Procurement Risk and Supply Resilience

Introduction and context

Strategic purchasing is not concerned only with obtaining the lowest quoted price. It is concerned with securing the organisation’s ability to obtain the right goods and services, at the required quality and volume, when they are needed, while remaining financially viable and legally compliant. Procurement risk is the possibility that uncertainty will prevent purchasing objectives from being achieved. Supply resilience is the capability to anticipate, absorb, respond to, recover from and learn from disruptive events.

Modern supply networks are exposed to interconnected risks. A supplier’s factory closure may create an operational shortage; that shortage may stop production, damage customer relationships and create financial losses. A geopolitical event can affect transport, exchange rates, sanctions compliance and access to critical materials simultaneously. Digital procurement systems can increase visibility and efficiency, but they also create cyber vulnerabilities. Consequently, risk management must move beyond isolated supplier checks towards an integrated view of the supply network.

For an advanced diploma purchasing professional, the practical challenge is to translate uncertainty into decisions: which risks deserve attention, what controls are proportionate, when should a buyer accept or transfer risk, and how can resilience be improved without creating excessive inventory or supplier cost?

Learning objectives

After studying this chapter, the learner should be able to:

• distinguish procurement risk from supply-chain resilience;
• identify financial, operational, geopolitical, cyber, quality and continuity risks;
• construct and maintain a procurement risk register;
• assess risks using likelihood, impact, exposure and expected-loss concepts;
• apply scenario analysis and stress testing to purchasing decisions;
• design business-continuity and supplier-continuity responses;
• evaluate multi-sourcing, dual sourcing, buffers and alternative specifications;
• integrate contractual, technological, ethical and governance controls; and
• monitor resilience through meaningful performance indicators.

1. The nature and taxonomy of procurement risk

Risk is not simply an adverse event. It includes uncertainty about events, their causes, their consequences and the effectiveness of controls. A useful distinction is:

• Inherent risk: exposure before controls are applied.
• Residual risk: exposure remaining after controls.
• Known risk: an identified uncertainty that can be analysed.
• Emerging risk: a developing threat for which evidence and consequences are still uncertain.
• Opportunity risk: uncertainty that may produce a beneficial outcome, such as a new regional supplier or substitute technology.

A procurement risk may originate inside the buying organisation, at a supplier, in a logistics channel, in a market, or in the wider political and environmental system. Risks are also interconnected. For example, weak supplier cash flow can lead to deferred maintenance, which raises quality failures and eventually causes operational interruption.

Main categories

The categories should not be treated as mutually exclusive. A responsible procurement assessment records both the immediate event and the transmission path through which it affects organisational objectives.

2. Risk governance and accountability

Effective risk management begins with governance. The board or senior management normally establishes risk appetite: the level and type of risk the organisation is willing to accept in pursuit of its objectives. Procurement then translates this appetite into supplier requirements, approval thresholds, escalation rules and monitoring routines.

Important responsibilities include:

• Business owner: defines the consequence of interruption and approves operational priorities.
• Procurement professional: identifies supply exposure, designs sourcing controls and maintains supplier information.
• Supplier: reports its own risks accurately and implements agreed controls.
• Finance: assesses solvency, payment exposure, currency and cost implications.
• Quality and technical functions: approve specifications, testing and process controls.
• Information security: evaluates system access, data protection and cyber resilience.
• Legal and compliance functions: address sanctions, competition law, contracts, labour standards and anti-corruption.

The three-lines model is useful: operational teams own and manage risk; risk, compliance and specialist functions provide oversight and challenge; internal audit provides independent assurance. Procurement should not outsource accountability to a supplier rating platform or consultant.

A sound policy should define critical suppliers, mandatory due diligence, approval of exceptions, incident reporting times, audit rights, continuity expectations and consequences for non-compliance. Controls should be proportionate. Excessive documentation for a low-value, easily replaceable item wastes resources, whereas a single-source component used in a safety-critical product requires intensive oversight.

3. Risk identification and the procurement risk register

Risk identification combines documentary evidence, professional judgement and structured inquiry. Useful techniques include supplier financial analysis, process mapping, site visits, stakeholder interviews, historical incident review, market intelligence, horizon scanning and supplier self-assessment. The analyst should ask:

1. What could interrupt supply, increase cost, compromise quality or create legal exposure?
2. What assets, materials, systems or relationships are dependent on this supplier?
3. What early-warning signals would show deterioration?
4. How quickly would the organisation be affected?
5. How long could the organisation operate without normal supply?
6. What controls already exist, and have they been tested?

A risk register converts findings into accountable action. A useful register contains:

A weak entry says “supplier may fail.” A stronger entry says “the only approved supplier of the sterile valve may lose production capacity after a major equipment failure, causing a projected interruption within ten days; capacity confirmation and an alternate qualification are required.”

Risk registers must be living management tools rather than one-time compliance documents. They should be reviewed at sourcing events, contract renewals, major market changes and after incidents.

4. Risk measurement and prioritisation

4.1 Likelihood–impact scoring

A simple scoring system can prioritise attention. Let L denote likelihood and I denote impact. A basic risk score is:

where R is the risk score, and L and I are ordinal scores, commonly from 1 to 5. The scale is not a probability model; it is a prioritisation device. Its usefulness depends on clearly defined scoring criteria and consistent calibration.

For example, likelihood may range from rare (1) to almost certain (5), while impact may range from insignificant (1) to catastrophic (5). A score of 20 should normally receive more attention than a score of 4, but multiplication can hide important differences: a rare catastrophic event and a frequent moderate event can receive the same score. Therefore, risk owners should also consider urgency, detectability, velocity and legal or safety non-negotiability.

4.2 Expected loss

When credible probability and monetary consequence estimates are available, expected loss is more informative:

where EL is expected loss per defined period, pᵢ is the probability of scenario i, and Cᵢ is its monetary consequence. The probabilities must cover the relevant scenarios and should not overlap. Consequences may include lost contribution, emergency freight, penalties, recovery cost and reputational or regulatory effects where these can be responsibly estimated.

Suppose a buyer estimates a 10% annual probability of a supplier interruption costing $120,000 and a 4% probability of a severe interruption costing $500,000. If the scenarios are mutually exclusive:

The result is an average decision-support measure, not a prediction that exactly $32,000 will be lost. It does not capture risk appetite, cash-flow timing, safety consequences or the possibility that probabilities are unreliable. A control costing $10,000 annually may be economically attractive in this simplified example, but the decision also requires analysis of its effectiveness and implementation costs.

4.3 Criticality, time and recovery measures

Financial exposure is only one dimension. Criticality assessment should consider:

• time to impact (how soon operations stop);
• maximum tolerable period of disruption;
• time to recover normal supply;
• substitutability of the item or supplier;
• safety, legal and customer consequences; and
• dependency on shared infrastructure or sub-tier suppliers.

Two continuity metrics are particularly useful. Recovery time objective (RTO) is the target time within which an affected process or service should be restored. Recovery point objective (RPO) is the maximum acceptable period of data or transaction loss, especially relevant to procurement and payment systems. These are management objectives, not universal formulas. Their values should be set by business-impact analysis.

5. Scenario analysis and stress testing

Scenario analysis asks how the supply network would perform under plausible conditions. It is more useful than relying only on a single forecast because disruptions are often nonlinear and correlated. Scenarios can be:

• single-event: one supplier experiences a fire;
• compound: a geopolitical shock occurs while demand rises;
• reverse stress: identify the conditions that would make the organisation unable to continue;
• best/base/worst case: compare a range of market outcomes; or
• near miss: examine an event that almost caused failure.

A structured scenario workshop should define the event, assumptions, affected nodes, time sequence, operational consequences, decision triggers, available actions and recovery path. Participants should include procurement, operations, finance, quality, IT, legal and relevant suppliers.

Scenario analysis should test dependencies rather than merely list events. For example, moving all sourcing to a second supplier may appear resilient, but if both suppliers depend on the same port, raw-material refinery or cloud platform, the apparent diversification is weak. This is concentration risk at a hidden tier.

Stress testing can examine capacity. If normal demand is 8,000 units per month and a disruption removes 40% of primary capacity, the remaining capacity is 4,800 units per month. If demand rises to 9,000 units, the monthly shortage is 4,200 units unless inventory, substitutes or a qualified alternate source fills the gap. Such calculations should use consistent periods and should distinguish production capacity from deliverable capacity after transport and quality constraints.

6. Business continuity and supply continuity

Business continuity management aims to maintain critical activities during disruption and restore them in an orderly manner. A procurement continuity plan should be integrated with the organisation’s broader continuity and disaster-recovery plans.

Business-impact analysis

The business-impact analysis identifies critical products, processes and services, their dependencies, acceptable disruption duration and recovery priorities. It should answer:

• Which purchased inputs are essential to safety, revenue or legal compliance?
• What is the minimum acceptable operating level?
• What inventory, substitute, internal capability or alternate supplier exists?
• Which decisions require executive approval?
• How will customers, regulators, employees and suppliers be informed?

Continuity plan components

A practical plan includes:

1. Prevention: supplier qualification, maintenance, cyber controls, insurance and contract requirements.
2. Preparedness: contact lists, alternate specifications, emergency purchasing procedures, drills and reserved logistics capacity.
3. Response: incident classification, crisis team activation, demand prioritisation, allocation of scarce supply and communications.
4. Recovery: restoration of production, verification of quality, reconciliation of orders and controlled return to normal sourcing.
5. Learning: root-cause analysis, corrective actions and revision of risk assumptions.

Plans must be tested. A document that has never been exercised may contain obsolete contacts, unrealistic lead times or incompatible specifications. Tabletop exercises are inexpensive; live simulations provide stronger evidence but must be carefully controlled.

7. Resilience strategies in sourcing and inventory

Resilience is not equivalent to redundancy everywhere. It is a deliberate balance between robustness, agility, cost and service.

Multi-sourcing and dual sourcing

Multi-sourcing uses more than one supplier for the same category or family of requirements. Dual sourcing is a specific form involving two principal sources. Benefits include alternative capacity, competitive tension and reduced dependency. Costs include qualification, smaller volumes per supplier, duplicated tooling, coordination and potentially lower economies of scale.

The decision should assess effective—not merely nominal—diversification. Suppliers should be checked for common ownership, shared sub-tier sources, common geography, shared transport routes and common technology providers. A second supplier that cannot produce the required volume or quality during a crisis provides little resilience.

Nearshoring, regionalisation and local capability

Regional supply may reduce transport distance and geopolitical exposure, but it may increase unit cost or reduce access to specialised capability. Local sourcing can support continuity and stakeholder objectives, yet it does not automatically remove risk; local suppliers may be financially fragile or dependent on imported components.

Buffer inventory and decoupling

Safety stock can absorb demand and lead-time variation. A simple cycle-service planning relationship, when demand during lead time is approximately normally distributed, is:

where SS is safety stock in units, z is the standard-normal service factor, and σₗ is the standard deviation of demand during lead time. This formula assumes that demand during lead time is reasonably represented by a normal distribution, that observations are relevant to the future, and that the chosen service factor reflects the desired cycle-service probability. It is unsuitable without modification for severe intermittency, structural disruption or strongly non-normal demand.

If the standard deviation of demand during lead time is 300 units and the selected service factor is 1.645, corresponding approximately to a 95% cycle-service target under the stated assumptions:

The result should be rounded according to pack size and policy. Inventory is not a substitute for supplier development, and excessive stock can become obsolete, expire or conceal poor process performance.

Standardisation and substitution

Using common specifications, interchangeable components and pre-approved alternatives increases flexibility. However, substitution must respect engineering, safety, regulatory, warranty and customer requirements. Procurement cannot unilaterally replace a material merely because it is cheaper or available.

Supplier development and collaboration

Resilience may be improved by helping suppliers strengthen capacity, quality systems, cyber controls, financial planning or continuity procedures. Long-term agreements, forecast sharing and joint investment can create mutual commitment. Such collaboration requires clear ownership of intellectual property, fair treatment and safeguards against anti-competitive information exchange.

8. Contractual and commercial controls

Contracts should allocate risk deliberately rather than rely on general assurances. Relevant provisions include:

• measurable specifications and service levels;
• delivery, capacity and notification obligations;
• audit and access rights, including appropriate sub-tier visibility;
• quality acceptance, traceability and corrective-action procedures;
• business-continuity and disaster-recovery obligations;
• cyber-security standards, incident notification and data protection;
• sanctions, export-control and anti-bribery compliance;
• force majeure definitions and mitigation duties;
• price-adjustment, currency and indexation mechanisms;
• liability, insurance, indemnity and limitation provisions;
• termination, step-in, transition and tooling-access rights; and
• exit assistance and orderly transfer to an alternate source.

A force majeure clause may excuse performance under specified extraordinary events; it does not itself guarantee continuity or compensate every loss. Buyers should examine notice requirements, causation, mitigation, partial performance and whether payment obligations remain. Legal review is essential because enforceability varies by jurisdiction.

Commercial continuity also depends on fair payment practices. Delayed payment may weaken strategically important suppliers, while unrealistic price pressure can discourage investment in quality, maintenance and cyber security. Total cost of ownership is therefore more appropriate than quoted price alone.

9. Cyber, data and technology risks

Digital procurement introduces exposure through e-procurement portals, enterprise-resource-planning systems, supplier integrations, electronic data interchange, banking interfaces and cloud services. Threats include ransomware, business-email compromise, fraudulent bank-detail changes, unauthorised access, intellectual-property theft and manipulation of purchase orders.

Controls should include least-privilege access, multi-factor authentication, segregation of duties, supplier identity verification, encryption, secure backups, patching, logging, anomaly detection and tested incident response. A bank-account change should be independently verified through a trusted channel, not accepted solely through an email.

Artificial intelligence can support contract review, anomaly detection, demand sensing and supplier monitoring. Its outputs require human validation because training data may be incomplete, confidential information may be exposed, and automated recommendations can reproduce bias or create false confidence. Governance should define permitted data, approval authority, auditability, model performance monitoring and accountability for decisions.

10. Quality, ethical and regulatory resilience

Quality risk should be managed across the product life cycle. Supplier approval, process capability, incoming inspection, statistical process control, traceability and corrective-action systems are complementary. Inspection at receipt detects defects but may not prevent them; process controls and supplier development address causes earlier.

Ethical procurement is also risk management. Forced labour, unsafe working conditions, corruption and environmental harm can interrupt supply, trigger legal penalties and undermine legitimacy. Due diligence should be risk-based and should consider country, sector, product and supplier characteristics. Audits alone are insufficient: announced audits may miss actual conditions, and workers may fear retaliation. Effective programmes combine worker voice, grievance mechanisms, remediation, transparent escalation and responsible purchasing practices.

The buyer must comply with applicable competition, sanctions, customs, product-safety, data-protection, labour and environmental rules. “Resilience” cannot be used to justify unlawful collusion, discriminatory exclusion or concealment of defects.

11. Measuring resilience and early warning

A balanced dashboard may include:

Indicators should have thresholds and owners. A dashboard without decision rules merely describes risk. For example, a deterioration in on-time delivery, a sudden request for accelerated payment and loss of key personnel may together trigger a financial and continuity review even if no single indicator exceeds a limit.

12. Illustrative case: Northstar Medical Devices

Background

Northstar Medical Devices, a fictional manufacturer, produces infusion pumps for hospitals. A low-cost precision valve is purchased from one overseas supplier. The valve is safety-critical, has a four-month qualification lead time and is manufactured at a single supplier site. Northstar holds 18 days of finished-goods inventory. The supplier has recently requested shorter payment terms and reported difficulty obtaining a specialist polymer.

Problem

Procurement’s initial supplier score is acceptable because historical delivery performance is strong. However, the organisation has no approved alternate valve, limited visibility of the polymer sub-tier and no tested emergency allocation plan. A fire at the supplier site would stop pump assembly after the available inventory is consumed.

Analysis

The risk team maps the dependency and identifies financial, operational, quality and continuity risks. A workshop estimates a 12% annual probability of a major interruption with an estimated direct and contribution-margin consequence of $1.2 million. The simplified expected annual loss is:

This estimate excludes safety and reputational consequences and is therefore not a complete decision rule. The team also discovers that a proposed second supplier uses the same polymer producer, so nominal dual sourcing would not remove the most important sub-tier dependency.

Approach and solution

Northstar adopts a layered response:

1. It qualifies a regional supplier for 35% of normal demand and begins technical validation of a second polymer.
2. It negotiates reserved capacity and emergency allocation rights in both supplier contracts.
3. It increases inventory temporarily while qualification is completed, using expiry controls.
4. It requires continuity plans, incident notification within 24 hours and annual tabletop exercises.
5. It introduces monthly monitoring of supplier liquidity, polymer availability, capacity and delivery reliability.
6. It establishes an approved substitute valve subject to engineering and regulatory approval.
7. It creates a crisis playbook defining allocation among hospital customers if supply is constrained.
8. It conducts a cyber and bank-detail verification review after a suspected phishing attempt.

Outcome

After nine months, the regional supplier is approved, the polymer alternative passes validation and the dependency on one site falls substantially. The additional controls increase annual purchasing and qualification cost, but the organisation gains tested alternatives, better sub-tier visibility and faster escalation. Northstar does not claim that risk has been eliminated; instead, residual risk is accepted by a named executive with scheduled review.

Learning points

The case demonstrates that resilience requires more than adding a second purchase order. Criticality, qualification time, common sub-tiers, inventory policy, contracts, quality approval and crisis allocation must be considered together. It also shows why supplier scorecards based only on past delivery can miss emerging financial and continuity signals.

13. Challenges and limitations

Risk analysis is affected by incomplete data, cognitive bias and changing conditions. Managers may underestimate rare events, over-rely on historical performance, or treat a high score as objective fact. Probability estimates can be especially weak for novel geopolitical or cyber events. Models may also encourage false precision when consequences such as trust, safety and reputation are difficult to monetise.

Resilience has trade-offs. Multi-sourcing may increase cost and reduce volume leverage. More inventory may create obsolescence. Localisation may reduce one risk while increasing another. Audits can impose burdens on small suppliers without producing genuine improvement. Transparency may be limited by commercial confidentiality and sub-tier complexity.

These limitations do not make risk management futile. They require sensitivity analysis, scenario thinking, diverse expertise, explicit assumptions, independent challenge and regular revision. Decisions should document not only the selected action but also the risks consciously accepted.

14. Best-practice implementation sequence

An organisation beginning or improving procurement resilience can use the following sequence:

1. Define critical products, services, suppliers, sites and objectives.
2. Map direct and important sub-tier dependencies.
3. Establish risk appetite, governance and escalation rules.
4. Build a consistently scored, owned and dated risk register.
5. Assess financial, operational, geopolitical, cyber, quality, ethical and continuity exposure.
6. Conduct business-impact analysis and at least one compound scenario exercise.
7. Select proportionate treatments: prevention, transfer, reduction, acceptance or contingency.
8. Qualify alternatives and verify that diversification is effective.
9. Embed continuity, information-security, quality and compliance requirements in contracts.
10. Test plans, monitor indicators and learn from incidents and near misses.

The strategic principle is “resilience by design.” It is less expensive and more credible to design alternatives, visibility and recovery capability before a disruption than to improvise after one has occurred.

Chapter Summary

Procurement risk is the uncertainty that can prevent purchasing and organisational objectives from being achieved. It includes financial, operational, geopolitical, cyber, quality, ethical and continuity exposures, which frequently interact across supplier and sub-tier networks. Supply resilience is the capability to anticipate, absorb, respond to, recover from and learn from disruption.

Risk governance assigns ownership and establishes risk appetite, while a living risk register records causes, consequences, controls, indicators, treatments and accountability. Likelihood–impact scores support prioritisation, whereas expected loss provides a monetary decision aid when probabilities and consequences are credible. Neither replaces judgement about safety, legal duties, urgency or reputation.

Scenario analysis, business-impact analysis and tested continuity plans reveal dependencies that ordinary supplier scorecards may miss. Resilience strategies include dual or multi-sourcing, effective geographic and sub-tier diversification, safety stock, standardisation, approved substitutes, supplier development and contractual protections. Each has cost and limitations.

Cyber security, ethical due diligence, quality assurance and regulatory compliance are integral to procurement resilience. Dashboards become useful only when indicators have thresholds, owners and escalation actions. The professional buyer’s task is not to eliminate every risk, which is impossible, but to make exposure visible, reduce unacceptable vulnerability and ensure that accepted residual risk is informed, owned and reviewed.

Key Terms

Business continuity: The capability to maintain or restore critical activities during disruption.

Business-impact analysis: A structured assessment of disruption consequences, dependencies and recovery priorities.

Concentration risk: Exposure created by dependence on one supplier, site, country, route, sub-tier or technology platform.

Critical supplier: A supplier whose failure could materially affect safety, operations, revenue, compliance or customers.

Expected loss: Probability-weighted consequence across defined scenarios.

Force majeure: A contractual provision addressing performance impediments caused by specified extraordinary events.

Inherent risk: Risk before controls are applied.

Multi-sourcing: Obtaining a requirement from more than one supplier.

Procurement risk: Uncertainty that may prevent procurement objectives from being achieved.

Recovery point objective: Maximum acceptable period of data or transaction loss.

Recovery time objective: Target time for restoring an affected process or service.

Residual risk: Risk remaining after controls and treatments.

Risk appetite: The level and type of risk an organisation is willing to accept.

Risk register: A controlled record of risks, assessment, controls, owners, actions and status.

Safety stock: Inventory held to protect against demand or lead-time uncertainty.

Scenario analysis: Examination of outcomes under defined plausible conditions.

Supply resilience: The ability to anticipate, absorb, respond to, recover from and learn from disruption.

Sub-tier supplier: A supplier that provides inputs to a direct supplier rather than directly to the buying organisation.

Stress testing: Evaluation of performance under severe but plausible conditions.

Three-lines model: Governance arrangement separating operational ownership, oversight and independent assurance.

Review Questions

Short Answer Questions

1. Define procurement risk and supply resilience.
2. Distinguish inherent risk from residual risk.
3. What information should a procurement risk register contain?
4. State two differences between an RTO and an RPO.
5. Why does a second supplier not always eliminate concentration risk?

Long Answer Questions

1. Explain the major categories of procurement risk and show how two categories can interact in a supply disruption.
2. Discuss the role of governance, risk appetite and the three-lines model in strategic procurement risk management.
3. Explain how scenario analysis and business-impact analysis should be used to develop a continuity plan.
4. Evaluate the advantages and disadvantages of multi-sourcing, safety stock, supplier development and standardisation.
5. Discuss how cyber security, ethical due diligence and quality management contribute to supply resilience.

Analytical / Application Questions

1. A critical item has a 15% estimated probability of a disruption costing $800,000 and a 5% probability of a severe disruption costing $2,000,000, with mutually exclusive scenarios. Calculate expected annual loss and recommend what additional information should be gathered before approving a resilience investment.
2. An organisation proposes a second supplier located in another country, but both suppliers use the same raw-material producer and port. Analyse the residual risks and propose a revised resilience design.
3. Design a concise risk-register entry and continuity response for a single-source component that has a 30-day lead time, a 10-day operational buffer and a four-month qualification period for substitutes.

Multiple Choice Questions with Answers

Question 1

Which statement best defines residual risk?

A. Risk before any controls are applied

B. Risk remaining after controls and treatments

C. Risk transferred entirely to an insurer

D. Risk that has already caused a loss

Correct Answer: B. Risk remaining after controls and treatments

Question 2

If likelihood is scored as 4 and impact as 5, using R = L × I, what is the risk score?

A. 9

B. 15

C. 20

D. 25

Correct Answer: C. 20

Question 3

A mutually exclusive disruption has a 10% probability of costing $120,000 and a 4% probability of costing $500,000. What is the expected loss?

A. $20,000

B. $32,000

C. $50,000

D. $620,000

Correct Answer: B. $32,000

Question 4

What is the principal purpose of a recovery time objective?

A. To specify the maximum acceptable data loss

B. To determine the supplier’s quoted price

C. To define the target time for restoring an affected process

D. To calculate annual safety-stock cost

Correct Answer: C. To define the target time for restoring an affected process

Question 5

Which situation represents hidden concentration risk?

A. Two suppliers use different sites and independent raw-material sources

B. A buyer has one supplier for a low-value stationery item

C. Two geographically different suppliers depend on the same sub-tier producer

D. A buyer uses approved substitute specifications

Correct Answer: C. Two geographically different suppliers depend on the same sub-tier producer

Question 6

Under the stated safety-stock assumptions, if z = 1.645 and σₗ = 300 units, what safety stock is indicated?

A. 182 units

B. 300 units

C. 494 units approximately

D. 1,945 units

Correct Answer: C. 494 units approximately

Question 7

Which is an example of a detective rather than a preventive cyber control?

A. Multi-factor authentication

B. Access limitation by role

C. Monitoring logs for unusual transactions

D. Supplier password policy

Correct Answer: C. Monitoring logs for unusual transactions

Question 8

Why should a business-continuity plan be tested?

A. Testing guarantees that disruption cannot occur

B. Testing reveals obsolete contacts, unrealistic assumptions and coordination weaknesses

C. Testing removes the need for supplier contracts

D. Testing converts residual risk into zero risk

Correct Answer: B. Testing reveals obsolete contacts, unrealistic assumptions and coordination weaknesses

Question 9

Which contractual provision most directly supports an orderly move to an alternate supplier?

A. A vague product description

B. Exit assistance and transition obligations

C. An unlimited payment delay

D. Removal of all audit rights

Correct Answer: B. Exit assistance and transition obligations

Question 10

Why is expected loss not a complete procurement decision rule?

A. It cannot use monetary values

B. It ignores all probabilities by definition

C. It may not capture safety, urgency, reputation or uncertainty in estimates

D. It applies only to inventory risks

Correct Answer: C. It may not capture safety, urgency, reputation or uncertainty in estimates