Foundations of Supply Chain Risk Management

Introduction and Context

Modern supply chains are not linear chains but interconnected networks of suppliers, manufacturers, logistics providers, distributors, technology platforms, regulators and customers. A product may depend on raw materials from several countries, specialised components from a small number of suppliers, shared transport infrastructure, cloud-based information systems and highly coordinated production schedules. This interdependence creates efficiency, but it also creates exposure. A delay, quality failure, cyberattack, natural hazard, regulatory change or sudden demand shift can propagate across organisational boundaries.

Supply chain risk management (SCRM) is the systematic process of identifying, assessing, treating, monitoring and learning from events or conditions that may impair the flow of materials, information, finance or services through a supply network. Its purpose is not to eliminate all risk. Complete elimination is usually impossible and may be uneconomic. The purpose is to make informed trade-offs between efficiency, exposure, continuity, customer service, financial performance and strategic flexibility.

For postgraduate managers, SCRM is both an analytical and a governance discipline. It requires understanding uncertainty and network structure, evaluating possible consequences, selecting controls, coordinating with external partners and preparing for conditions that cannot be forecast precisely.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish risk, uncertainty, vulnerability, disruption, resilience, robustness and recoverability.
2. Classify major sources and consequences of supply chain risk.
3. Explain how risk propagates through interconnected supply networks.
4. Apply basic qualitative and quantitative risk-assessment methods.
5. Evaluate mitigation, preparedness, response and recovery strategies.
6. Explain the strategic, ethical and governance importance of SCRM.
7. Recognise the limitations of conventional risk models and the need for adaptive management.

1. Core Concepts and Terminology

Risk

Risk is commonly understood as the effect of uncertainty on objectives. In supply chains, objectives may include cost, service level, delivery time, quality, safety, compliance, revenue, reputation and sustainability. Risk therefore exists when uncertain conditions can produce outcomes different from those required or expected.

A simple expected-loss representation is:

Here, E(L) is expected loss, pᵢ is the probability of scenario i, and Cᵢ is the consequence or cost of that scenario. The expression assumes that scenarios are sufficiently defined, probabilities are meaningful, consequences can be estimated, and the decision maker is evaluating average exposure over a relevant period. It does not describe the full distribution of outcomes, tail risk, interdependence or uncertainty about the probabilities themselves.

For example, if a supplier failure has an estimated probability of 0.10 over a planning period and would cause a loss of £200,000, its expected loss is £20,000. This does not mean that the organisation will lose £20,000 in reality; it means that £20,000 is the probability-weighted average for decision analysis.

Uncertainty

Uncertainty refers to incomplete knowledge about future conditions, events, relationships or outcomes. It is broader than risk. In a narrow interpretation, risk concerns situations in which probabilities can be estimated, whereas uncertainty concerns situations in which probabilities are unknown, disputed or unreliable. In practice, supply chain managers face both:

• Aleatory uncertainty: natural variability, such as fluctuating demand or transit time.
• Epistemic uncertainty: limited knowledge, such as uncertainty about a supplier’s true cyber capability or financial health.
• Deep uncertainty: situations in which decision makers cannot agree on the relevant models, probabilities or future scenarios.

A useful distinction is that variability may be managed statistically, while lack of knowledge may require information gathering, assumptions testing, scenario planning or robust decisions.

Hazard, exposure and consequence

A hazard is a potentially damaging source, such as an earthquake, cyber vulnerability, labour dispute or contaminated input. Exposure is the extent to which a supply chain is located in, connected to or dependent on the hazard. Consequence is the resulting effect if the hazard affects the exposed system.

A coastal distribution centre may be exposed to flooding, but the consequence depends on inventory levels, alternative facilities, drainage, insurance, customer commitments and recovery capability. Risk is therefore not determined by the hazard alone; it emerges from the relationship between hazard, exposure, vulnerability and consequence.

Vulnerability

Vulnerability is the susceptibility of a supply chain or organisation to harm, together with limited ability to resist, absorb or recover from that harm. Typical sources include:

• dependence on a single supplier, route, facility or technology platform;
• lack of visibility beyond immediate suppliers;
• high product customisation or long replacement lead times;
• low financial reserves;
• tightly coupled production schedules;
• poor data quality and weak escalation procedures;
• concentration in one geography;
• insufficient safety stock or capacity redundancy.

Vulnerability is not identical to risk. A highly vulnerable system may face little immediate risk if no relevant hazard is present, while a moderate vulnerability may become critical when exposed to a severe hazard.

Disruption

A disruption is an event or condition that interrupts, reduces or threatens the normal flow of goods, services, information or funds. Disruptions may be short-lived or prolonged, local or systemic, anticipated or unexpected. Examples include a port closure, supplier insolvency, product recall, cyber incident, industrial action, pandemic restriction or sudden regulatory prohibition.

Disruption should be distinguished from routine variation. A late delivery of one hour may be normal operational variability; a closure that prevents deliveries for several weeks is a disruption. The boundary depends on the process, performance standards and consequences involved.

Resilience

Supply chain resilience is the capability to prepare for, respond to and recover from disruptive events while maintaining or restoring essential operations. A resilient supply chain may also adapt and improve after disruption.

Resilience commonly includes four capabilities:

1. Preparation: anticipating threats, designing contingencies and maintaining resources.
2. Absorption: sustaining essential performance during an event.
3. Adaptation: changing sourcing, production, logistics or product decisions as conditions evolve.
4. Recovery and learning: restoring performance and reducing future vulnerability.

Resilience is dynamic. It is not simply the possession of spare inventory or a documented continuity plan.

Robustness

Robustness is the ability of a system to perform acceptably despite variation or adverse conditions. A robust supply chain continues to meet defined requirements across a range of foreseeable scenarios without requiring major redesign during the event. Examples include packaging that tolerates normal transport variability, flexible production equipment and contracts with multiple approved suppliers.

Robustness is often designed before disruption. Resilience includes robustness but extends further into response, adaptation and recovery. A robust design may reduce the probability or initial impact of failure; resilience determines how the system responds when performance nevertheless deteriorates.

Recoverability

Recoverability is the capacity and speed with which a supply chain restores an acceptable level of performance after disruption. It concerns time, resources, sequencing and learning. Measures may include time to recover, time to restore critical service and the percentage of demand fulfilled during recovery.

Recoverability differs from resilience conceptually. Resilience covers preparation, absorption, adaptation and recovery; recoverability focuses specifically on restoration capability. A facility may be difficult to protect but easy to replace, or well protected but extremely difficult to restart because of specialised equipment.

Business continuity and viability

Business continuity is the capability to continue delivering critical products and services at an acceptable level during disruption. Viability is the longer-term ability of the supply network to survive, remain economically sustainable and fulfil its strategic purpose. Continuity may involve temporary measures, whereas viability requires adaptation to structural change.

2. Sources of Supply Chain Risk

Risk sources are often classified by origin, although categories overlap.

Environmental and natural risks

Earthquakes, floods, storms, droughts, wildfires, extreme temperatures and geological events can damage facilities, interrupt transport and reduce availability of agricultural or mineral inputs. Climate change increases the importance of compound and chronic risks, such as repeated flooding, water stress and heat-related productivity losses.

Geopolitical and macroeconomic risks

Trade restrictions, sanctions, war, political instability, border controls, exchange-rate movements, inflation, interest-rate changes and economic recessions can alter cost and availability. A supply chain may be operationally efficient but strategically exposed if it relies on a politically unstable region or a restricted technology.

Market and demand risks

Demand risk includes forecast error, product substitution, competitor action, fashion changes, customer concentration and demand amplification. The bullwhip effect describes the tendency for relatively small changes in consumer demand to create progressively larger fluctuations upstream because of forecasting, batching, shortage gaming and order policies.

Supply and supplier risks

Supplier risks include capacity shortages, poor quality, financial distress, labour problems, unethical practices, weak management, intellectual-property leakage and failure to meet regulatory requirements. A direct supplier may appear reliable while depending on a fragile lower-tier supplier.

Process and operational risks

Operational risks arise from equipment failure, poor maintenance, design defects, inadequate skills, contamination, warehouse error, inaccurate master data, unsafe work practices and ineffective procedures. Lean operations may reduce waste but can increase sensitivity to small failures when buffers and alternatives are absent.

Logistics and infrastructure risks

Transport risks include congestion, accidents, theft, temperature excursions, port closures, carrier insolvency and route dependence. Infrastructure risks affect roads, railways, ports, airports, electricity, telecommunications and water systems. Because many organisations share infrastructure, a single failure can create correlated disruption across competitors and suppliers.

Information, technology and cyber risks

Digital supply chains rely on enterprise systems, electronic data interchange, cloud platforms, sensors, application programming interfaces and automated decision tools. Risks include ransomware, system outage, unauthorised access, manipulated data, software defects, model error and loss of connectivity. Digitalisation can improve visibility while simultaneously increasing dependency and attack surface.

Legal, regulatory and ethical risks

Changes in product standards, environmental rules, sanctions, data protection, labour law, modern-slavery requirements, customs procedures and product liability can interrupt supply or impose substantial costs. Ethical failures, such as forced labour or unsafe working conditions, can produce legal, reputational and human consequences even when contractual performance appears satisfactory.

Inter-organisational and relational risks

Trust failures, conflicting incentives, poor communication, ambiguous contracts and inadequate information sharing can prevent coordinated response. Risk is not only located inside firms; it is also produced by relationships among firms.

3. Consequences and Propagation Mechanisms

A disruption can create direct and indirect consequences:

Supply chain risk propagates through several mechanisms:

• Dependency: one process cannot proceed without a particular input.
• Connectivity: firms and facilities are linked by physical, financial or digital flows.
• Concentration: many activities depend on one supplier, region, route or platform.
• Coupling: tightly timed processes leave little slack between activities.
• Substitution constraints: alternatives are unavailable, unqualified or slow to activate.
• Information delay: decision makers learn about problems after damage has spread.
• Common-cause failure: apparently separate nodes share the same power grid, port, software provider or climate hazard.

A network perspective is essential because local optimisation can increase system-wide exposure. For example, consolidating purchases with one low-cost supplier may reduce unit price while increasing concentration risk. The relevant decision is not simply whether that supplier is efficient, but whether the network can continue to serve customers if the supplier becomes unavailable.

4. A Framework for Supply Chain Risk Management

A practical SCRM cycle consists of six linked activities.

Establish context and objectives

The organisation first defines critical products, customers, service commitments, risk appetite, planning horizon and performance thresholds. A pharmaceutical supply chain may prioritise patient safety and continuity, while a fashion retailer may prioritise speed and markdown risk.

Identify risks

Methods include process mapping, supplier mapping, interviews, workshops, historical analysis, failure mode and effects analysis, audits, incident databases, external intelligence and scenario analysis. Identification should extend beyond tier-one suppliers where possible.

Analyse risk

Analysis examines causes, likelihood, consequence, velocity, duration, detectability, interdependence and existing controls. A simple risk score may be represented as:

where R is a prioritisation score, P is a likelihood rating and I is an impact rating. This is a screening device, not a universal measure of economic risk. Ratings must use defined scales, consistent assumptions and documented evidence. Multiplying ordinal scores can create misleading precision; two risks with the same score may have very different probability distributions, recovery times or strategic importance.

Where credible probabilities and monetary consequences exist, expected loss may support economic comparison. Where probabilities are unreliable, scenario ranges, stress tests and robust decision criteria are more appropriate.

Evaluate and prioritise

Risk evaluation compares analysed exposure with risk appetite and resource constraints. Priorities should consider not only expected loss but also life safety, legal duties, ethical impact, customer criticality, systemic effects and irreversibility. Low-probability, high-consequence events may deserve attention even when their expected monetary loss is modest.

Treat risk

Treatment options include:

• Avoidance: discontinue a hazardous activity or location.
• Reduction: lower likelihood or consequence through controls.
• Transfer or sharing: use insurance, contracts or partnerships, recognising that responsibility cannot always be transferred ethically or operationally.
• Acceptance: retain exposure when it is understood and consistent with risk appetite.
• Exploitation: in some situations, flexibility or optionality creates competitive advantage from uncertainty.

Monitor, communicate and learn

Risk indicators should track changing conditions, control effectiveness and early warnings. Useful indicators include supplier financial health, capacity utilisation, lead-time variance, defect rates, overdue corrective actions, cyber alerts, inventory coverage and geopolitical developments. Monitoring must lead to decisions; collecting data without escalation rules does not create resilience.

5. Strategic Approaches to Resilience and Robustness

Redundancy and buffering

Safety stock, spare capacity, alternative suppliers, duplicate tooling and multiple transport routes create buffers. Their value depends on holding cost, obsolescence, qualification time and the duration of disruption. Redundancy should be targeted at critical points rather than added indiscriminately.

Flexibility and agility

Flexible facilities, cross-trained employees, postponement, modular product design and adaptable contracts allow rapid reconfiguration. Flexibility may cost more in stable conditions but reduce recovery time and dependence on a single path.

Visibility and collaboration

End-to-end mapping, shared forecasts, supplier development, joint business continuity exercises and event monitoring improve detection and coordination. Visibility is not the same as control: information must be accurate, timely and connected to authority for action.

Design and network diversification

Diversification across suppliers, geographies, technologies and transport modes reduces concentration. However, diversification may increase coordination complexity, quality variation and total cost. A portfolio approach is more useful than the simplistic rule that every input must have two suppliers.

Postponement and decoupling

Postponement delays final configuration until demand is clearer. Decoupling points separate stages so that a disruption in one stage does not immediately stop every downstream activity. These approaches can reduce demand and supply mismatch, but they require suitable product and process design.

Contracts and governance

Contracts should clarify service levels, notification duties, audit rights, data sharing, recovery priorities, liability, ethical standards and termination or substitution rights. Contractual language is insufficient if the parties lack trust, capability or realistic recovery plans.

6. Worked Application: Prioritising a Critical Supplier Risk

A manufacturer identifies three supplier scenarios for a critical component. Management assigns likelihood and impact on a 1–5 scale:

Using R = P × I, the transport closure receives the highest screening score. However, the score alone does not determine the decision. The insolvency scenario may have a lower likelihood but a longer recovery time and no qualified replacement. Management should therefore examine duration, detectability, substitution lead time and customer criticality before allocating resources.

Suppose a separate analysis estimates the following annual expected losses:

• quality failure: 0.20 × £60,000 = £12,000;
• insolvency: 0.05 × £500,000 = £25,000;
• transport closure: 0.15 × £180,000 = £27,000.

The expected losses are £12,000, £25,000 and £27,000 respectively. The transport closure has the highest expected loss, but the insolvency risk is close and may justify investment in a second qualified source. These calculations assume that scenarios are defined consistently, probabilities refer to the same period, and losses include the relevant direct and indirect costs. They should not be interpreted as forecasts with certainty.

7. Illustrative Case: The Northstar Medical Devices Network

Background

Northstar Medical Devices, a fictional European manufacturer, produces infusion pumps. Its final assembly plant is reliable, but a specialised sensor is purchased from one qualified supplier located in a region exposed to flooding. The sensor supplier itself purchases a semiconductor from a lower-tier producer. Northstar’s inventory policy is based on average demand and assumes a six-week replenishment lead time.

Problem

A severe flood closes roads and damages the supplier’s facility. Northstar has only three weeks of sensor inventory. The organisation initially believes that the disruption is a supplier problem, but later discovers that the lower-tier semiconductor supplier is also affected. Regulatory approval prevents immediate substitution with an unqualified sensor.

Analysis

The exposure arises from several interacting conditions: single sourcing, lower-tier opacity, geographical concentration, qualification constraints and a tightly coupled final-assembly process. The immediate operational effect is a shortage, but consequences include delayed hospital deliveries, potential contractual penalties, reputational damage and patient-care concerns.

A conventional likelihood-impact matrix identifies the flood as important. A network analysis reveals that the true vulnerability is not merely the flood hazard; it is the combination of common geography, lack of alternatives and long regulatory qualification time.

Approach and solution

Northstar takes the following actions:

1. establishes a cross-functional response team involving procurement, engineering, regulatory affairs, quality, logistics and customer service;
2. obtains verified lower-tier information and conducts a rapid capacity and inventory assessment;
3. allocates remaining sensors to the most clinically critical orders;
4. evaluates approved design alternatives and accelerates regulatory review without bypassing safety requirements;
5. arranges temporary production support and alternative transport for unaffected inputs;
6. develops a second source in another region;
7. sets risk indicators for geographical concentration, qualification lead time and supplier recovery capability;
8. conducts a scenario exercise involving flood, cyber outage and transport interruption.

Outcome

Northstar maintains essential hospital supply, although some commercial orders are delayed. The second-source programme increases unit cost, but the board concludes that the cost is justified by reduced concentration and improved recoverability. The company also revises its inventory policy for clinically critical components and includes lower-tier mapping in supplier reviews.

Learning points

The case illustrates that resilience is a network capability, not a procurement activity alone. It also shows that inventory is only one form of protection. Qualification flexibility, information quality, cross-functional authority and customer prioritisation can be equally important. Finally, resilience decisions involve ethical judgement: scarce medical components should be allocated according to transparent clinical principles rather than only commercial profitability.

8. Governance, Ethics and Regulation

SCRM involves responsibilities to customers, employees, suppliers, communities, regulators and investors. Organisations should not conceal known hazards, shift unacceptable risks to vulnerable suppliers or treat contractual transfer as a substitute for prevention. Due diligence should address labour rights, modern slavery, occupational safety, environmental impacts, data protection and responsible use of technology.

Boards and senior executives should define risk appetite, approve critical dependencies, review continuity capability and ensure that incentives do not reward short-term cost reduction at the expense of systemic exposure. Procurement performance metrics based only on purchase price can encourage single sourcing, excessive supplier pressure and inadequate investment in resilience.

Incident response should include clear authority, escalation thresholds, communication protocols and record keeping. Regulatory duties may require notification of breaches, product safety incidents, cyber events or environmental harm. Compliance is a minimum requirement; ethical SCRM also considers foreseeable harm beyond formal legal obligations.

9. Technology, Data and Artificial Intelligence

Digital tools can improve supplier mapping, demand sensing, control-tower visibility, anomaly detection and scenario analysis. Artificial intelligence may identify patterns in shipment data, news, weather, financial information or quality records. However, AI does not remove uncertainty. It can reproduce biased data, generate false alarms, obscure reasoning, expose confidential information or fail under conditions not represented in historical data.

Good practice includes validating data provenance, defining human accountability, testing models against extreme scenarios, monitoring drift, protecting sensitive information and maintaining manual fallback procedures. A technology platform is resilient only if its data, connectivity, users, governance and alternative operating procedures are resilient.

10. Challenges and Limitations

Several limitations complicate SCRM:

• probabilities may be unavailable or unstable;
• risk scores can create false precision;
• lower-tier visibility may be incomplete;
• risks can interact rather than occur independently;
• resilience investments have costs and opportunity trade-offs;
• recovery targets may conflict with safety or regulatory requirements;
• risk ownership may be unclear across organisational boundaries;
• historical data may not represent novel threats;
• excessive buffers can reduce efficiency and sustainability.

Managers should therefore combine quantitative analysis with expert judgement, scenario planning, stress testing and qualitative inquiry. They should distinguish uncertainty in the world from uncertainty in the model and communicate both openly.

Best-Practice Principles

Effective SCRM generally follows these principles:

1. manage networks, not only first-tier suppliers;
2. connect risk assessment to strategic objectives and customer criticality;
3. combine prevention, preparedness, response, recovery and learning;
4. use multiple methods rather than relying on one risk matrix;
5. test plans through realistic exercises;
6. maintain clear ownership and escalation authority;
7. invest selectively in redundancy, flexibility and visibility;
8. integrate safety, ethics, sustainability and regulatory duties;
9. verify data and challenge optimistic assumptions;
10. review exposure continuously because networks and hazards evolve.

Chapter Summary

Supply chain risk management addresses the effects of uncertainty on supply network objectives. Risk must be distinguished from uncertainty, vulnerability, disruption, resilience, robustness and recoverability. Vulnerability reflects susceptibility and limited coping ability; disruption is an interruption to flows; robustness is acceptable performance under adverse variation; resilience is the broader capability to prepare, absorb, adapt, recover and learn; recoverability concerns restoration after failure.

Supply chain risks arise from natural hazards, geopolitics, markets, suppliers, operations, logistics, infrastructure, technology, regulation and inter-organisational relationships. Their consequences may be operational, financial, customer-related, strategic, reputational, social, environmental or legal. Interdependence, concentration, coupling, common-cause failure and information delay enable risk propagation.

A practical SCRM cycle establishes context, identifies and analyses risk, evaluates priorities, treats exposure, and monitors and learns. Expected-loss analysis is useful when probabilities and consequences are credible, while scenario planning and stress testing are essential under deep uncertainty. Resilience can be strengthened through targeted buffers, redundancy, flexibility, visibility, collaboration, diversification, postponement, network design and sound governance. Effective SCRM is ultimately a strategic and ethical responsibility, not merely a procurement or insurance exercise.

Key Terms

Risk: The effect of uncertainty on objectives.

Uncertainty: Incomplete knowledge about future conditions, events or outcomes.

Hazard: A potentially damaging source or event.

Exposure: The extent to which a system is subject to a hazard.

Consequence: The effect resulting from a risk event or condition.

Vulnerability: Susceptibility to harm combined with limited ability to resist or recover.

Disruption: An interruption or reduction in normal supply chain flows.

Resilience: Capability to prepare, absorb, adapt, recover and learn.

Robustness: Ability to perform acceptably despite adverse variation.

Recoverability: Ability and speed of restoring acceptable performance.

Supply chain risk management: Systematic identification, assessment, treatment and monitoring of supply network risk.

Bullwhip effect: Amplification of demand variation as it moves upstream.

Concentration risk: Exposure created by dependence on a limited supplier, location, route or platform.

Redundancy: Additional capacity, sources or resources that provide alternatives.

Flexibility: Ability to change activities, resources or configurations in response to conditions.

Visibility: Timely and accurate knowledge of relevant supply network conditions.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Business continuity: Capability to maintain critical operations during disruption.

Common-cause failure: Failure of apparently separate elements due to a shared cause.

Deep uncertainty: A situation in which models, probabilities or future scenarios are disputed or unknown.

Review Questions

Short Answer Questions

1. Define supply chain risk and explain why it cannot be equated with probability alone.
2. Distinguish vulnerability from exposure and consequence.
3. What is the difference between robustness and resilience?
4. Identify four major sources of supply chain risk.
5. Explain why single sourcing can increase strategic vulnerability.

Long Answer Questions

1. Explain the relationship among hazard, exposure, vulnerability, disruption and consequence using a supply network example.
2. Describe and evaluate the main stages of a supply chain risk management cycle.
3. Discuss how risk propagates through interconnected supply networks.
4. Compare redundancy, flexibility, visibility and diversification as resilience strategies.
5. Critically evaluate the usefulness and limitations of a likelihood-impact risk matrix.

Analytical / Application Questions

1. A company depends on one overseas supplier for a safety-critical component. Analyse its vulnerability and recommend a balanced resilience strategy.
2. A risk has a probability of 0.08 and an estimated consequence of £750,000. Calculate its expected loss and explain why the result should not be treated as a forecast.
3. Design a risk-monitoring dashboard for a pharmaceutical supply chain. Justify the indicators, escalation thresholds and governance responsibilities.

Multiple Choice Questions with Answers

Question 1

Which statement best defines supply chain resilience?

A. The ability to eliminate every possible supply chain risk

B. The capability to prepare for, absorb, adapt to and recover from disruption

C. The practice of reducing purchasing cost through global sourcing

D. The probability that a supplier will fail

Correct Answer: B. The capability to prepare for, absorb, adapt to and recover from disruption

Question 2

A company depends on one supplier, one transport route and one geographic region. Which risk is most directly illustrated?

A. Concentration risk

B. Demand seasonality

C. Product cannibalisation

D. Accounting risk

Correct Answer: A. Concentration risk

Question 3

If a disruption has probability 0.10 and consequence £200,000, what is its expected loss?

A. £2,000

B. £20,000

C. £200,000

D. £2,000,000

Correct Answer: B. £20,000

Question 4

Which concept refers specifically to restoring acceptable performance after a disruption?

A. Recoverability

B. Exposure

C. Hazard

D. Forecasting

Correct Answer: A. Recoverability

Question 5

What is a limitation of multiplying ordinal likelihood and impact ratings?

A. It always requires financial data

B. It can create misleading precision

C. It cannot rank any risks

D. It measures only supplier quality

Correct Answer: B. It can create misleading precision

Question 6

Which is an example of epistemic uncertainty?

A. Daily variation in customer demand

B. A known seasonal pattern

C. Incomplete knowledge of a supplier’s cyber capability

D. A fixed contractual delivery date

Correct Answer: C. Incomplete knowledge of a supplier’s cyber capability

Question 7

Which mechanism can amplify a local disruption across a network?

A. Common-cause dependency

B. Product standardisation alone

C. Stable demand

D. Complete information sharing

Correct Answer: A. Common-cause dependency

Question 8

Which action is an example of risk avoidance?

A. Buying insurance for a hazardous shipment

B. Adding safety stock for a critical component

C. Discontinuing a supply activity in a highly exposed location

D. Monitoring supplier financial indicators

Correct Answer: C. Discontinuing a supply activity in a highly exposed location

Question 9

Why can inventory alone fail to create supply chain resilience?

A. Inventory has no relationship to customer service

B. It cannot solve qualification, information or network-dependency constraints

C. Inventory always increases disruption probability

D. Inventory is useful only for financial reporting

Correct Answer: B. It cannot solve qualification, information or network-dependency constraints

Question 10

Which governance practice best supports responsible SCRM?

A. Rewarding procurement solely for lowest purchase price

B. Concealing known supplier hazards from customers

C. Defining risk appetite, ownership and escalation authority

D. Transferring every risk through contractual language

Correct Answer: C. Defining risk appetite, ownership and escalation authority