Supplier Relationship, Performance and Risk Management

Introduction and Context

Procurement has evolved from transactional buying to the strategic management of external capabilities. In many organisations, suppliers provide critical materials, technology, logistics, engineering, data, and innovation. Consequently, supplier management is not limited to monitoring delivery and price. It involves designing relationships, measuring performance, controlling risk, developing capability, protecting continuity, and creating mutual value.

Supplier relationship, performance, and risk management are closely connected. A supplier relationship defines how the buying organisation and supplier interact. Performance management converts expectations into measurable standards and improvement actions. Risk management identifies events that may interrupt supply, damage reputation, create legal exposure, or reduce value. These activities should operate as an integrated governance system rather than as isolated administrative processes.

For procurement professionals, the central challenge is balance. Not every supplier requires a strategic partnership, and excessive monitoring can waste resources. Conversely, treating a critical supplier as an ordinary vendor may expose the organisation to severe operational and financial consequences. Effective management therefore depends on segmentation, proportional controls, reliable data, transparent communication, and disciplined decision-making.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Segment suppliers according to business importance, supply risk, value, and relationship requirements.
2. Design supplier key performance indicators (KPIs), scorecards, targets, and review mechanisms.
3. Conduct structured supplier performance reviews and manage corrective and preventive actions.
4. Distinguish supplier development, collaboration, innovation, and supplier replacement decisions.
5. Assess supply risk using likelihood, impact, exposure, and control effectiveness.
6. Design business continuity and supply-chain resilience measures.
7. Explain the governance, ethical, technological, and professional implications of supplier management.

1. The Supplier Relationship Management Concept

Supplier relationship management (SRM) is the systematic approach used to govern interactions with suppliers in order to achieve agreed commercial, operational, strategic, and social outcomes. SRM includes supplier selection, contracting, communication, performance evaluation, issue resolution, development, innovation, and exit management.

SRM is broader than supplier administration. Administration records purchase orders, invoices, certificates, and contracts. SRM asks whether the supplier relationship is producing the intended value and whether the relationship remains appropriate as conditions change.

A relationship may be:

• Transactional: standardised purchases, limited interaction, and low switching difficulty.
• Operational: regular coordination is needed to maintain service, quality, or delivery.
• Collaborative: both parties share information and jointly improve processes.
• Strategic: the supplier provides scarce, critical, or innovative capability and requires executive governance.

These categories are not permanent labels. A supplier may move from transactional to strategic if a product becomes business-critical, or from strategic to operational when alternative sources are developed.

Relationship governance

A well-governed relationship normally defines:

• ownership and decision rights;
• communication frequency and escalation routes;
• performance measures and evidence requirements;
• information-sharing rules;
• commercial review arrangements;
• confidentiality, intellectual property, and data protection controls;
• change-control and approval processes; and
• termination, transition, and continuity provisions.

Governance must be proportionate. A critical technology supplier may require quarterly executive reviews and detailed operational meetings, whereas a low-value stationery supplier may be managed through catalogue controls and periodic market testing.

2. Supplier Segmentation and Portfolio Thinking

Supplier segmentation groups suppliers with similar management requirements. The objective is not merely to rank suppliers, but to determine the appropriate relationship model, control intensity, resource allocation, and risk response.

2.1 Segmentation criteria

Common criteria include:

• annual expenditure and total cost of ownership;
• supply criticality and effect of failure;
• availability of substitutes;
• switching time and switching cost;
• technological or intellectual-property dependence;
• quality and regulatory sensitivity;
• geographic and logistical exposure;
• financial and operational capability;
• innovation potential; and
• environmental, labour, human-rights, and reputational risk.

Spend alone is insufficient. A low-spend supplier may provide a safety-critical component, a legally required service, or a unique software interface. Conversely, a high-spend commodity may have many interchangeable suppliers and low continuity risk.

2.2 Kraljic portfolio logic

The Kraljic purchasing portfolio model classifies categories using two broad dimensions: profit impact and supply risk. It commonly identifies four categories:

The model is a decision aid, not a substitute for judgement. A category can move between quadrants as markets, technology, regulation, or organisational strategy changes.

2.3 A practical segmentation process

A robust process contains five steps:

1. Define the unit of analysis. Segment suppliers, categories, sites, or individual contracts consistently.
2. Collect evidence. Use spend data, incident records, market intelligence, audit findings, dependency information, and stakeholder assessments.
3. Assess importance and risk. Apply documented scales and record the reasons for each rating.
4. Assign a relationship strategy. Specify governance, KPIs, review frequency, development actions, and contingency requirements.
5. Reassess periodically. Review segmentation after major incidents, contract changes, mergers, geopolitical events, or technology shifts.

A segmentation register should contain the supplier, category, critical services, risk rating, relationship type, executive owner, contract status, review frequency, and required actions.

3. Performance Management: From Expectations to Evidence

Supplier performance management converts contract requirements and business needs into observable measures. A KPI is useful only when it is relevant, measurable, consistently defined, attributable to the supplier, and connected to a decision or improvement action.

3.1 Characteristics of effective KPIs

A strong KPI should have:

• a precise definition;
• a stated data source;
• a measurement period;
• a responsible owner;
• a target and tolerance;
• a reporting frequency;
• an agreed calculation method; and
• an escalation or action rule.

The distinction between a KPI and a metric is important. A metric is any measurement. A KPI is a strategically significant metric used to evaluate achievement and guide management action.

3.2 Common supplier KPI families

Measures should not encourage dysfunctional behaviour. For example, measuring only purchase price may encourage a supplier to reduce quality, increase packaging waste, or impose hidden logistics costs.

3.3 KPI definitions and formulas

For delivery performance, one possible definition is the on-time delivery rate:

The numerator counts deliveries meeting the agreed date or agreed delivery window. The denominator excludes cancelled orders or events explicitly outside the supplier’s responsibility, provided the exclusion rules are documented before measurement. The unit is percent, and the formula assumes that delivery records are complete and dates are consistently defined.

A quality defect rate may be calculated as:

The organisation must state whether defects are counted by unit, batch, shipment, or incident. These bases are not interchangeable. A single defective unit in a shipment and a shipment containing thousands of defective units can produce very different management implications.

A weighted supplier score can combine standardised performance results:

Here, S is the overall score, wᵢ is the weight assigned to criterion i, and rᵢ is the supplier’s rating for that criterion. The weights should sum to 1, or to 100% when expressed as percentages. Ratings must use a common scale, such as 0 to 100. The model assumes that criteria are sufficiently defined and that weighted addition is an acceptable approximation of decision-maker preferences.

Worked example. Suppose delivery is weighted 30%, quality 35%, cost 20%, and responsiveness 15%. A supplier receives ratings of 92, 86, 78, and 90 respectively. Its score is:

The score is 86.8 out of 100. If the organisation classifies 85–100 as green, the supplier is green overall. However, the quality rating of 86 may still conceal a serious safety-related defect. Therefore, an overall score must not override mandatory requirements or critical-failure rules.

3.4 Scorecard design

A scorecard should combine outcome measures and leading indicators. Outcome measures describe what happened, such as defects or late deliveries. Leading indicators provide evidence of future capability, such as preventive-maintenance completion, training, capacity verification, or continuity-plan testing.

An effective scorecard normally includes:

1. KPI definition and formula;
2. target, tolerance, and minimum acceptable level;
3. actual result and trend;
4. evidence source and data-quality status;
5. weight, where weighted scoring is used;
6. commentary on causes and business impact;
7. agreed action, owner, and due date; and
8. escalation status.

Traffic-light systems can aid communication, but colours require written thresholds. A red rating should indicate a defined management condition, not merely subjective dissatisfaction.

4. Supplier Reviews and Corrective Action

Supplier reviews should be purposeful and evidence-based. A review is not simply a meeting at which procurement reads out a scorecard. It is a governance process for evaluating results, causes, risks, commitments, and future requirements.

4.1 Review cycle

A typical cycle includes:

• Preparation: validate data, identify trends, gather stakeholder feedback, and circulate an agenda.
• Performance discussion: compare actual performance with targets and contractual obligations.
• Root-cause analysis: distinguish symptoms from causes and examine process evidence.
• Action planning: agree corrective, preventive, and improvement actions.
• Escalation: apply contractual remedies or executive intervention when required.
• Follow-up: verify completion and confirm whether performance has improved.

Review frequency should reflect segmentation. Critical suppliers may require monthly operational reviews and quarterly executive reviews. Low-risk suppliers may be reviewed annually or by exception.

4.2 Corrective and preventive action

Corrective action addresses the cause of an observed non-conformance. Preventive action reduces the likelihood of a potential or recurring problem. A credible corrective action plan identifies:

• the problem statement and affected requirement;
• immediate containment;
• factual root cause;
• permanent corrective action;
• responsible person;
• due date;
• evidence of implementation; and
• effectiveness verification.

Useful root-cause techniques include the five-whys method, process mapping, Pareto analysis, fault-tree reasoning, and structured cause-and-effect analysis. The technique should match the complexity of the problem. Repeatedly asking “why?” without evidence can produce speculation rather than analysis.

Procurement should distinguish supplier-caused failure from buyer-caused or jointly caused failure. Inaccurate forecasts, unstable specifications, late approvals, unrealistic lead times, and frequent engineering changes may contribute to supplier performance problems. Fair attribution improves both accountability and solution quality.

5. Supplier Development and Innovation

Supplier development is a deliberate effort by the buying organisation, sometimes jointly with other parties, to improve a supplier’s capability or performance. It is justified where the supplier is important, replacement is difficult, and improvement is feasible.

Development interventions may include:

• technical assistance and process training;
• quality-system development;
• joint value-stream mapping;
• capacity and equipment planning;
• forecasting and collaborative planning;
• responsible-sourcing improvement;
• information-system integration; and
• second-source or subcontractor development.

Development should have a business case. The organisation must assess expected benefits, costs, intellectual-property implications, dependency risks, and the possibility that the supplier will serve competitors.

Innovation management involves more than inviting suppliers to submit ideas. It requires a clear problem statement, evaluation criteria, intellectual-property rules, funding arrangements, pilot governance, and a route from experiment to implementation. Supplier ideas may concern product design, packaging, logistics, energy use, automation, maintenance, or service delivery.

A gain-sharing arrangement can encourage innovation, but it should define the baseline, eligible costs, verification method, ownership of savings, duration of sharing, and treatment of unintended consequences. Savings should be measured against an agreed baseline rather than an inflated reference point.

6. Supply Risk Assessment

Supply risk is the possibility that an event or condition will prevent the organisation from obtaining required goods or services at acceptable cost, quality, timing, compliance, or reputation. Risk management includes identification, analysis, treatment, monitoring, and communication.

6.1 Risk categories

Important categories include:

• Operational: capacity failure, quality breakdown, labour shortage, equipment failure.
• Commercial and financial: insolvency, liquidity pressure, price volatility, fraud.
• Geopolitical: sanctions, conflict, trade restrictions, border disruption.
• Natural and environmental: flood, earthquake, fire, epidemic, water scarcity.
• Technological and cyber: ransomware, system outage, data breach, obsolete technology.
• Legal and regulatory: non-compliance, licensing failure, modern-slavery exposure, defective products.
• Concentration: dependence on one supplier, one site, one country, or one logistics route.
• Reputational and ethical: labour abuse, corruption, environmental damage, misleading claims.

6.2 Risk scoring

A simple screening method uses likelihood and impact scores. Let L represent likelihood and I represent impact. A basic risk score is:

The scores must use defined ordinal scales, for example 1 to 5. If likelihood is 4 and impact is 5, the score is 20. The result is a prioritisation aid, not a probability estimate. Ordinal scores do not necessarily have equal numerical intervals, so a score of 20 should not be interpreted as twice the risk of a score of 10.

A more developed assessment may consider inherent risk, control effectiveness, and residual risk. Inherent risk is the exposure before controls; residual risk is the exposure after controls. Controls may include dual sourcing, safety stock, audits, insurance, technical qualification, cyber safeguards, and tested recovery plans.

Where reliable probability and loss data exist, expected loss can be estimated as:

Probability is expressed between 0 and 1, and impact must be expressed in the same currency and time basis as the resulting loss. This calculation is appropriate only when probability and impact estimates are sufficiently credible. It should not replace scenario analysis where consequences are non-financial or highly uncertain.

6.3 Risk treatment options

The main treatment choices are:

• Avoid: stop using the exposed source, design, route, or process.
• Reduce: lower likelihood or impact through controls.
• Transfer or share: use insurance, contractual allocation, or another party, while recognising that accountability may not be fully transferable.
• Prepare and accept: establish contingency arrangements and accept residual exposure within approved limits.
• Exploit or enable: in positive-risk contexts, invest to capture an opportunity, such as supplier innovation.

Risk registers should include the risk statement, cause, event, consequence, rating, controls, owner, treatment, trigger, review date, and residual assessment.

7. Business Continuity and Supply-Chain Resilience

Business continuity is the capability to continue or recover critical operations after disruption. Resilience is broader: it includes the ability to anticipate, absorb, adapt to, and recover from disruption while maintaining or rapidly restoring required performance.

Continuity planning should begin with a business impact analysis. This identifies critical products and services, dependencies, maximum tolerable disruption, recovery priorities, and required resources. Procurement should work with operations, finance, information technology, risk, legal, and security functions.

Typical resilience measures include:

• qualified alternative suppliers;
• geographic diversification;
• approved substitute materials or designs;
• strategic inventory or buffer capacity;
• flexible logistics routes;
• supplier financial and capacity monitoring;
• contractual emergency provisions;
• tested communication trees;
• manual workarounds for system outages; and
• rehearsed recovery exercises.

Resilience has cost. Dual sourcing may reduce dependence but increase qualification, tooling, and coordination costs. Inventory improves response time but ties up capital and may become obsolete. Local sourcing may reduce transport exposure but not necessarily improve financial or cyber resilience. Decisions should therefore consider total cost, service consequences, lead time, regulatory requirements, and risk appetite.

A continuity plan that exists only as a document is weak evidence of resilience. Plans should be tested through simulations, scenario exercises, supplier recovery demonstrations, and periodic contact verification. Lessons from exercises must be assigned, tracked, and closed.

8. Technology, Data, and Artificial Intelligence

Digital supplier management can integrate enterprise-resource-planning data, contract repositories, supplier portals, external risk intelligence, quality systems, logistics visibility, and sustainability information. Dashboards can reveal trends and alert managers to late deliveries, worsening financial indicators, expiring certifications, or concentration exposure.

Artificial intelligence may support anomaly detection, document classification, demand and lead-time analysis, natural-language review of contracts, and early-warning analysis. However, AI outputs require human oversight. Risks include biased training data, false alerts, opaque recommendations, confidentiality leakage, fabricated summaries, and overreliance on third-party data.

Good governance requires:

• defined data ownership and access rights;
• validated source data;
• audit trails for important decisions;
• human review of high-impact actions;
• cybersecurity and privacy controls;
• clear treatment of confidential supplier information; and
• periodic testing for bias, drift, and accuracy.

Technology should improve judgement, not replace supplier dialogue, site verification, professional scepticism, or accountability.

9. Ethics, Governance, and Legal Considerations

Supplier management creates power asymmetry. Large buyers may impose unrealistic payment terms, transfer excessive risk, or demand concessions that threaten supplier viability. Ethical procurement requires proportionality, transparency, respect for contracts, prompt payment where commitments exist, and fair treatment of smaller suppliers.

Important governance controls include segregation of duties, conflict-of-interest declarations, competitive-procurement records, approval thresholds, gifts and hospitality rules, anti-bribery controls, whistleblowing channels, and documented exceptions.

Modern supply chains also require attention to human rights, forced labour, child labour, worker safety, discrimination, environmental harm, and responsible mineral sourcing. Supplier codes of conduct are useful only when supported by due diligence, meaningful audits, remediation, and escalation. A buyer should not rely solely on a signed declaration.

Confidential information and intellectual property require contractual protection. Collaborative innovation should clearly address ownership, licences, publication rights, security, and use of jointly developed data. Regulatory obligations vary by jurisdiction, so procurement professionals must coordinate with legal and compliance specialists rather than assume that a general supplier policy satisfies every requirement.

10. Applied Case: Resilience in a Medical-Device Supply Chain

This is an illustrative case.

Background

MedAxis, a regional medical-device manufacturer, purchases a specialised polymer connector from one approved supplier. The connector represents only 3% of annual spend but is incorporated into a regulated product. Qualification of a new source takes approximately nine months because of testing and regulatory approval.

Problem

The supplier’s on-time delivery rate declined from 96% to 82% over two quarters. The supplier attributed the decline to labour shortages and a failure of a moulding machine. MedAxis initially focused on price because the connector’s spend was small. A risk review showed that the item was a bottleneck category: low relative spend, high supply risk, and long switching time.

Analysis

The procurement team collected delivery, quality, capacity, maintenance, financial, and continuity data. It identified three exposures:

1. single-site dependence;
2. inadequate preventive-maintenance evidence; and
3. absence of an approved alternative design.

A risk workshop rated likelihood at 4 and impact at 5 on a defined five-point scale, producing a screening score of 20. The score did not prove a probability of failure, but it justified immediate treatment.

Approach and solution

MedAxis and the supplier agreed to:

• establish weekly capacity and order-visibility meetings;
• create a corrective action plan for machine reliability;
• maintain a defined quantity of finished-goods buffer stock;
• qualify a second moulding site operated by the same supplier;
• begin technical work on an alternative connector design;
• test the supplier’s continuity plan; and
• introduce a scorecard covering delivery, quality, maintenance completion, recovery time, and communication.

MedAxis also corrected its own forecast process and committed to earlier release of firm schedules. The supplier received technical assistance for preventive-maintenance planning, but improvement milestones and evidence requirements were documented to avoid indefinite dependence.

Outcome

After six months, on-time delivery improved to 95%, maintenance completion reached the agreed target, and the second site passed initial qualification. MedAxis retained the supplier but reduced single-point exposure. The relationship became collaborative rather than merely transactional.

Learning points

The case demonstrates that spend-based prioritisation can hide criticality. It also shows that risk treatment may combine supplier development, inventory, alternative capacity, design change, and improved buyer behaviour. Partnership language alone is not a control; measurable actions, ownership, testing, and follow-up are essential.

11. Implementation Framework for Procurement Professionals

An organisation can establish an integrated supplier-management system through the following sequence:

1. Create a reliable supplier master. Remove duplicates and connect suppliers to categories, sites, contracts, and dependencies.
2. Segment the portfolio. Record business criticality, supply risk, value, substitutability, and relationship type.
3. Set governance levels. Define review frequency, management ownership, escalation routes, and required evidence.
4. Build balanced scorecards. Include operational, commercial, compliance, sustainability, innovation, and resilience measures where relevant.
5. Baseline performance. Confirm definitions, data quality, and historical trends before imposing targets.
6. Review and improve. Use structured meetings, root-cause analysis, corrective actions, and effectiveness checks.
7. Maintain risk registers and continuity plans. Link risk treatments to owners, budgets, triggers, and test schedules.
8. Develop strategic suppliers selectively. Invest where criticality, feasibility, and expected value justify the effort.
9. Use technology with governance. Automate routine visibility while retaining professional judgement for significant decisions.
10. Reassess the portfolio. Update strategies when the market, technology, organisation, or risk environment changes.

Challenges and Limitations

Supplier performance data may be incomplete, inconsistent, or biased toward easily measured outcomes. Weighted scores can create false precision and may hide a critical failure behind strong performance elsewhere. Risk scores can be subjective, particularly where historical data are scarce. Audits provide snapshots rather than continuous assurance, and supplier certifications do not guarantee actual performance.

Relationships also create the danger of complacency. A trusted supplier may receive less scrutiny precisely when dependence is increasing. Conversely, excessive adversarial monitoring can discourage openness and reduce innovation. Procurement must therefore combine challenge with fairness, commercial discipline with collaboration, and relationship continuity with credible alternatives.

Supplier development may unintentionally increase dependency, transfer proprietary knowledge, or subsidise a supplier without securing durable value. Resilience investments may increase short-term cost. Senior management must make these trade-offs explicit through risk appetite, total-cost analysis, and scenario planning.

Chapter Summary

Supplier relationship, performance, and risk management form an integrated strategic capability. Supplier segmentation determines how much governance, collaboration, monitoring, and contingency planning a supplier requires. Portfolio models such as the Kraljic framework help distinguish non-critical, leverage, bottleneck, and strategic situations, although professional judgement remains necessary.

Effective performance management uses clearly defined KPIs, reliable data, balanced scorecards, targets, tolerances, and documented escalation rules. Weighted scores can support comparison, but they must not conceal mandatory failures or critical risks. Supplier reviews should examine trends and root causes, assign corrective and preventive actions, and verify effectiveness.

Supplier development and innovation are appropriate where capability improvement is feasible and strategically valuable. Supply risk assessment considers operational, financial, geopolitical, technological, regulatory, ethical, environmental, and concentration risks. Likelihood-impact scoring supports prioritisation, while continuity and resilience practices reduce exposure through alternatives, buffers, flexible capacity, tested plans, and recovery capability.

Finally, supplier management must be ethical, evidence-based, and properly governed. Digital tools and AI can improve visibility and analysis, but they require data governance, cybersecurity, human oversight, and accountability. The professional procurement manager manages both performance and relationships while protecting continuity, value, compliance, and organisational reputation.

Key Terms

Supplier relationship management: A systematic approach to governing supplier interactions and value creation.

Supplier segmentation: Grouping suppliers according to characteristics that determine management requirements.

Kraljic portfolio model: A framework classifying purchasing categories by profit impact and supply risk.

Supplier performance management: The process of measuring, reviewing, and improving supplier results.

Key performance indicator: A strategically important measure used to evaluate achievement.

Scorecard: A structured set of supplier measures, targets, results, trends, and actions.

On-time delivery rate: The percentage of eligible deliveries received within the agreed delivery requirement.

Corrective action: Action taken to remove the cause of an observed non-conformance.

Preventive action: Action taken to reduce the likelihood of a potential or recurring problem.

Root-cause analysis: A systematic investigation into the underlying causes of a problem.

Supplier development: Deliberate investment or assistance intended to improve supplier capability.

Supplier innovation: New or improved ideas, products, processes, or services contributed by a supplier.

Supply risk: The possibility that a disruption will prevent acceptable supply performance.

Inherent risk: Exposure before risk controls are applied.

Residual risk: Exposure remaining after controls and treatments are applied.

Business continuity: The capability to continue or recover critical operations after disruption.

Supply-chain resilience: The ability to anticipate, absorb, adapt to, and recover from disruption.

Concentration risk: Exposure created by dependence on one supplier, site, region, route, or technology.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Supplier governance: Structures, responsibilities, controls, and decision rights used to manage suppliers.

Review Questions

Short Answer Questions

1. What is supplier relationship management, and how does it differ from supplier administration?
2. Identify the four categories in the Kraljic purchasing portfolio model.
3. State four characteristics of an effective supplier KPI.
4. What is the difference between corrective action and preventive action?
5. Define residual supply risk.

Long Answer Questions

1. Explain how an organisation should segment its suppliers and assign relationship strategies.
2. Discuss the design of a balanced supplier scorecard, including KPI definitions, targets, data sources, and escalation rules.
3. Explain the supplier performance-review cycle from preparation through effectiveness verification.
4. Compare supplier development, dual sourcing, inventory buffering, and alternative design as resilience measures.
5. Discuss the ethical, governance, and legal issues that arise in supplier relationship management.

Analytical / Application Questions

1. A supplier has a low annual spend but provides a component requiring nine months for requalification. Using portfolio logic, analyse its likely category and recommend a management strategy.
2. A supplier’s ratings are delivery 90, quality 70, cost 95, and responsiveness 80. The weights are 30%, 35%, 20%, and 15%. Calculate the weighted score and explain why the organisation should not rely on the score alone.
3. Design a risk-treatment plan for a single-source supplier affected by geopolitical disruption. Include immediate controls, medium-term resilience measures, responsible owners, and review triggers.

Multiple Choice Questions with Answers

Question 1

Which supplier category normally combines high profit impact with high supply risk?

A. Non-critical

B. Leverage

C. Bottleneck

D. Strategic

Correct Answer: D. Strategic

Question 2

Which feature is essential for a well-designed supplier KPI?

A. It must be difficult for the supplier to calculate

B. It must have a precise definition and agreed data source

C. It should measure only purchase price

D. It should change every reporting period

Correct Answer: B. It must have a precise definition and agreed data source

Question 3

A supplier scorecard uses delivery, quality, cost, and responsiveness ratings of 92, 86, 78, and 90 with weights of 30%, 35%, 20%, and 15%. What is the weighted score?

A. 82.4

B. 84.6

C. 86.8

D. 89.2

Correct Answer: C. 86.8

Question 4

What is the primary purpose of root-cause analysis?

A. To assign blame immediately

B. To identify the underlying cause of a problem

C. To increase the number of KPIs

D. To replace contract requirements

Correct Answer: B. To identify the underlying cause of a problem

Question 5

In a basic likelihood-impact model, a likelihood score of 4 and an impact score of 5 produce a risk score of:

A. 9

B. 16

C. 20

D. 25

Correct Answer: C. 20

Question 6

Which is an example of a leading indicator of supplier resilience?

A. Last quarter’s late-delivery rate

B. Number of defects already received

C. Completion of continuity-plan testing

D. Historical invoice value

Correct Answer: C. Completion of continuity-plan testing

Question 7

Which action is most directly associated with supplier development?

A. Providing process training to improve supplier capability

B. Deleting the supplier from the master file

C. Ignoring repeated non-conformances

D. Removing all performance measures

Correct Answer: A. Providing process training to improve supplier capability

Question 8

Why should an overall weighted supplier score not conceal a critical failure?

A. Weighted scores are always illegal

B. A high average can hide a breach of a mandatory requirement

C. Suppliers cannot receive numerical ratings

D. Quality is never relevant to procurement

Correct Answer: B. A high average can hide a breach of a mandatory requirement

Question 9

Which practice provides the strongest evidence that a continuity plan is usable?

A. Storing it in an unapproved file

B. Obtaining a signature without review

C. Testing it through a simulation or recovery exercise

D. Reviewing it only after a major failure

Correct Answer: C. Testing it through a simulation or recovery exercise

Question 10

What is a key governance risk when using artificial intelligence in supplier management?

A. It eliminates the need for data

B. It guarantees unbiased decisions

C. It may produce opaque or inaccurate recommendations requiring human oversight

D. It prevents all cyber incidents

Correct Answer: C. It may produce opaque or inaccurate recommendations requiring human oversight