Supplier Discovery, Qualification and Due Diligence

Introduction and Context

Strategic sourcing begins before a request for quotation is issued. An organisation must first determine which suppliers exist, which are capable of meeting its requirements, which are acceptable sources of risk, and which can become reliable long-term partners. Supplier discovery, qualification and due diligence therefore form a decision system rather than a clerical purchasing sequence.

Supplier discovery identifies potential sources. Qualification determines whether a supplier can meet defined technical, commercial, operational and governance requirements. Due diligence investigates whether the supplier is legitimate, financially viable, ethically acceptable, secure and resilient enough for the intended relationship. Onboarding converts an approved supplier into an operationally usable source through contracts, master-data controls, systems integration, performance baselines and risk-monitoring arrangements.

These activities are especially important where purchases involve critical components, regulated products, intellectual property, personal data, concentrated supply markets, cross-border trade or significant switching costs. A low quoted price cannot compensate for counterfeit materials, production interruption, sanctions exposure, cyber compromise or a supplier that fails shortly after award.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Design a structured supplier-search strategy using internal, external and digital sources.
2. Distinguish supplier discovery, prequalification, due diligence, selection and onboarding.
3. Construct weighted qualification criteria and evaluate evidence consistently.
4. Assess technical capability, capacity, quality systems, financial health, cybersecurity, compliance, sustainability, ownership and geopolitical exposure.
5. Apply risk-based segmentation, escalation and approval controls.
6. Design an onboarding process that protects data integrity and establishes performance accountability.
7. Critically evaluate the limitations, ethical implications and governance requirements of supplier due diligence.

1. The Supplier Qualification Decision System

A useful distinction is:

• Discovery: finding possible suppliers and collecting initial information.
• Screening: removing suppliers that clearly fail mandatory requirements.
• Prequalification: testing whether a supplier merits participation in a tender or detailed evaluation.
• Due diligence: verifying identity, ownership, capabilities, conduct and risk exposures using reliable evidence.
• Selection: choosing the supplier or supplier portfolio that offers the best acceptable value and risk profile.
• Onboarding: establishing the commercial, operational, technological and governance arrangements required for transacting.
• Monitoring: reassessing performance and risk throughout the relationship.

These stages should not be confused. A supplier may pass a technical questionnaire but fail sanctions screening. It may be financially sound but lack the capacity required for a demand surge. It may be suitable for a low-value, noncritical purchase but unacceptable for a safety-critical component.

A robust system combines three principles:

1. Evidence over assertion: claims should be supported by documents, demonstrations, references, audit findings or independent data.
2. Proportionality: scrutiny should reflect spend, criticality, data access, geographic exposure, substitutability and harm potential.
3. Independence and traceability: decisions should be reviewable, conflicts of interest controlled and exceptions documented.

A risk-based supplier lifecycle

Figure: Supplier management is a lifecycle rather than a one-time approval event.

2. Supplier Discovery and Market Intelligence

2.1 Defining the search before searching

The quality of discovery depends on the quality of the sourcing brief. The brief should describe the requirement in functional rather than unnecessarily restrictive terms. It should identify:

• required outcomes and technical specifications;
• forecast demand, order pattern and service locations;
• regulatory, safety and environmental requirements;
• required certifications, testing and traceability;
• data, intellectual-property and site-access implications;
• acceptable geography and logistics constraints;
• expected contract duration and relationship model;
• switching costs, substitutes and business-continuity needs.

A cross-functional team should challenge whether the specification unintentionally excludes innovative suppliers or embeds the incumbent's design. Procurement, engineering, operations, quality, finance, information security, legal and sustainability personnel may all contribute.

2.2 Sources of potential suppliers

Supplier discovery may use:

• approved-supplier and historical procurement records;
• industry associations, trade fairs and professional networks;
• specialist directories and independent market research;
• referrals from customers, engineers and logistics providers;
• technology platforms and supplier marketplaces;
• public tender portals and government registries;
• patent, certification and standards databases;
• regional development agencies and supplier-diversity networks;
• direct market mapping and competitor or substitute analysis.

No source is automatically reliable. A marketplace listing establishes visibility, not capability. A referral may reveal a strong supplier but can introduce bias. Public records may be incomplete or delayed. Discovery therefore produces a longlist, not an approval.

2.3 Market mapping

Market mapping examines the structure of supply: number of qualified producers, ownership concentration, geographic clustering, raw-material dependency, technology maturity, logistics routes and barriers to entry. It should identify direct suppliers as well as critical sub-tier suppliers. In many disruptions, the visible supplier is not the true constraint; the constraint may be a single-source processor, semiconductor foundry, mineral producer or software dependency.

The search should also consider supplier diversity. A geographically or ownership-diverse portfolio can reduce concentration risk, but diversity should not be treated as a substitute for capability or quality. The appropriate objective is a resilient and competitive supply base.

3. Prequalification Design

Prequalification is a controlled reduction of the longlist. It should use a standard questionnaire, clear evidence requirements and explicit decision rules. Questions should be relevant to the intended contract and should not request sensitive information without a legitimate purpose.

3.1 Mandatory gates and weighted criteria

Some requirements are non-negotiable. Examples include legal registration, required licence, sanctions compliance, minimum insurance, acceptance of a code of conduct or ability to meet a safety regulation. These are gates: failure normally excludes the supplier or triggers senior review.

Other attributes vary by degree and can be scored. Typical dimensions include technical capability, capacity, quality, commercial strength, financial health, cybersecurity, sustainability and service.

A weighted score can be represented as:

where S is the total normalized score, w_i is the weight assigned to criterion i, r_i is the supplier's rating on criterion i, and n is the number of criteria. Weights should sum to 1, and ratings must use a defined scale, such as 0 to 5. The formula assumes criteria are sufficiently independent for additive scoring and that poor performance on a critical criterion is controlled separately through mandatory gates or minimum thresholds.

For example, if technical capability has weight 0.30 and rating 4, its contribution is 1.20. If capacity has weight 0.20 and rating 3, its contribution is 0.60. All contributions are added, but a supplier scoring highly overall should still be rejected if it fails a mandatory product-safety requirement.

3.2 Evidence hierarchy

Evidence should be classified according to reliability. A practical hierarchy is:

1. independently verified records, regulatory filings and audit reports;
2. controlled certificates whose validity is confirmed with the issuer;
3. customer references and observed performance;
4. demonstrations, site visits and sample testing;
5. supplier declarations and questionnaire responses;
6. unverified marketing claims.

The hierarchy is not absolute. A site visit can be more informative than an outdated certificate, and a certificate may cover only a narrow management-system scope. Evaluators should record evidence date, scope, issuer, limitations and unresolved questions.

3.3 Avoiding scoring distortion

Weighted models can create false precision. A rating of 4 rather than 3 does not necessarily represent a measurable 33 percent improvement. To improve consistency, define behavioural anchors. For example, a capacity rating of 5 may mean demonstrated capacity above forecast peak demand with validated contingency; a rating of 3 may mean capacity meets the base forecast but requires planned overtime for peaks; a rating of 1 may mean capacity is unverified or materially below demand.

Use panel scoring for high-risk categories, document disagreements and perform sensitivity analysis. If small changes in weights reverse the decision, the result is not robust and should be escalated rather than presented as an objective answer.

4. Capability and Capacity Assessment

4.1 Technical capability

Technical evaluation asks whether the supplier can consistently produce or deliver the required outcome. Evidence may include engineering drawings, process capability studies, prototype results, test reports, calibration records, design-control procedures, tooling ownership and change-control history.

For manufactured products, evaluators may review process flow, critical-to-quality characteristics, measurement systems, failure-mode analyses and validation records. For services, capability may involve professional qualifications, operating methods, staffing models, service-level evidence and incident history. For software suppliers, architecture, secure-development practices, integration interfaces, support arrangements and data portability are relevant.

The buyer should distinguish capability from capacity. A supplier may know how to make a product but lack the equipment, people or time to meet required volume.

4.2 Capacity and scalability

Capacity assessment should consider nominal capacity, available capacity, bottleneck resources, utilisation, maintenance, labour availability, lead times, raw-material constraints and competing customer commitments. A useful demand test compares required volume with demonstrable available capacity:

Both quantities must use the same period and unit, such as units per month or service hours per quarter. Positive headroom does not guarantee resilience because it may depend on overtime, a single machine or a scarce technician. The evaluator should test base demand, peak demand and disruption scenarios.

Questions should include: What happens if demand rises by 20 percent? Which operation is the bottleneck? How quickly can a second shift be added? What is the recovery time after equipment failure? Which sub-tier supplier limits output? Is capacity reserved contractually or merely estimated?

5. Quality Systems and Operational Control

Quality due diligence examines both outcomes and management systems. Relevant evidence may include quality certifications, audit results, nonconformance data, corrective-action effectiveness, complaint trends, traceability, product-release controls and supplier-change notifications.

Certification is not proof that every product is conforming. The scope, site, expiry, exclusions and certification body must be checked. A mature quality system demonstrates prevention, detection, learning and accountability. Important indicators include:

• first-pass yield and defect rates;
• on-time closure of corrective actions;
• customer complaint frequency and recurrence;
• calibration and maintenance discipline;
• lot or batch traceability;
• control of nonconforming material;
• management review and internal-audit effectiveness.

Audits should be risk-based. A desktop review may be adequate for office supplies, while a witnessed process audit and sample approval may be necessary for medical, aerospace, food, chemical or safety-critical applications. Audit findings should distinguish observation, minor nonconformity, major nonconformity and critical breach according to the organisation's established method.

6. Financial Health and Commercial Viability

A supplier's financial condition affects continuity, quality investment and bargaining behaviour. Assessment may include audited financial statements, credit reports, payment history, insurance, debt structure, liquidity, ownership support and dependence on a small number of customers.

Common analytical indicators include:

The current ratio is a broad short-term liquidity indicator; it assumes that reported current assets and liabilities are reasonably classified and does not prove that assets are readily convertible to cash. Operating margin measures operating profitability, but interpretation depends on industry, accounting policy and business cycle. Ratios should be compared across time and with relevant peers rather than used as universal pass/fail rules.

A worked illustration: suppose a supplier reports current assets of $18 million and current liabilities of $12 million. Its current ratio is 18 ÷ 12 = 1.5. If operating profit is $2.4 million on revenue of $30 million, operating margin is 2.4 ÷ 30 × 100% = 8%. These figures may indicate acceptable liquidity and profitability, but the buyer should investigate debt maturities, cash flow, covenant pressure, customer concentration, tax arrears and unusual related-party transactions.

Financial due diligence should be proportionate and lawful. Small private firms may not disclose full audited statements. Alternative evidence can include bank references, management accounts, trade references, insurance, escrow arrangements, parent guarantees or staged commitments. Confidentiality and data-protection obligations must be respected.

7. Cybersecurity, Data and Digital Dependence

Cybersecurity is a supply-chain risk because suppliers may access systems, personal data, operational technology, source code or sensitive designs. Assessment should identify the information and connectivity involved before selecting controls.

Key questions include:

• What data does the supplier receive, create, store or transmit?
• Is access least-privilege, time-limited and monitored?
• Are multifactor authentication, encryption, secure backup and vulnerability management implemented?
• How are subcontractors and cloud providers controlled?
• How quickly must incidents be reported?
• Has the supplier tested incident response and recovery?
• Can services continue if a platform or data centre is unavailable?
• Are software components inventoried and updated?

Evidence can include independent assurance reports, penetration-test summaries, policies, security certifications, incident records and demonstrations of access controls. A certificate should be examined for scope and date; it should not replace understanding the actual service architecture.

Contracts should specify security requirements, audit rights, breach notification, vulnerability remediation, data location where legally relevant, secure deletion, business continuity, subcontractor approval and exit assistance. Artificial intelligence tools used by suppliers require additional questions about training data, confidentiality, model governance, human oversight, bias, explainability and intellectual-property rights.

8. Compliance, Ethics and Sustainability

Due diligence should address legal and ethical conduct throughout the supplier's operations and supply chain. Topics may include anti-bribery, competition law, conflicts of interest, labour standards, forced labour, child labour, modern-slavery risks, export controls, sanctions, tax compliance, environmental permits, health and safety, product regulations and data protection.

A supplier code of conduct is useful but insufficient. Effective governance combines contractual commitments, training, reporting channels, risk-based audits, remediation and consequences for noncompliance. The buyer should avoid imposing impossible requirements without support, especially on smaller suppliers. Remediation may be preferable to immediate termination where harm can be corrected and continued engagement protects affected workers.

Sustainability assessment should examine material impacts rather than rely on broad claims. Evidence may include energy and emissions data, water and waste controls, permits, hazardous-material management, responsible mineral sourcing, worker safety statistics and environmental incident history. Avoid accepting vague claims such as “green” without boundaries, measurement method and verification.

Ethical procurement also requires fairness in the buyer's own process. Suppliers should receive consistent information, reasonable response times and an avenue to challenge factual errors. Confidential bids must be protected, and evaluators must disclose conflicts of interest.

9. Ownership, Beneficial Ownership and Geopolitical Exposure

The legal entity signing a contract may not reveal who ultimately controls or benefits from it. Ownership due diligence should identify the corporate chain, beneficial owners, directors, parent entities, state ownership, politically exposed persons where relevant, related parties and significant changes in control.

This information matters because ownership can affect sanctions exposure, corruption risk, access to capital, intellectual-property control and continuity. It should be verified through corporate registries, reliable commercial databases, declarations, legal documents and appropriate independent checks. Privacy and applicable law constrain what can be collected and how it is used.

Geopolitical analysis examines country risk, trade restrictions, diplomatic tensions, conflict, transport chokepoints, currency controls, local-content rules, expropriation risk, infrastructure reliability and dependence on politically sensitive inputs. Country risk is not a reason to stereotype suppliers or exclude an entire population. It is a prompt to assess specific exposures and controls.

Possible mitigations include dual sourcing, approved substitutes, regional inventory, alternate logistics routes, contractual allocation, buffer capacity, local technical support and continuity exercises. These controls have costs; the decision should compare expected risk reduction with additional total cost and complexity.

10. Risk Scoring, Segmentation and Decision Governance

A practical risk model distinguishes inherent risk from residual risk. Inherent risk exists before controls; residual risk remains after controls. A simple screening model may use likelihood and impact ratings:

If each rating is an ordinal scale from 1 to 5, the score ranges from 1 to 25. This multiplication is a prioritisation convention, not a probability theorem. It assumes the organisation's rating definitions are consistent and that multiplying ordinal values is acceptable for screening. It should not be interpreted as a precise monetary loss estimate.

A supplier may be segmented as low, medium, high or critical risk based on factors such as spend, product criticality, substitutability, access to data, regulatory exposure, geographic concentration and recovery difficulty. Segmentation determines the depth and frequency of due diligence.

Approval governance should define:

• who may approve ordinary suppliers;
• which risks require legal, finance, security or executive review;
• when a waiver is permissible;
• how compensating controls are documented;
• when a supplier must be suspended;
• how reassessment is triggered by ownership, location, incident or performance change.

A procurement committee should avoid both rubber-stamping and excessive bureaucracy. Decision records should state the evidence reviewed, assumptions, unresolved risks, controls, owner and review date.

11. Onboarding: From Approval to Operational Readiness

Approval does not make a supplier operational. Onboarding commonly includes:

1. confirming legal entity, tax details, bank-account ownership and authorised contacts;
2. executing the contract, confidentiality terms, code of conduct and data-processing terms;
3. agreeing specifications, quality plans, acceptance criteria and change control;
4. creating supplier master data with segregation of duties and duplicate checks;
5. setting purchase-order, invoicing, delivery and dispute procedures;
6. provisioning only necessary system access;
7. completing samples, pilot orders, first-article inspection or service transition;
8. establishing performance measures, escalation contacts and business-continuity plans;
9. communicating training, reporting and incident obligations;
10. recording renewal and reassessment dates.

Bank-detail changes deserve enhanced controls because payment fraud frequently exploits weak master-data processes. Independent callback verification using trusted contact information, dual approval and audit logs are stronger than accepting an emailed change request.

Performance indicators should reflect the contract. Possible measures include on-time-in-full delivery, defect rate, response time, corrective-action closure, invoice accuracy, incident reporting and sustainability commitments. Measures should have clear definitions, data sources, frequency, target and owner.

12. Applied Case: Northstar Medical Devices

This is an illustrative case. Northstar Medical Devices is introducing a disposable infusion component. Its incumbent supplier can meet current volume but relies on a single overseas sterilisation subcontractor. A second supplier, Meridian Components, offers a lower unit price and shorter quoted lead time.

Background and problem

The procurement team initially proposes awarding 70 percent of volume to Meridian because its quotation is 8 percent below the incumbent's price. Quality and regulatory staff object that Meridian has submitted a valid quality certificate but has not disclosed its sterilisation sub-tier or recent process-validation evidence.

Analysis

The cross-functional team defines the component as critical because failure could affect patient safety and product release. Mandatory gates are established: regulatory licence, traceability, validated sterilisation, product-liability insurance, sanctions screening, cybersecurity controls for shared design data and acceptance of audit rights.

Meridian passes legal-entity and sanctions checks. Its technical sample meets dimensional requirements, but the audit finds that sterilisation capacity is shared with two major customers and that contingency arrangements are informal. Financial review shows adequate profitability but high customer concentration. Ownership records reveal a recent acquisition by an investment group; the change is not itself disqualifying, but it triggers review of management continuity and contractual change-of-control provisions.

The team scores suppliers on technical capability, capacity, quality, financial resilience, total cost, continuity and governance. Rather than relying only on a weighted total, it treats validated sterilisation and traceability as gates. Meridian is conditionally approved for a controlled pilot, not immediate majority allocation.

Approach and solution

Northstar requires Meridian to:

• complete sterilisation validation and provide objective evidence;
• disclose and qualify the sterilisation subcontractor;
• demonstrate surge and recovery capacity;
• implement electronic batch traceability;
• agree incident notification and audit rights;
• provide a tested continuity plan and alternate sterilisation route.

Northstar retains the incumbent for the initial majority share, conducts first-article and pilot testing, and establishes a milestone-based transition. The sourcing team also negotiates a price-adjustment mechanism tied to verified cost drivers rather than accepting an unexplained fixed escalation clause.

Outcome

After four months, Meridian completes validation and a successful pilot. It is awarded 25 percent of volume, with expansion tied to three consecutive months of quality and delivery performance and completion of a second continuity exercise. Northstar pays slightly more than the original dual-source proposal in the short term but reduces dependence on one sterilisation route without compromising patient safety.

Learning points

The case illustrates that qualification is not merely a supplier comparison exercise. Critical gates prevent high weighted scores from masking unacceptable failures. Sub-tier visibility is essential, ownership changes require reassessment, and staged onboarding can capture competition while limiting exposure.

13. Technology, AI and Contemporary Developments

Digital supplier-risk platforms can consolidate questionnaires, sanctions screening, certificates, financial information, news alerts and performance data. They improve visibility but can reproduce data errors, regional bias and false alerts. Organisations should establish data provenance, review thresholds, escalation rules and human accountability.

AI can help classify documents, identify missing evidence, detect unusual payment or delivery patterns and summarise audit findings. It should not independently approve a high-risk supplier. Human reviewers must validate extracted facts, protect confidential information and examine whether the model has omitted smaller or less digitally visible suppliers.

Contemporary practice is moving toward continuous monitoring rather than annual certification checks. Triggers may include ownership changes, cyber incidents, severe quality events, sanctions updates, financial distress, adverse regulatory action, major geopolitical events or a change in critical sub-tier sourcing. Continuous monitoring must remain proportionate; excessive alerts create fatigue and reduce attention to genuinely material risks.

Challenges and Limitations

Due diligence has unavoidable limitations. Private suppliers may have limited public information. Financial ratios can be distorted by accounting conventions. Certificates can be valid but narrow in scope. Audits provide a sample rather than complete assurance. Supplier responses may be strategic, while third-party data may be outdated or wrongly matched to an entity.

Global supply chains also create tension between transparency and confidentiality. Small suppliers may experience questionnaires as costly and intrusive. Buyers should use modular questionnaires, explain purpose, avoid duplicate requests and share improvement expectations. Risk models can create spurious precision and embed assumptions that favour large incumbent firms. Periodic validation, supplier feedback and outcome-based review are therefore necessary.

The most serious governance failure is treating due diligence as a one-time compliance document. Capability, ownership, cybersecurity, financial health and geopolitical conditions change. A defensible process is one that identifies uncertainty, assigns controls and revisits the decision when conditions change.

Best-Practice Checklist

A mature supplier discovery and qualification system should:

• begin with a clear, outcome-based sourcing brief;
• map direct and critical sub-tier supply;
• separate mandatory gates from weighted preferences;
• require evidence matched to risk and contract scope;
• use cross-functional evaluation and conflict declarations;
• verify legal identity, ownership and payment information;
• assess capacity under normal, peak and disruption conditions;
• test quality systems rather than relying only on certificates;
• review financial, cyber, compliance, sustainability and geopolitical exposure;
• document assumptions, exceptions, controls and review dates;
• use staged pilots for critical or uncertain suppliers;
• monitor material changes throughout the relationship;
• ensure fair treatment, privacy and remediation where appropriate.

Chapter Summary

Supplier discovery, qualification and due diligence form an integrated, risk-based lifecycle. Discovery creates a credible market longlist; prequalification applies transparent gates and weighted criteria; due diligence verifies the supplier's identity, ownership, capability, capacity, quality, financial condition, cybersecurity, compliance, sustainability and geopolitical exposure. No single certificate, score or database is sufficient. Evidence must be relevant, current and proportionate to risk.

Weighted scoring supports structured comparison, but mandatory requirements and professional judgement remain essential. Financial ratios and risk scores are screening tools rather than definitive conclusions. Onboarding converts approval into operational readiness through contracts, master-data controls, access management, pilot testing, performance measures and continuity arrangements. Because supplier conditions change, effective organisations use continuous monitoring and defined reassessment triggers. Ethical governance requires fairness, privacy, conflict control, responsible remediation and human accountability for technology-supported decisions.

Key Terms

Supplier discovery: The systematic identification of potential sources of supply.

Prequalification: A preliminary evaluation determining whether a supplier may proceed to detailed sourcing.

Due diligence: Investigation and verification of a supplier's identity, capability, conduct and risk.

Mandatory gate: A non-negotiable requirement that must be satisfied for approval.

Weighted scoring: A method that combines criterion ratings according to assigned importance weights.

Technical capability: The ability to design, produce or deliver to specified requirements.

Capacity headroom: Available capacity remaining after required capacity is deducted.

Sub-tier supplier: A supplier providing goods or services to the buyer's direct supplier.

Quality management system: The organised processes used to control and improve conformity.

Corrective action: Action taken to eliminate the cause of a detected nonconformity.

Current ratio: Current assets divided by current liabilities.

Beneficial owner: The individual or entity that ultimately owns or controls a legal entity.

Geopolitical exposure: Risk arising from political, legal, conflict, trade or infrastructure conditions affecting supply.

Residual risk: Risk remaining after controls are applied.

Supplier segmentation: Classification of suppliers according to importance, risk and management requirements.

Onboarding: The process of making an approved supplier operational within the organisation.

Continuous monitoring: Ongoing observation of supplier performance and changing risk conditions.

Compensating control: An alternative control used to reduce risk when the preferred control is unavailable.

Review Questions

Short Answer Questions

1. Distinguish supplier discovery, prequalification and due diligence.
2. Why should mandatory gates be used alongside weighted scoring?
3. Identify four forms of evidence that may support supplier capability claims.
4. What is the difference between inherent risk and residual risk?
5. State four controls that should be included in supplier onboarding.

Long Answer Questions

1. Explain how a cross-functional team should design a risk-based supplier qualification process.
2. Discuss the strengths and limitations of using weighted supplier-scoring models.
3. Explain how technical capability, capacity and quality-system maturity should be assessed together.
4. Analyse the relationship between ownership transparency, geopolitical exposure and supply continuity.
5. Discuss the ethical and governance issues involved in using AI for supplier due diligence.

Analytical / Application Questions

1. A supplier passes all technical tests but depends on one undisclosed sub-tier processor. Design an investigation and recommend possible approval conditions.
2. A supplier has a current ratio of 0.9, strong delivery performance and a parent-company guarantee. Explain what further evidence you would request and whether immediate rejection is justified.
3. Construct a supplier-risk response for a critical component sourced from one country, considering capacity, cyber risk, logistics disruption and alternative-source development.

Multiple Choice Questions with Answers

Question 1

Which activity primarily involves identifying possible sources before detailed evaluation?

A. Supplier discovery

B. Supplier onboarding

C. Corrective action

D. Invoice reconciliation

Correct Answer: A. Supplier discovery

Question 2

What is the main purpose of a mandatory qualification gate?

A. To replace all professional judgement

B. To ensure a non-negotiable requirement is satisfied

C. To increase the number of suppliers in the longlist

D. To calculate operating margin

Correct Answer: B. To ensure a non-negotiable requirement is satisfied

Question 3

A supplier has current assets of $18 million and current liabilities of $12 million. What is its current ratio?

A. 0.67

B. 1.20

C. 1.50

D. 30.00

Correct Answer: C. 1.50

Question 4

Which evidence generally provides stronger assurance than an unverified marketing claim?

A. A promotional brochure

B. An independently verified audit report

C. An informal sales statement

D. An unsigned presentation

Correct Answer: B. An independently verified audit report

Question 5

Why is a supplier's sterilisation subcontractor relevant in a critical medical-device supply chain?

A. It may represent a capacity, quality and continuity constraint

B. It determines the buyer's office-rent expense

C. It eliminates the need for product testing

D. It proves that the direct supplier is financially solvent

Correct Answer: A. It may represent a capacity, quality and continuity constraint

Question 6

Which statement about supplier certificates is most accurate?

A. A certificate guarantees conformity of every supplied product

B. A certificate is irrelevant if the supplier is low cost

C. Its scope, site, validity and exclusions should be checked

D. A certificate replaces ownership screening

Correct Answer: C. Its scope, site, validity and exclusions should be checked

Question 7

What does residual risk mean?

A. Risk before any controls exist

B. Risk remaining after controls are applied

C. Risk that has been legally eliminated

D. Risk found only in financial statements

Correct Answer: B. Risk remaining after controls are applied

Question 8

Which onboarding control most directly reduces fraudulent bank-detail changes?

A. Accepting emailed changes without review

B. Independent callback verification and dual approval

C. Removing all supplier contacts

D. Allowing one employee to create and approve changes

Correct Answer: B. Independent callback verification and dual approval

Question 9

What is a key limitation of a simple likelihood-times-impact risk score?

A. It cannot prioritise any risks

B. It is a screening convention and may create false precision

C. It always produces monetary loss values

D. It eliminates the need for controls

Correct Answer: B. It is a screening convention and may create false precision

Question 10

Why should supplier due diligence continue after onboarding?

A. Supplier ownership, cyber posture, finances and geopolitical conditions can change

B. Contracts have no relevance after award

C. Initial qualification is legally invalid in every case

D. Monitoring is needed only to increase purchase prices

Correct Answer: A. Supplier ownership, cyber posture, finances and geopolitical conditions can change