Supplier Discovery, Prequalification and Due Diligence

Introduction

Procurement performance depends substantially on the quality of the supplier market from which an organisation sources goods, services and works. A buyer may negotiate an attractive price, but the decision will fail if the selected supplier lacks production capacity, financial stability, ethical controls, cybersecurity safeguards or the resilience required to withstand disruption. Supplier discovery, prequalification and due diligence therefore form a connected decision process rather than three isolated administrative activities.

Supplier discovery identifies organisations that may be able to satisfy a requirement. Prequalification determines whether those organisations meet defined minimum conditions before they participate in a tender or request for quotation. Due diligence investigates whether information supplied by a prospective or existing supplier is reliable and whether the supplier presents acceptable legal, financial, operational, ethical, security and reputational risks.

The objective is not to eliminate all risk. Every commercial relationship contains uncertainty. The professional task is to obtain sufficient evidence, assess material risks proportionately, apply appropriate controls and make a decision that is transparent, defensible and aligned with organisational strategy.

Learning Objectives

By the end of this chapter, the learner should be able to:

• distinguish supplier discovery, prequalification, evaluation and due diligence;
• develop a structured supplier-discovery strategy;
• assess capability, capacity, quality systems and operational resilience;
• examine financial health, ownership, sanctions exposure and beneficial ownership;
• evaluate cybersecurity and sustainability risks in a proportionate manner;
• construct an evidence-based supplier risk assessment;
• recommend approval, conditional approval, development or rejection;
• identify ethical, regulatory, privacy and governance requirements; and
• use technology and AI responsibly in supplier intelligence and monitoring.

1. The Supplier Qualification Architecture

A procurement function should treat qualification as a lifecycle. The principal stages are:

1. Market intelligence: understanding supply markets, technologies, geographic concentrations, substitutes and barriers to entry.
2. Supplier discovery: generating a broad and credible longlist.
3. Initial screening: removing suppliers that clearly fail mandatory requirements.
4. Prequalification: collecting standardised evidence and confirming minimum eligibility.
5. Due diligence: independently testing material claims and investigating risk exposures.
6. Tender evaluation and selection: comparing technically and commercially acceptable offers.
7. Onboarding and contracting: translating identified risks into obligations, controls and remedies.
8. Continuous monitoring: reviewing changes in performance, ownership, financial condition, sanctions, cyber posture and resilience.

Discovery is exploratory; prequalification is threshold-based; due diligence is investigative. Confusing these purposes can produce two opposite errors: admitting unsuitable suppliers or excluding capable suppliers without fair evidence.

Important terminology

A longlist is the broad set of possible suppliers. A shortlist is the smaller set invited to compete or proceed to detailed evaluation. A mandatory criterion is a pass/fail condition, such as a required licence. A weighted criterion contributes proportionately to an evaluation score. Beneficial ownership refers to the natural person or persons who ultimately own or control an entity, even when ownership is held through other companies. Operational resilience is the ability to continue or recover critical operations within an acceptable time after disruption.

2. Supplier Discovery: Finding the Relevant Market

Supplier discovery should begin with the requirement, not with a familiar supplier. The buyer first clarifies the specification, demand profile, service levels, geographic constraints, regulatory obligations, contract duration and expected total cost. Poorly defined requirements lead to narrow searches and false confidence.

Sources of supplier intelligence

Useful sources include:

• existing supplier databases and approved lists;
• industry associations, trade directories and professional networks;
• exhibitions, technical conferences and supplier days;
• chambers of commerce and export-promotion agencies;
• public procurement portals and published contract awards;
• independent market research and analyst reports;
• referrals from engineering, operations and quality professionals;
• technology platforms and digital marketplaces; and
• suppliers identified through benchmarking or competitor analysis.

No single source is sufficient. A directory may contain outdated information; a supplier’s website may present only favourable claims; and a referral may reflect personal preference. Triangulation—checking important information through multiple independent sources—improves reliability.

Discovery strategy

A robust search defines:

• product or service categories and technical synonyms;
• required certifications, licences and regulatory approvals;
• target regions and acceptable logistics routes;
• preferred supplier characteristics, such as local content or innovation capability;
• prohibited conditions, such as sanctioned jurisdictions or unacceptable labour practices;
• likely market structure, including manufacturers, distributors, agents and subcontractors; and
• the evidence required to move from discovery to qualification.

Buyers should actively search beyond incumbent suppliers. Excessive dependence on an established supplier can reduce competition, conceal market alternatives and weaken negotiation power. However, a new supplier should not be treated as attractive merely because it offers a lower price. Discovery creates options; it does not establish suitability.

Market engagement and fairness

Early supplier engagement can clarify technical feasibility, identify alternative specifications and improve the quality of a solicitation. Engagement must be conducted consistently and ethically. Material information disclosed to one potential bidder should normally be made available to all eligible bidders, subject to confidentiality and intellectual-property obligations. Procurement personnel should document meetings, attendees, information shared and any conflicts of interest.

3. Prequalification Design

Prequalification is a structured gateway. It should ask only for information relevant to the purchasing risk and should avoid imposing unnecessary barriers on small, innovative or diverse suppliers.

Mandatory and weighted criteria

Typical mandatory criteria include legal registration, required licences, minimum insurance, acceptance of key contractual conditions, absence of disqualifying sanctions and evidence of capacity for the required scope. Weighted criteria may include technical capability, quality maturity, delivery performance, sustainability, innovation, local support and total cost.

A criterion should be:

• relevant to the requirement;
• measurable or supported by defined evidence;
• proportionate to risk and contract value;
• applied consistently to comparable suppliers; and
• capable of being audited.

For a weighted model, a supplier’s overall score may be calculated as:

where S is the total score, wᵢ is the weight assigned to criterion i, rᵢ is the supplier’s rating for criterion i, and the weights sum to 1 (or 100%). The ratings must use a consistent scale, such as 0 to 5. The formula assumes that criteria are sufficiently comparable for additive scoring and that minimum mandatory requirements have already been passed. A high weighted score must not override a failed mandatory legal or safety condition.

Illustration. Suppose technical capability has a weight of 0.40 and a rating of 4/5, quality has a weight of 0.25 and a rating of 3/5, and resilience has a weight of 0.35 and a rating of 5/5. If ratings are converted to percentages, the score is:

• technical: 0.40 × 80 = 32;
• quality: 0.25 × 60 = 15;
• resilience: 0.35 × 100 = 35.

The total is 82 out of 100. This result is meaningful only if the evidence behind each rating is credible.

Evidence hierarchy

Evidence generally becomes stronger as it moves from assertion to independent verification:

1. supplier declaration;
2. documentary evidence supplied by the supplier;
3. customer references and performance records;
4. independent database or registry checks;
5. site visit, audit or technical demonstration; and
6. corroborated evidence from several independent sources.

The appropriate level depends on risk. A low-value office-supply purchase may need basic registration and capability checks. A supplier of medical devices, critical infrastructure, controlled chemicals or cloud services requires significantly deeper scrutiny.

4. Assessing Supplier Capability and Capacity

Capability concerns whether the supplier can perform the required work correctly. It includes technical knowledge, equipment, qualified personnel, process maturity, intellectual property and relevant experience. Capacity concerns whether the supplier can provide the required volume, service level and continuity within the required time.

Questions for capability assessment include:

• Has the supplier completed comparable projects?
• Does it possess the required technical licences and equipment?
• Are personnel appropriately qualified and available?
• Can it demonstrate design, testing, inspection and change-control processes?
• Does it rely on undisclosed subcontractors or intermediaries?
• Can it provide traceability for materials, components and records?

Capacity assessment should examine installed production capacity, current utilisation, lead times, labour availability, critical equipment, maintenance arrangements, inventory policies and dependence on a single site. A supplier may have impressive annual capacity but insufficient available capacity during the buyer’s delivery window.

A useful analysis compares required demand with reliable available capacity. If annual requirement is 12,000 units and the supplier’s demonstrated available capacity is 15,000 units, the apparent headroom is 3,000 units. That margin may be inadequate if the supplier has major customers, seasonal peaks, a single production line or uncertain labour availability. Capacity evidence should therefore be time-specific and linked to the proposed contract period.

5. Financial Health and Commercial Viability

Financial due diligence seeks to determine whether a supplier is likely to remain solvent and able to finance performance. It is not an attempt to predict the future with certainty.

Relevant evidence may include audited financial statements, management accounts, credit reports, banking references, insurance certificates, tax compliance evidence, ownership information and records of insolvency or litigation. Important indicators include revenue trend, profitability, liquidity, leverage, cash generation, customer concentration and dependence on advance payments.

Common ratios include:

The current ratio is dimensionless and indicates short-term coverage in accounting terms; the debt-to-equity ratio is also dimensionless and indicates financial leverage. Neither ratio has a universal pass mark. Interpretation depends on sector norms, asset structure, payment terms, seasonality and the reliability of reported figures. Ratios should be compared across several periods and, where possible, against relevant industry benchmarks.

For example, current assets of $2.4 million and current liabilities of $1.6 million produce a current ratio of 1.5. This does not prove that the supplier is financially safe: inventory may be slow-moving, receivables may be doubtful, or major debt maturities may be imminent. Financial review should therefore combine quantitative analysis with qualitative investigation.

Commercial safeguards may include parent guarantees, performance bonds, retention, milestone payments, escrow arrangements, limits on advance payment and rights to obtain financial information during the contract.

6. Quality Management and Technical Assurance

Quality due diligence examines the supplier’s ability to produce conforming outputs consistently, not merely whether it holds a certificate. Evidence may include a quality-management certificate, audit reports, non-conformance data, corrective-action records, calibration records, inspection and test plans, process capability studies and customer complaints.

A certification such as ISO 9001 can provide useful evidence of a quality-management system, but certification does not guarantee flawless products or services. The buyer should verify the scope, validity, issuing body and sites covered. It should also assess whether the supplier’s actual processes reflect documented procedures.

A mature quality system normally includes:

• documented responsibilities and process controls;
• competence and training records;
• supplier and subcontractor control;
• design and change management;
• inspection, testing and traceability;
• non-conformance handling and root-cause analysis;
• corrective and preventive action; and
• management review and continual improvement.

For critical goods, a pre-award technical audit or sample inspection may be justified. Contractual requirements should specify acceptance criteria, inspection rights, reporting, warranty obligations and remedies for non-conformance.

7. Cybersecurity and Information Risk

Supplier cybersecurity is a procurement issue because suppliers may access personal data, confidential designs, operational technology, credentials or corporate networks. Risk assessment should consider the information handled, connectivity, system criticality, location of data, subcontractors and consequences of compromise.

Evidence can include security policies, independent assurance reports, penetration-test summaries, vulnerability-management practices, identity and access controls, encryption, backup arrangements, incident-response plans, staff awareness training and data-protection compliance. The buyer should distinguish between a policy document and evidence that the policy operates effectively.

Contractual controls may address:

• least-privilege access and multifactor authentication;
• segregation of customer environments;
• breach notification within a defined period;
• secure development and patching obligations;
• data location, retention and deletion;
• audit and assessment rights;
• flow-down obligations to subcontractors; and
• exit support and secure transfer or destruction of data.

Cloud and digital suppliers require special attention to concentration risk. Several business units may depend on the same platform or underlying infrastructure. Business continuity should therefore address both the direct supplier and critical fourth parties.

8. Sustainability, Human Rights and Responsible Sourcing

Sustainability due diligence covers environmental, social and governance impacts throughout the supply chain. Topics may include greenhouse-gas emissions, energy and water use, waste, hazardous substances, biodiversity, modern slavery, child labour, working hours, occupational health and safety, freedom of association, anti-bribery and responsible sourcing of minerals.

The buyer should examine whether claims are specific, measurable and independently supported. A broad statement such as “environmentally friendly” is weaker than verified data about energy use, recycled content, emissions methodology or product life-cycle impacts. Suppliers should identify significant subcontractors and high-risk upstream sources where relevant.

Responsible sourcing is not achieved by transferring all responsibility to a supplier through a contractual clause. Effective practice combines supplier standards, risk mapping, worker-centred grievance channels, audits, remediation and escalation. Immediate termination may sometimes be necessary, but in other cases responsible engagement and corrective action can improve conditions more effectively than disengagement.

9. Ownership, Integrity and Sanctions Exposure

Ownership and control analysis protects the organisation from undisclosed conflicts, corruption, fraud, money laundering and prohibited dealings. The procurement team should identify the legal entity contracting with the organisation, its directors, parent entities, beneficial owners, agents and relevant related parties.

Checks may include corporate registries, beneficial-ownership records where available, litigation databases, politically exposed person screening, adverse-media review, sanctions lists and debarment registers. Screening must be jurisdictionally appropriate and periodically refreshed because ownership and sanctions status can change.

A potential name match is not proof of a sanctions violation. It requires resolution using identifiers such as date of birth, nationality, registration number, address and ownership percentage. Conversely, absence from a database is not proof of ethical conduct. Human review, documented escalation and legal advice may be required.

Red flags include requests for payment to unrelated accounts, opaque ownership structures, unusually complex intermediaries, reluctance to disclose controlling persons, inconsistent registration details, unexplained commissions, gifts to decision-makers and pressure to bypass normal controls.

10. Operational Resilience and Business Continuity

Resilience assessment asks how the supplier will prevent, absorb, respond to and recover from disruption. Relevant threats include natural hazards, geopolitical instability, cyberattack, industrial action, epidemic disease, transport interruption, utility failure, raw-material scarcity and insolvency.

Evidence may include business-continuity plans, disaster-recovery tests, recovery time and recovery point objectives, alternate sites, safety stock, multiple transport routes, dual sourcing, emergency contacts, insurance and lessons learned from previous incidents. A plan that has never been tested provides limited assurance.

A buyer should map critical dependencies beyond the first-tier supplier. A manufacturer may depend on a sole-source component producer; a logistics provider may depend on one port; and a software provider may depend on a single cloud region. Contractual rights should cover notification of material changes, continuity testing, substitution, contingency stock, step-in rights and orderly transition.

11. Integrated Risk Assessment and Decision-Making

Due diligence findings should be consolidated into a risk register. Each risk should state the issue, evidence, likelihood, consequence, owner, treatment and residual risk. A simple qualitative matrix can classify likelihood and impact as low, medium or high, but the organisation should define these terms consistently.

Where a numerical model is used, an expected-loss estimate can be expressed as:

Probability is expressed between 0 and 1, while consequence must use a defined unit, such as currency, downtime hours or a carefully constructed impact scale. The model assumes that the probability and consequence estimates are sufficiently meaningful and that uncertainty is acknowledged. It should not be presented as a precise forecast when evidence is weak.

For example, if a disruption is estimated to have a probability of 0.10 in a contract year and the financial consequence is estimated at $500,000, the expected loss is $50,000. This figure supports comparison of controls; it does not mean that the organisation will actually lose exactly $50,000.

Possible decisions include:

• approve without special conditions;
• approve with controls or a remediation plan;
• approve for a limited scope or pilot;
• defer pending evidence;
• develop the supplier through capability-building; or
• reject or disqualify.

The decision record should explain the evidence, thresholds, risk acceptance authority, conflicts considered and controls imposed. Procurement, technical, finance, legal, information security and sustainability specialists should participate according to the risk profile.

12. Technology, Data and Artificial Intelligence

Supplier-management platforms can centralise questionnaires, certificates, expiry dates, audit findings, sanctions alerts, performance data and workflow approvals. Automated monitoring can identify changes in corporate registration, adverse media, cyber incidents or financial distress.

Artificial intelligence may assist with document classification, duplicate detection, anomaly identification, summarisation and prioritisation of review. It must not be treated as an autonomous decision-maker. Risks include inaccurate extraction, biased training data, fabricated citations, false positives, privacy breaches and inability to explain a recommendation. Human reviewers should verify material findings against primary evidence, maintain an audit trail and provide a route for supplier challenge or correction.

Data governance should specify lawful collection, purpose limitation, access controls, retention, accuracy, cross-border transfers and secure deletion. Supplier data often contains personal and commercially sensitive information, so procurement analytics must comply with applicable privacy and security requirements.

13. Applied Case: Northstar Medical Equipment (Illustrative)

Background

Northstar Medical Equipment, a fictional regional hospital group, needed a supplier of sterilisation components for a three-year contract. The components were safety-critical, and failure could interrupt surgery. Four suppliers were discovered through an industry association, a public tender database and technical referrals.

Problem

The lowest-priced supplier, MedAxis Components, claimed high annual capacity and an international quality certification. Initial screening also revealed that its proposed distributor was not the same legal entity as the manufacturer. A sanctions-screening tool produced a possible match involving a director with a similar name.

Analysis

The procurement team required legal-entity identification, beneficial-ownership disclosure, certification scope, production records, financial statements, cybersecurity controls for the supplier portal and evidence of continuity planning. A site audit found that MedAxis had adequate equipment but operated one critical production line at 92% utilisation. Its stated annual capacity did not reflect existing customer commitments.

The possible sanctions match was investigated using nationality, date of birth and corporate identifiers. It was determined to be a false positive involving a different person. However, the ownership review showed that the distributor controlled customer communications and received payments, while the manufacturer remained responsible for production. This relationship required clear contractual allocation of liability.

The supplier’s quality system was certified, but audit records showed repeated late closure of corrective actions. Financial review indicated acceptable profitability but weak liquidity. The resilience plan depended on a single sterilisation subcontractor.

Approach and solution

Northstar did not automatically reject MedAxis. It required a restricted pilot, independent inspection of initial batches, a performance bond, evidence of corrective-action closure, disclosure of the subcontractor, dual-source planning and quarterly financial and resilience reviews. Payments were made to the contracting legal entity only. The contract included audit rights, incident notification, change-of-control notification and termination rights for unresolved safety or compliance failures.

Outcome

The pilot met technical requirements, but two batches were delayed because the subcontractor experienced a maintenance outage. Northstar activated its contingency supplier and required MedAxis to qualify a second sterilisation provider. After corrective action and a successful continuity test, the supplier was approved for the full contract with enhanced monitoring.

Learning points

The case demonstrates that discovery information is not sufficient evidence; capacity claims must be tested against committed demand; a false sanctions match requires investigation rather than automatic rejection; certification does not replace performance evidence; and a conditional approval can be more appropriate than either unrestricted approval or immediate exclusion.

14. Governance, Ethics and Regulatory Considerations

Supplier qualification must be fair, confidential, proportionate and auditable. Procurement professionals should declare conflicts of interest, avoid gifts and inducements, protect commercially sensitive information and apply criteria consistently. Public-sector procurement may additionally require equal treatment, transparency, competition, debarment checks, records retention and formal remedies.

Privacy laws may restrict collection and processing of personal information about directors, beneficial owners and employees. Competition law may be relevant when buyers exchange sensitive supplier information or coordinate market activity. Anti-bribery laws may apply to agents, intermediaries and third parties acting on the organisation’s behalf. Export controls and sanctions rules may restrict products, technologies, services or payments even where the supplier itself is not listed.

A supplier should have a reasonable opportunity to clarify errors or challenge factual findings, subject to legal and security constraints. Decisions should be based on relevant evidence rather than nationality, personal relationships, unsupported reputation or discriminatory assumptions.

15. Limitations and Best Practices

No due-diligence process provides certainty. Information may be incomplete, financial statements may lag current conditions, audits may observe only a sample, certificates may be misused and risks may arise in lower tiers that are difficult to see. Excessive questionnaires can create administrative burden without improving assurance, while insufficient scrutiny can expose the organisation to severe loss.

Best practice is to:

• apply a risk-based and proportionate process;
• define requirements before reviewing suppliers;
• use independent and current evidence;
• distinguish mandatory gates from weighted preferences;
• investigate anomalies rather than relying on automated matches;
• assess subcontractors and critical fourth parties;
• record assumptions, uncertainty and decision authority;
• convert findings into contractual controls;
• monitor suppliers throughout the relationship; and
• review the qualification model after incidents and lessons learned.

Chapter Summary

Supplier discovery creates a credible market of potential providers. Prequalification applies transparent minimum requirements, while due diligence independently examines whether supplier claims and risk controls are reliable. Effective assessment covers capability, capacity, financial health, quality management, cybersecurity, sustainability, ownership, sanctions exposure and operational resilience.

A professional process is risk-based, evidence-led and proportionate. Weighted scoring can support comparison, but it cannot compensate for a failed mandatory requirement or weak evidence. Financial ratios and expected-loss calculations are useful analytical aids only when their assumptions and limitations are understood. Technology and AI can improve monitoring and workflow, but material decisions require human review, data governance and an audit trail. Finally, qualification is not a one-time event: supplier risks change, so approval must be supported by contractual controls, performance management and continuous monitoring.

Key Terms

Supplier discovery: The process of identifying organisations that may satisfy a procurement requirement.

Longlist: The broad set of potential suppliers identified during market research.

Shortlist: The smaller group selected for detailed evaluation or competition.

Prequalification: A structured assessment of whether a supplier meets minimum participation requirements.

Due diligence: Investigation and verification of a supplier’s legal, financial, operational and ethical position.

Mandatory criterion: A pass/fail requirement that must be satisfied.

Weighted criterion: An evaluation factor that contributes proportionately to an overall score.

Capability: The technical and organisational ability to perform required work.

Capacity: The available volume, resources and time to fulfil demand.

Beneficial ownership: Ultimate ownership or control by a natural person or persons.

Sanctions screening: Checking persons, entities, goods or jurisdictions against applicable restrictions.

Quality-management system: Organised processes used to control and improve conformity and performance.

Operational resilience: The ability to withstand, respond to and recover from disruption.

Fourth party: A supplier’s supplier or other indirect provider critical to performance.

Residual risk: Risk remaining after controls and treatments are applied.

Corrective action: Action taken to eliminate the cause of a detected non-conformity.

Supplier segmentation: Grouping suppliers according to value, criticality, risk or other relevant characteristics.

Conditional approval: Permission to proceed subject to specified controls, evidence or remediation.

Review Questions

Short Answer Questions

1. Distinguish supplier discovery, prequalification and due diligence.
2. Why should mandatory criteria not be overridden by a high weighted score?
3. Identify four types of evidence that may be used in supplier due diligence.
4. What is the difference between supplier capability and supplier capacity?
5. Why does supplier certification not by itself guarantee satisfactory performance?

Long Answer Questions

1. Explain how an organisation can design a proportionate supplier prequalification process for a safety-critical purchase.
2. Discuss the principal financial, ownership and sanctions checks that should be conducted before supplier approval.
3. Evaluate the role of cybersecurity and fourth-party risk in supplier qualification.
4. Explain how sustainability and human-rights considerations can be incorporated without creating arbitrary barriers to competition.
5. Discuss the benefits and limitations of using weighted scoring and numerical risk models in supplier selection.

Analytical / Application Questions

1. A supplier has excellent technical capability but weak liquidity, a single production site and an undisclosed subcontractor. Recommend a decision and specify the controls or additional evidence you would require.
2. A sanctions-screening system identifies a possible match for a supplier director, but the name is common and other identifiers differ. Design an investigation and escalation process.
3. A cloud-service supplier refuses to provide a full penetration-test report but offers an independent assurance report, incident-notification commitments and audit rights. Assess whether conditional approval is justified and explain your reasoning.

Multiple Choice Questions with Answers

Question 1

Which activity primarily generates a broad set of potential suppliers?

A. Supplier discovery

B. Contract close-out

C. Invoice reconciliation

D. Post-award dispute resolution

Correct Answer: A. Supplier discovery

Question 2

What is the principal purpose of prequalification?

A. To guarantee the lowest purchase price

B. To confirm that suppliers meet defined minimum requirements

C. To replace contract management

D. To eliminate all supplier risk

Correct Answer: B. To confirm that suppliers meet defined minimum requirements

Question 3

A supplier has current assets of $2.4 million and current liabilities of $1.6 million. What is its current ratio?

A. 0.67

B. 1.20

C. 1.50

D. 4.00

Correct Answer: C. 1.50

Question 4

Which statement about a weighted evaluation score is correct?

A. It can automatically override a failed legal requirement

B. It is meaningful without evidence supporting ratings

C. It combines criterion ratings according to assigned weights

D. It must use financial criteria only

Correct Answer: C. It combines criterion ratings according to assigned weights

Question 5

Who is the beneficial owner of an organisation?

A. Any employee who signs a purchase order

B. The natural person who ultimately owns or controls it

C. The external auditor only

D. The logistics provider

Correct Answer: B. The natural person who ultimately owns or controls it

Question 6

Which evidence most directly tests whether a supplier’s continuity plan works?

A. A marketing brochure

B. An unverified verbal statement

C. A completed and documented continuity or recovery test

D. A historic product catalogue

Correct Answer: C. A completed and documented continuity or recovery test

Question 7

What is a major limitation of relying only on a quality certification?

A. Certification always prevents competition

B. Certification does not guarantee flawless current performance

C. Certification proves financial solvency

D. Certification identifies all beneficial owners

Correct Answer: B. Certification does not guarantee flawless current performance

Question 8

If an event has probability 0.10 and consequence of $500,000, what is the expected loss under the chapter’s simple model?

A. $5,000

B. $50,000

C. $500,000

D. $5,000,000

Correct Answer: B. $50,000

Question 9

How should a potential sanctions name match normally be handled?

A. Treat it as confirmed without review

B. Ignore it because databases are imperfect

C. Resolve it using additional identifiers and escalation where necessary

D. Publish the supplier’s personal information

Correct Answer: C. Resolve it using additional identifiers and escalation where necessary

Question 10

Why should AI-assisted supplier screening retain human review?

A. AI cannot process any documents

B. Automated outputs may contain errors, bias or false positives

C. Human review removes the need for evidence

D. AI is legally prohibited in all procurement

Correct Answer: B. Automated outputs may contain errors, bias or false positives