Risk Governance, Appetite and Organizational Culture

Introduction

Supply chain risk management is not governed effectively merely because an organization has a risk register, insurance programme, continuity plan or compliance department. Governance determines who has authority to make risk decisions, which risks the organization is prepared to accept, how controls are designed and monitored, and when issues must be escalated. In supply chains, these questions are especially important because risk is distributed across suppliers, logistics providers, technology platforms, customers, regulators and geopolitical systems. A disruption may originate outside the legal boundary of the focal organization while still affecting its customers, reputation, cash flow and strategic objectives.

Risk governance therefore connects strategy with operational behaviour. It converts broad intentions—such as resilience, service reliability, ethical sourcing or cost leadership—into decision rights, policies, controls, performance measures and escalation processes. It also shapes organizational culture: the shared assumptions and behaviours that determine whether people report bad news early, challenge unrealistic plans and learn from near misses.

This chapter examines the design and practical use of supply chain risk governance. It distinguishes risk appetite from risk tolerance, explains ownership and accountability, discusses the relationship between governance and internal control, and evaluates how leadership and culture influence risk outcomes.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the meaning and purpose of supply chain risk governance.
2. Distinguish risk capacity, appetite, tolerance, limits and thresholds.
3. Allocate risk ownership and accountability across supply chain roles.
4. Design governance policies, controls, reporting routines and escalation structures.
5. Evaluate the influence of leadership and organizational culture on risk management.
6. Apply governance principles to a complex supply chain disruption scenario.
7. Critically assess limitations, ethical issues and emerging technology applications.

1. The Meaning and Scope of Risk Governance

Risk governance is the system through which an organization directs, oversees and controls risk-taking. It includes the structures, policies, processes, information flows, behaviours and assurance activities used to manage uncertainty in relation to organizational objectives.

Supply chain risk governance has four connected dimensions:

Governance differs from risk management, although the two are interdependent. Risk management identifies, assesses, treats and monitors risks. Governance establishes the authority, accountability and boundaries within which those activities occur. A procurement analyst may identify supplier concentration risk, but governance determines whether the risk is accepted by the category manager, escalated to the chief operations officer or submitted to the board.

An effective governance system should be proportionate. A small organization may use a monthly management meeting and a concise risk dashboard; a multinational manufacturer may require a board risk committee, regional committees, formal delegations, independent assurance and integrated enterprise-risk technology. Complexity alone, however, does not guarantee effectiveness. Excessive committees can slow decisions, obscure accountability and encourage people to assume that someone else is responsible.

2. Strategic Alignment and the Risk Governance Architecture

Risk governance begins with strategy. A low-cost supply chain, a highly responsive supply chain and a premium ethical supply chain face different exposures and should not use identical risk priorities. For example, a low-cost strategy may accept some supplier concentration to obtain scale economies, whereas a resilience-oriented strategy may deliberately maintain dual sourcing even at higher unit cost.

A practical governance architecture typically contains five levels:

1. Board or governing body: approves strategic direction, oversees material risks and confirms that management has established suitable controls.
2. Executive leadership: translates strategy into risk appetite, policies, resources and performance expectations.
3. Risk, audit or compliance functions: develop frameworks, challenge management, consolidate reporting and provide specialist advice. These functions should not replace operational ownership.
4. Business and supply chain management: own risks arising from sourcing, planning, manufacturing, logistics, inventory, information systems and supplier relationships.
5. Operational personnel and partners: execute controls, identify emerging conditions and report incidents or near misses.

A useful principle is the separation of ownership, oversight and independent assurance. The person who operates a process should normally own its risks and controls. A risk or compliance function may advise and challenge, but should not accept operational risk on behalf of management. Internal audit provides independent assurance rather than designing or operating the controls it later evaluates.

This logic is often expressed through the three-lines model:

• First line: operational management owns and manages risk.
• Second line: risk, compliance, quality or security functions support, monitor and challenge the first line.
• Third line: internal audit independently evaluates governance, risk management and control.

The model is not a rigid hierarchy. In a smaller enterprise, one person may perform multiple functions, but conflicts of interest should be recognized and mitigated.

3. Risk Capacity, Appetite, Tolerance and Limits

These terms are related but not interchangeable.

Risk capacity is the maximum level of risk an organization can bear before its survival, solvency, legal position or ability to pursue its strategy is seriously threatened. Capacity is influenced by cash reserves, debt covenants, regulatory requirements, contractual commitments, insurance, operational capability and stakeholder expectations.

Risk appetite is the amount and type of risk an organization is willing to pursue or retain in seeking its objectives. Appetite is a strategic choice. It may be expressed qualitatively, quantitatively or both.

Risk tolerance is the acceptable variation around a particular objective, process or risk measure. Tolerance is usually more specific and operational than appetite.

Risk limits are enforceable boundaries that should not be exceeded without authorized approval or escalation. Thresholds are trigger points that prompt investigation or management action before a limit is breached.

The relationship can be summarized as:

This is a governance relationship rather than a universal numerical law. It assumes that the organization has defined comparable dimensions and that appetite is not set above its ability to absorb loss. Limits may be set below appetite to provide a safety margin and early warning.

For example, a retailer may state:

• Strategic appetite: moderate appetite for supplier innovation and low appetite for loss of product safety assurance.
• Capacity: no more than 10 days of disruption to a critical product family without severe financial or customer consequences.
• Tolerance: a critical supplier may account for no more than 40% of annual volume unless a documented exception exists.
• Threshold: supplier concentration above 35% triggers a mitigation review.
• Limit: concentration above 40% requires executive approval and a time-bound remediation plan.

A risk appetite statement should answer five questions:

1. Which objectives and risk categories does it cover?
2. What level of exposure is acceptable?
3. What forms of risk-taking are encouraged or prohibited?
4. Which indicators show that appetite is being approached or exceeded?
5. Who may approve exceptions, and how quickly must they be escalated?

Qualitative and Quantitative Appetite Statements

Qualitative statements are appropriate where measurement is difficult or where ethical and legal principles dominate. Examples include “zero tolerance for deliberate falsification of supplier records” or “minimal tolerance for forced labour risk.” Zero tolerance should be used carefully. It may mean zero acceptance of the behaviour, not an unrealistic claim that exposure can never exist in a complex global supply chain.

Quantitative statements can refer to service, financial, operational or compliance measures. Examples include maximum acceptable downtime for a supplier portal, maximum percentage of spend in a high-risk country, maximum backlog of overdue corrective actions or maximum number of days of inventory for a critical item.

Metrics should be linked to decisions. A dashboard that reports supplier concentration without specifying an owner, threshold and response is descriptive rather than governable.

4. Risk Ownership and Accountability

Risk ownership means responsibility for ensuring that a risk is understood, treated, monitored and reported. Accountability is the obligation to explain decisions and accept consequences. A person may delegate tasks but normally cannot delegate accountability for the outcome.

Ownership should be assigned to the manager with sufficient authority, resources, expertise and proximity to the risk. A chief procurement officer may own strategic supplier concentration, while a supplier quality manager owns product conformity risk and a chief information officer owns cyber risks affecting supply chain systems. Interdependencies should be documented because one event may have several owners across different risk categories.

A RACI matrix can clarify roles:

R means responsible for performing work, A means accountable for the result, C means consulted and I means informed. Each activity should have one clear accountable role, even where several parties contribute.

Common ownership failures include:

• assigning a risk to a committee rather than an individual executive;
• making the risk department responsible for operational risks it cannot control;
• assigning risks at a level too senior to support timely action;
• measuring control completion rather than risk reduction;
• failing to update ownership after reorganizations or outsourcing.

5. Policies, Standards and Internal Controls

A risk policy establishes principles and minimum requirements. A standard provides more specific expectations, such as supplier due diligence or access-control requirements. Procedures explain how work is performed. Guidelines offer recommended practices where judgement is necessary.

A coherent policy hierarchy prevents two opposite problems: excessive detail at the strategic level and uncontrolled discretion at the operational level. A supply chain risk policy may require risk-based supplier segmentation, documented approval for exceptions, periodic monitoring and incident escalation. A supplier onboarding standard may define checks for financial health, sanctions, labour practices, cyber maturity and business continuity.

Internal controls are actions designed to provide reasonable assurance that objectives will be achieved. Controls may be:

• Preventive: supplier approval before purchase orders are released.
• Detective: monitoring for unusual order changes or duplicate bank accounts.
• Corrective: containment, recall or remediation after a control failure.
• Directive: policies, training and leadership instructions that establish expected behaviour.

Controls may also be manual, automated or hybrid. Automation can improve consistency but may reproduce poor rules at scale. A control is effective only when its design is suitable and it operates as intended. Evidence should show who performed it, what was checked, when it was completed and how exceptions were resolved.

Control design should consider cost and proportionality. A high-value, safety-critical supplier may justify site audits, financial monitoring and independent certification. Applying the same intensity to a low-value office-supplies vendor can consume resources without materially reducing exposure.

6. Reporting, Escalation and Decision Rights

Risk reporting should support decisions rather than simply provide information. A useful report links each material risk to its cause, event, consequence, current controls, exposure, owner, trend, appetite position and planned action.

A basic escalation structure may use three conditions:

1. Watch: exposure is within tolerance but deteriorating or requiring management attention.
2. Action: a threshold is exceeded; the owner must implement a defined response within a specified period.
3. Critical escalation: a limit is breached or a major event occurs; senior leadership activates crisis management and informs relevant stakeholders.

Escalation criteria should include more than financial loss. They may include threats to human safety, product integrity, legal compliance, customer commitments, human rights, environmental performance, data confidentiality and organizational reputation.

Effective escalation has four characteristics:

• Speed: urgent risks move rapidly to the people who can act.
• Clarity: thresholds and decision rights are understood in advance.
• Traceability: decisions, assumptions and approvals are recorded.
• Psychological safety: employees can report concerns without retaliation.

A “no surprises” culture does not mean that managers receive no bad news. It means that material bad news is communicated early enough to preserve options.

7. Organizational Culture and Leadership

Organizational culture is reflected in repeated behaviours, informal norms, incentives and assumptions. A company may possess excellent policies but still have weak risk governance if employees believe that production targets matter more than safety, that reporting problems damages careers or that senior leaders will not tolerate challenge.

Important cultural dimensions include:

• Speak-up climate: willingness to report concerns and near misses.
• Accountability: consistent ownership of decisions and consequences.
• Learning orientation: use of incidents to improve systems rather than merely assign blame.
• Respect for controls: recognition that controls support objectives rather than obstruct performance.
• Challenge and independence: willingness to question forecasts, suppliers and executive assumptions.
• Ethical consistency: alignment between stated values, incentives and actual decisions.

Leadership shapes culture through resource allocation, attention, role modelling and responses to failure. If leaders demand uninterrupted supply at any cost, employees may conceal quality or labour concerns. If leaders reward early escalation and fund mitigation, the same employees are more likely to surface emerging risks.

Culture can be assessed through surveys, interviews, focus groups, whistleblowing data, audit findings, near-miss reporting, employee turnover and observed decision practices. No single metric proves that culture is strong. For example, a low number of reported incidents may indicate excellent performance—or fear of reporting.

A mature culture does not eliminate judgement or risk. It enables informed risk-taking within clear boundaries. It also distinguishes honest mistakes, negligence and deliberate misconduct, applying proportionate responses.

8. A Practical Governance Design Method

A postgraduate supply chain manager can use the following design sequence.

Step 1: Clarify strategic objectives

Identify objectives such as cost, service, growth, innovation, resilience, compliance, sustainability and customer trust. Risk appetite has meaning only in relation to objectives.

Step 2: Map the supply chain and critical dependencies

Identify suppliers, tiers, logistics nodes, systems, facilities, utilities, labour dependencies and external institutions. Consider hidden dependencies such as common sub-tier suppliers or shared transport corridors.

Step 3: Define risk categories and materiality

Use categories such as supply continuity, demand, quality, cyber, geopolitical, financial, legal, environmental, social and reputational risk. Define what makes a risk material.

Step 4: Set capacity, appetite, tolerance and limits

Use evidence from scenario analysis, financial resilience, service commitments and stakeholder requirements. Avoid setting targets that are impossible to monitor.

Step 5: Assign ownership and decision rights

Name an accountable executive and operational control owners. Define who can accept exceptions and who must be consulted.

Step 6: Design controls and indicators

Select preventive, detective and corrective controls. Establish key risk indicators (KRIs), key control indicators and performance measures. Indicators should have owners, data sources, frequency and response actions.

Step 7: Establish escalation and assurance

Define reporting frequency, event notification periods, crisis authority, documentation requirements and independent testing arrangements.

Step 8: Review and learn

Reassess appetite after strategic changes, acquisitions, major incidents, regulatory change or significant shifts in the supply market. Governance should be dynamic rather than a one-time documentation exercise.

9. Worked Application: Supplier Concentration Exposure

Consider a manufacturer whose critical component is purchased from three suppliers. Annual demand is 100,000 units. Supplier A provides 55,000 units, B provides 30,000 and C provides 15,000. The organization’s policy states that no supplier should provide more than 40% of critical-component demand without an approved exception.

The concentration share for supplier i is:

where sᵢ is supplier i’s share, qᵢ is the quantity sourced from supplier i, and Q is total demand. The quantities must use the same unit and period.

For supplier A:

Supplier A exceeds the 40% limit. The immediate governance conclusion is not automatically to terminate the supplier. Management should investigate whether A is uniquely capable, whether alternatives are qualified, the time required to transfer volume, inventory protection, contractual commitments and the consequences of disruption. The risk owner should escalate the breach, document the rationale for any temporary exception and establish a remediation date.

Possible actions include qualifying supplier C for additional volume, redesigning the component, holding strategically justified inventory, negotiating continuity obligations or investing in supplier development. Each action has cost, lead-time and execution risks. Governance ensures that the decision is explicit rather than an accidental result of short-term purchasing pressure.

10. Illustrative Case: Meridian Appliances and the Silent Constraint

Background

Meridian Appliances, a fictional international manufacturer, marketed itself as a reliable producer of energy-efficient refrigerators. Its supply chain strategy emphasized low unit cost and global scale. A key electronic control module was sourced from one specialist supplier in another region. The supplier had excellent historical quality and was approved through the normal procurement process.

Problem

A severe storm disrupted the supplier’s electricity supply and damaged a sub-tier semiconductor facility. Meridian initially received no formal warning. The supplier’s sales team continued to confirm delivery dates because its performance incentives were based on maintaining customer commitments. Within two weeks, Meridian’s assembly plants faced a component shortage. The organization discovered that the same semiconductor was used by several other suppliers and that no approved alternative existed.

The incident revealed governance weaknesses:

• procurement owned price and delivery but no executive owned concentration risk;
• supplier due diligence assessed the direct supplier but not critical sub-tier dependencies;
• the risk dashboard reported on-time delivery but not resilience indicators;
• employees were reluctant to escalate because previous warnings had been treated as obstacles to cost reduction;
• the business continuity plan assumed a direct supplier failure, not a shared sub-tier failure.

Analysis

The event was not simply a weather problem. It was a governance problem involving concentration, incomplete visibility, incentive design, weak escalation and an appetite statement that emphasized cost without defining acceptable continuity exposure. The direct supplier had complied with its contractual obligations until the disruption became unavoidable, but contractual compliance did not provide sufficient resilience.

Approach and solution

Meridian’s executive committee took five actions:

1. It established an executive owner for critical-component continuity and required a quarterly report to the operations risk committee.
2. It revised the appetite statement to specify maximum acceptable exposure for single-source components and critical sub-tier dependencies.
3. It introduced a supplier segmentation model based on business criticality, substitutability, lead time, geographic concentration and recovery capability.
4. It required continuity evidence and sub-tier mapping for high-criticality suppliers, while recognizing confidentiality and commercial constraints.
5. It redesigned incentives so that early reporting, validated contingency plans and risk reduction contributed to supplier and internal performance evaluation.

Meridian also funded qualification of a second module design, increased limited strategic inventory during the transition and established an incident escalation protocol with explicit time thresholds.

Outcome

The organization did not eliminate all disruption risk, but it reduced dependence on a single technical pathway and improved visibility. Subsequent exercises identified additional shared dependencies. Importantly, managers began reporting weak signals earlier because escalation was treated as responsible performance rather than failure.

Learning points

1. A supplier’s historical performance does not prove resilience under novel conditions.
2. Risk ownership must cover dependencies, not merely contracts.
3. Appetite statements should address the trade-off between efficiency and continuity.
4. Incentives can either reinforce or undermine governance.
5. Culture determines whether formal escalation mechanisms are actually used.

11. Challenges and Limitations

Risk governance faces several persistent limitations.

Uncertainty and model risk: Supply chain relationships are complex, and available data may be incomplete or biased. Risk assessments should state assumptions and use scenarios rather than imply precise prediction.

Conflicting objectives: Cost, speed, resilience, sustainability and security may require trade-offs. Governance should make these trade-offs visible rather than conceal them in operational decisions.

Third-party dependence: Organizations cannot directly control all supplier actions. Contracts, collaboration, auditing, incentives and alternative sources provide different degrees of influence but not certainty.

Governance overload: Too many indicators and approval layers can slow action and cause “dashboard fatigue.” Materiality and exception-based reporting are essential.

False assurance: Certifications and completed checklists may create confidence without demonstrating real capability. Assurance should test outcomes, evidence and recovery performance.

Dynamic risk: Geopolitical shifts, climate events, cyber threats and technological change can invalidate historical assumptions. Appetite and controls require periodic review.

12. Ethical, Regulatory and Technology Considerations

Supply chain governance has ethical consequences. Decisions about suppliers may affect worker safety, wages, forced labour exposure, privacy, local communities and environmental harm. A low-cost sourcing decision can transfer risk to vulnerable people or ecosystems. Ethical governance therefore requires due diligence, grievance mechanisms, responsible purchasing practices and remediation where harm is identified.

Regulatory expectations differ by jurisdiction but commonly concern product safety, sanctions, competition, data protection, environmental reporting, modern slavery or forced labour, and financial integrity. Compliance should not be treated as the entire risk-management objective. Legal minimums may be lower than the organization’s ethical commitments or stakeholder expectations.

Technology can support governance through supplier-risk platforms, workflow controls, access logs, scenario models, process mining and anomaly detection. Artificial intelligence may help identify patterns in news, invoices, shipping data or supplier communications. However, AI outputs require human oversight because data may be incomplete, explanations limited and false positives costly. Organizations should define data ownership, model validation, privacy safeguards, audit trails and escalation responsibility. An algorithm should inform a risk decision, not silently make an unaccountable decision about a supplier’s future.

Best Practices

The following practices support mature supply chain risk governance:

• align risk appetite explicitly with strategy and stakeholder obligations;
• distinguish capacity, appetite, tolerance, limits and thresholds;
• assign one accountable owner to each material risk;
• use risk-based supplier segmentation rather than identical controls for every supplier;
• connect indicators to predefined actions and escalation rights;
• test continuity plans through exercises, not only document reviews;
• include sub-tier and shared-dependency analysis for critical items;
• protect and reward responsible reporting;
• separate operational ownership, second-line challenge and independent assurance;
• review incentives for unintended encouragement of concealment or excessive risk-taking;
• record exceptions with rationale, owner, expiry date and remediation plan;
• integrate ethical, legal, cyber, environmental and human-rights considerations;
• use technology to improve evidence and visibility while retaining human accountability.

Chapter Summary

Risk governance establishes how supply chain risks are directed, owned, controlled, reported and challenged. It connects strategy with operational decisions through governance structures, policies, decision rights and assurance. Risk capacity describes the maximum exposure an organization can bear; appetite describes the exposure it is willing to accept; tolerance, limits and thresholds translate that strategic position into operational boundaries.

Effective governance assigns material risks to accountable owners, separates operational management from independent assurance, and links indicators to clear escalation actions. Internal controls should be proportionate, evidence-based and tested for both design and operation. Leadership and culture are equally important: employees must be able to report weak signals, challenge assumptions and learn from incidents without fear of retaliation. The illustrative Meridian case demonstrates that supplier resilience depends on visibility, incentives, sub-tier understanding and executive ownership, not simply on direct-supplier performance.

Because supply chains are dynamic and ethically consequential, governance must be reviewed as strategy, technology, regulation and external conditions change. Strong governance does not eliminate uncertainty; it makes risk-taking deliberate, accountable and aligned with organizational purpose.

Key Terms

Risk governance: The structures, policies, processes and behaviours used to direct and oversee risk.

Risk capacity: The maximum risk exposure an organization can bear without threatening its viability or strategic objectives.

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Risk tolerance: Acceptable variation around a particular objective, process or risk measure.

Risk limit: A defined boundary that should not be exceeded without authorized action.

Threshold: A trigger point indicating that investigation or management action is required.

Risk owner: The individual accountable for ensuring that a risk is understood, treated, monitored and reported.

Accountability: The obligation to explain decisions and accept responsibility for outcomes.

Three-lines model: A model distinguishing operational ownership, specialist oversight and independent assurance.

Internal control: An action or mechanism providing reasonable assurance that objectives will be achieved.

Preventive control: A control designed to stop an unwanted event before it occurs.

Detective control: A control designed to identify an event or deviation after it occurs.

Key risk indicator: A measure that signals changes in risk exposure or proximity to a boundary.

Escalation: The movement of a risk or incident to a higher authority for decision or intervention.

Risk culture: Shared assumptions and behaviours influencing how people perceive and manage risk.

Psychological safety: A climate in which people can raise concerns without fear of unfair retaliation.

Supplier concentration: Dependence on a small number of suppliers for volume, capability or critical inputs.

Sub-tier supplier: A supplier serving a focal organization indirectly through another supplier.

Independent assurance: Objective evaluation of governance, risk management or controls by a function separate from operations.

Review Questions

Short Answer Questions

1. Define risk appetite and explain how it differs from risk capacity.
2. What is the purpose of a risk owner?
3. Distinguish a threshold from a risk limit.
4. Identify the three lines in the three-lines model.
5. Why is psychological safety important for supply chain risk reporting?

Long Answer Questions

1. Explain how supply chain risk governance connects organizational strategy with operational controls.
2. Discuss the characteristics of an effective risk appetite statement, using supply chain examples.
3. Analyse the relationship between ownership, accountability and the RACI framework.
4. Explain how leadership incentives and organizational culture can weaken or strengthen risk governance.
5. Evaluate the benefits and limitations of using technology and artificial intelligence in supplier-risk governance.

Analytical / Application Questions

1. A company sources 70% of a critical component from one supplier. Design an appetite statement, threshold, limit, ownership arrangement and escalation response for this exposure.
2. A supplier repeatedly meets delivery targets but refuses to disclose sub-tier dependencies. Analyse the governance issues and recommend proportionate actions.
3. An employee reports a potential product-safety issue shortly before a major customer shipment. Develop an escalation and decision process that balances commercial pressure, safety, ethics and accountability.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes risk appetite from risk tolerance?

A. Appetite is the maximum survivable risk, while tolerance is the legal minimum.

B. Appetite is the amount of risk the organization is willing to accept strategically, while tolerance is acceptable variation around a specific objective or process.

C. Appetite applies only to financial risk, while tolerance applies only to supplier risk.

D. Appetite is an operational control, while tolerance is an audit opinion.

Correct Answer: B. Appetite is the amount of risk the organization is willing to accept strategically, while tolerance is acceptable variation around a specific objective or process.

Question 2

Which role normally owns the day-to-day risks arising from a procurement process?

A. The operational manager responsible for the procurement process

B. The external auditor

C. The board chair alone

D. The insurance broker

Correct Answer: A. The operational manager responsible for the procurement process

Question 3

A supplier concentration threshold is exceeded but the formal limit has not yet been breached. What is the most appropriate response?

A. Ignore the result because the limit was not breached

B. Automatically terminate the supplier

C. Investigate the exposure and initiate the predefined management review

D. Delete the indicator from the dashboard

Correct Answer: C. Investigate the exposure and initiate the predefined management review

Question 4

Which activity is most consistent with the third line of the three-lines model?

A. Operating supplier approval controls

B. Negotiating supplier prices

C. Setting daily production schedules

D. Independently evaluating the effectiveness of governance and controls

Correct Answer: D. Independently evaluating the effectiveness of governance and controls

Question 5

A company has total annual demand of 100,000 units and buys 55,000 units from Supplier A. What is Supplier A’s concentration share?

A. 5.5%

B. 45%

C. 55%

D. 155%

Correct Answer: C. 55%

Question 6

Which cultural condition most supports early escalation of supply chain risks?

A. Punishing every reported mistake

B. Rewarding concealment of performance problems

C. Psychological safety combined with clear accountability

D. Removing all operational targets

Correct Answer: C. Psychological safety combined with clear accountability

Question 7

Which is an example of a preventive control?

A. A post-incident investigation

B. Approval of a supplier before purchase orders are released

C. A report of last month’s late deliveries

D. A product recall after a defect is found

Correct Answer: B. Approval of a supplier before purchase orders are released

Question 8

Why can a low number of reported incidents be an unreliable indicator of strong risk culture?

A. Incidents are always unrelated to culture

B. Low reporting may reflect fear or concealment rather than low exposure

C. Incident data cannot be collected in supply chains

D. Strong cultures never experience incidents

Correct Answer: B. Low reporting may reflect fear or concealment rather than low exposure

Question 9

What is a key governance concern when artificial intelligence is used for supplier-risk screening?

A. It eliminates the need for human accountability

B. It guarantees that supplier data is complete

C. Its outputs may contain bias or errors and require oversight and validation

D. It prevents all false positives

Correct Answer: C. Its outputs may contain bias or errors and require oversight and validation

Question 10

Which feature makes an escalation process effective?

A. Unclear decision rights

B. Delayed reporting until all facts are certain

C. Thresholds, responsible owners, traceability and timely communication

D. Reporting only financial losses

Correct Answer: C. Thresholds, responsible owners, traceability and timely communication