Pre-approved substitutes, alternate suppliers, materials, routes, and specifications.
4. Inventory and reserved-capacity rules for priority items.
5. Emergency purchasing and approval procedures.
6. Quality, regulatory, and engineering release requirements for substitutions.
7. Communication protocols for suppliers, customers, regulators, and employees.
8. Cyber recovery arrangements, including offline contacts and tested backups.
9. Escalation criteria and a documented incident-command structure.
10. Recovery, review, and corrective-action procedures.

Continuity must address both time and performance. Restoring a supplier after ten days is not adequate if the organisation needed restoration within three days. Nor is a substitute acceptable if it fails safety or regulatory requirements.

Exercises should range from tabletop discussions to functional tests and full simulations. A good exercise introduces realistic constraints, records decisions and response times, identifies conflicting priorities, and produces corrective actions with owners and deadlines.

7. Stress Testing and Scenario Analysis

Stress testing asks whether a procurement system remains viable under severe but plausible conditions. Scenarios should be designed around causal mechanisms rather than arbitrary pessimism. Examples include a 30-day port closure, sudden sanctions against a source country, a supplier cyberattack, a 50% demand increase, simultaneous failure of two tier-one suppliers, or loss of a shared raw-material processor.

A scenario analysis process is:

1. Define the system boundary, time horizon, and critical outcomes.
2. Specify the shock and assumptions.
3. Trace first-order and second-order effects through suppliers, logistics, operations, finance, and customers.
4. Estimate service loss, financial exposure, safety consequences, and recovery time.
5. Test existing controls and decision rights.
6. Compare mitigation alternatives and residual exposure.
7. Document triggers, actions, owners, and lessons.

Sensitivity analysis varies uncertain assumptions such as disruption probability, recovery time, demand, and substitution cost. This prevents false precision. Monte Carlo simulation can be appropriate when probability distributions and dependencies are supported by data; it should not be used to give an appearance of rigour to invented inputs.

A resilience strategy should be evaluated using multiple dimensions: time to detect, time to respond, time to recover, percentage of demand served, cash required, quality performance, legal compliance, and customer impact. Cost minimisation alone can select a fragile system.

8. Governance, Ethics, and Regulation

Risk ownership must be explicit. Procurement may coordinate supplier risk, but operational, quality, finance, legal, cyber, and executive owners retain specialised accountability. A risk committee can resolve trade-offs and approve risk acceptance. The board or senior leadership should understand material exposures, scenario results, and the organisation’s tolerance for interruption.

Ethical procurement requires fair supplier treatment, avoidance of bribery and conflicts of interest, protection of confidential information, respect for labour rights, and responsible use of emergency powers. Crisis conditions do not justify unsafe substitutions, discriminatory allocation, price exploitation, or concealment of defects.

Supplier audits should be proportionate and evidence-based. Excessive questionnaires can impose costs without improving control, particularly on small suppliers. Conversely, superficial self-assessment is inadequate for high-risk categories. Remediation should distinguish unwillingness from lack of capability and should provide realistic improvement paths where appropriate.

Data governance is also essential. Supplier financial, employee, security, and personal data must be collected lawfully, accessed appropriately, retained securely, and shared only for legitimate purposes. AI-based risk monitoring can identify anomalies in delivery, pricing, news, or financial data, but models may generate false positives, embed geographic or supplier bias, or rely on incomplete information. Human review, explainability, source validation, and documented escalation remain necessary.

9. Applied Case: The Meridian Medical Devices Network

The following is a fictional illustrative case.

Background

Meridian Medical Devices manufactures infusion pumps. Its procurement strategy emphasised low unit cost and relied on a single qualified supplier in Country A for a specialised pressure sensor. The supplier had performed well for six years. Meridian held only ten days of sensor inventory because the component was expensive and had a twelve-week lead time.

Problem

A geopolitical dispute led Country A to impose export controls on selected electronic components. The supplier remained operational but could no longer obtain a sub-tier ceramic element. At the same time, a ransomware incident disrupted the supplier’s order-management system. Meridian initially treated the problem as a supplier delay rather than a continuity event.

Analysis

The sensor had high criticality because production could not proceed without it and regulators required validated performance. The concentration analysis showed a single-source share of 100%, HHI = 1. The apparent ten-day inventory buffer was inadequate against a twelve-week replenishment interruption. A tier-one questionnaire had not identified the ceramic sub-tier or tested cyber recovery. The risk map rated the exposure as high impact and medium likelihood, but the rating had not been linked to a funded action plan.

Approach and solution

Meridian established an incident team involving procurement, engineering, quality, regulatory affairs, cybersecurity, finance, and operations. It first verified the export-control position and secured lawful allocation of remaining supplier inventory. It then qualified a second supplier in Country B, using accelerated but documented testing. Engineering redesigned the sensor interface so that two technically equivalent components could be used. Meridian negotiated reserved capacity, required sub-tier disclosure for critical materials, and introduced quarterly continuity reviews.

The company also created a manual emergency ordering process, offline supplier contacts, tested backups, and a recovery-time requirement for the supplier’s ordering platform. Inventory policy was revised for the transition period, but the company did not rely on inventory as the permanent solution. A tabletop exercise tested the combined geopolitical and cyber scenario.

Outcome

Meridian experienced a three-week reduction in production but avoided a complete shutdown. The qualified second source reduced concentration and improved bargaining flexibility. The redesign increased engineering cost initially but reduced future substitution time. The exercise identified an additional weakness: the logistics provider used the same regional customs broker for both source countries, so geographic diversification alone had not removed the common dependency.

Learning points

The case demonstrates that supplier continuity depends on sub-tier visibility, lawful substitutability, technical qualification, cyber preparedness, and shared dependencies. A supplier may be financially healthy and still unable to supply. Resilience is a system property, not a characteristic of a single contract. Finally, the least-cost sourcing decision can be economically inferior when interruption costs and regulatory consequences are included.

10. Implementation Guidance and Limitations

A practical implementation sequence is to begin with criticality segmentation, map tier-one and selected sub-tier dependencies, establish a consistent risk taxonomy, assign ownership, assess inherent and residual risk, select treatments, and test continuity plans. The programme should be integrated with category strategy, supplier performance management, internal audit, enterprise risk management, and product design.

Several limitations require caution. Risk scores can create spurious precision and encourage attention to visible risks while ignoring unknown dependencies. Historical data may not represent unprecedented events. Supplier disclosures may be incomplete or strategically selective. Diversification may create common-mode risks rather than remove them. Inventory can protect against delay but not necessarily against legal prohibition or unique capability loss. Insurance and contractual damages may compensate financially without restoring customer service. Finally, resilience investments compete with short-term cost targets; senior management must make the trade-off explicit.

Best practice is therefore not a single model. It is a disciplined cycle of identification, prioritisation, treatment, monitoring, exercising, recovery, and learning. The cycle should be refreshed when products, suppliers, technologies, regulations, ownership, or geopolitical conditions change.

Chapter Summary

Procurement risk encompasses the possibility that external suppliers, markets, systems, or events will prevent an organisation from achieving operational, financial, legal, safety, or strategic objectives. The major categories include supply, financial, operational, geopolitical, cyber, quality, compliance, sustainability, and concentration risk.

Resilience is the ability to prepare for, absorb, recover from, and adapt to disruption. Continuity management translates this principle into critical-process priorities, recovery objectives, alternative resources, authority structures, communications, and tested procedures. Risk mapping and registers help prioritise exposure, while expected-loss analysis, concentration indices, inventory calculations, recovery objectives, scenario analysis, and stress testing support more disciplined decisions.

Mitigation may involve avoidance, supplier qualification, collaboration, contractual controls, diversification, inventory, reserved capacity, design flexibility, visibility, and cyber recovery. No single measure is sufficient. Effective resilience requires independent alternatives, sub-tier visibility, cross-functional governance, ethical conduct, regulatory compliance, and continual exercising. Technology and AI can strengthen monitoring but cannot replace expert judgment and accountable decision-making.

Key Terms

Procurement risk: The possibility that purchasing-related events prevent organisational objectives from being achieved.

Resilience: The capability to prepare for, absorb, recover from, and adapt to disruption.

Business continuity: The organised capability to maintain or restore critical activities during and after disruption.

Vulnerability: The degree to which a system is susceptible to harm or interruption.

Criticality: The importance of an item, supplier, or process to essential outcomes.

Risk register: A structured record of risks, causes, consequences, controls, owners, and actions.

Residual risk: Risk remaining after controls and treatments are applied.

Expected loss: Probability-weighted average loss across defined scenarios.

Concentration risk: Exposure created by dependence on a small number of sources, locations, or capabilities.

HHI: A concentration measure calculated by summing squared supplier shares.

Dual sourcing: Procuring the same requirement from two qualified sources.

Sub-tier supplier: A supplier that provides inputs to a buyer’s direct supplier.

Maximum tolerable downtime: The longest period a critical activity can be unavailable without unacceptable consequences.

Recovery time objective: The target time for restoring a process or service.

Recovery point objective: The maximum acceptable period of data loss measured in time.

Stress testing: Evaluating performance under severe but plausible scenarios.

Common-mode failure: A failure that affects apparently separate sources because they share a dependency.

Control effectiveness: The extent to which a control prevents, detects, or reduces risk.

Supplier continuity: The supplier’s capability to maintain or restore supply after disruption.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Review Questions

5 Short Answer Questions

1. Distinguish procurement risk from procurement resilience.
2. Why can a low-cost component have high procurement criticality?
3. What information should a procurement risk register contain?
4. Distinguish RTO from RPO.
5. Why does tier-one supplier visibility provide an incomplete view of risk?

5 Long Answer Questions

1. Explain the principal categories of procurement risk and show how they can interact during a disruption.
2. Critically evaluate the advantages and disadvantages of dual sourcing, inventory buffering, and supplier collaboration.
3. Describe how an organisation should design and test a supplier-continuity plan.
4. Explain the usefulness and limitations of expected-loss analysis and risk scoring.
5. Discuss how governance, ethics, cybersecurity, and sustainability should be integrated into procurement risk management.

3 Analytical / Application Questions

1. A buyer has three suppliers with volume shares of 0.50, 0.30, and 0.20. Calculate the HHI and explain what the result indicates. Then discuss why geographic independence must also be assessed.
2. A critical item has a 0.05 annual disruption probability. Direct loss is $250,000, recovery cost is $150,000, and consequential loss is $400,000. Calculate expected disruption cost and recommend two non-inventory mitigations.
3. Design a stress-test scenario for a hospital procurement category that combines a supplier cyberattack with a transport disruption. Identify assumptions, critical outcomes, early-warning indicators, and recovery actions.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from continuity?

A. Resilience concerns only financial performance, while continuity concerns only logistics.

B. Resilience includes preparation, absorption, recovery, and adaptation; continuity focuses on maintaining or restoring critical activities.

C. Resilience eliminates all risk, while continuity transfers risk to suppliers.

D. Resilience is a contractual term, while continuity is an inventory calculation.

Correct Answer: B. Resilience includes preparation, absorption, recovery, and adaptation; continuity focuses on maintaining or restoring critical activities.

Question 2

A procurement risk score calculated as R = P × I is primarily used to:

A. Estimate an exact probability distribution

B. Prioritise risks using likelihood and impact ratings

C. Calculate supplier market share

D. Determine the legally enforceable contract price

Correct Answer: B. Prioritise risks using likelihood and impact ratings

Question 3

If supplier shares are 0.50, 0.30, and 0.20, what is the HHI?

A. 0.25

B. 0.31

C. 0.38

D. 1.00

Correct Answer: C. 0.38

Question 4

Which is an example of a common-mode failure?

A. Two suppliers operate in different countries with independent sub-tier networks.

B. A buyer uses two suppliers that both depend on the same raw-material processor.

C. A buyer maintains safety stock for a critical component.

D. A supplier has two production shifts at one plant.

Correct Answer: B. A buyer uses two suppliers that both depend on the same raw-material processor.

Question 5

What does an RPO measure?

A. The time required to restore a process

B. The maximum acceptable period of lost or unrecoverable data

C. The maximum acceptable supplier lead time

D. The time required to qualify an alternate supplier

Correct Answer: B. The maximum acceptable period of lost or unrecoverable data

Question 6

A disruption has probability 0.10 and total loss of $500,000. Under the stated assumptions, expected disruption cost is:

A. $5,000

B. $50,000

C. $100,000

D. $500,000

Correct Answer: B. $50,000

Question 7

Which mitigation most directly reduces dependence on a single qualified source?

A. Increasing the buyer’s payment approval layers

B. Qualifying an independent second source

C. Reducing supplier performance monitoring

D. Extending the existing supplier’s payment terms

Correct Answer: B. Qualifying an independent second source

Question 8

Why should risk maps not be applied mechanically?

A. All risks have identical consequences.

B. Ordinal scores are exact monetary probabilities.

C. Low-scored risks may involve safety, legal, or human-rights consequences, and risks may interact.

D. Risk maps can only be used for transportation risks.

Correct Answer: C. Low-scored risks may involve safety, legal, or human-rights consequences, and risks may interact.

Question 9

Which activity best tests whether a continuity plan is operationally credible?

A. Filing the plan without assigning owners

B. Conducting a realistic exercise and tracking corrective actions

C. Removing alternate suppliers from the approved list

D. Replacing all contractual requirements with informal communications

Correct Answer: B. Conducting a realistic exercise and tracking corrective actions

Question 10

Why can inventory fail to protect against a sanctions event?

A. Inventory always increases lead time.

B. Inventory cannot make an otherwise prohibited transaction lawful.

C. Inventory eliminates product criticality.

D. Inventory prevents all quality inspections.

Correct Answer: B. Inventory cannot make an otherwise prohibited transaction lawful.