L5M2 Paper 1 – Free

✅ Correct Answer: The amount of risk it is willing to accept in pursuit of its objectives

📌 Explanation
Risk appetite is the level and type of risk an organisation is prepared to tolerate in order to achieve its strategic objectives. It frames decisions on which supply chain risks to accept, mitigate, transfer or avoid, and is set by senior management as part of a risk strategy.

❌ Why the other options are wrong:
The total number of risks recorded on its risk register — that is a count of identified risks, not the organisation's tolerance for them.
A source of potential harm within a process or activity — this defines a hazard, not risk appetite.
The financial loss suffered when a risk materialises — this describes exposure or impact, not appetite.

📋 LO: 1.1.1 — Definition of risks, hazards, exposure and risk appetite
📑 Indicative content: 1.1.1 Definitions of risk, hazard, exposure and risk appetite

✅ Correct Answer: 1, 2, 3 and 5 only

📌 Explanation
Statements 1 (financial), 2 (strategic), 3 (operational) and 5 (strategic) each correctly match the recognised risk categories. A warehouse fire is a classic hazard risk — a sudden, accidental physical event — so statement 4 is incorrect.

❌ Why the other options are wrong:
1, 3 and 4 only — includes statement 4, which mislabels a hazard risk as strategic, and omits valid statements 2 and 5.
2, 4 and 5 only — relies on the false statement 4 and drops correct statements 1 and 3.
1, 2 and 4 only — again includes the false statement 4 and omits correct statements 3 and 5.

📋 LO: 1.1.2 — Categories of risk
📑 Indicative content: 1.1.2 Categories of risk: financial, strategic, operational and hazard

✅ Correct Answer: The replacement cost of stock destroyed in the incident

📌 Explanation
Direct losses are the immediate, measurable consequences flowing straight from an event — such as the cost of replacing destroyed stock. Indirect (consequential) losses are the knock-on effects that follow later, such as lost goodwill, reputational harm and lower morale, which are harder to quantify but often larger.

❌ Why the other options are wrong:
Loss of customer goodwill and future sales — a consequential effect that emerges after the event, so it is an indirect loss.
Reputational damage reported in the media — an indirect, knock-on consequence rather than an immediate cost.
Reduced staff morale and higher staff turnover — a delayed, indirect effect of the disruption.

📋 LO: 1.1.6 — Direct and indirect losses
📑 Indicative content: 1.1.5 Positive and negative consequences of risk; 1.1.6 Direct and indirect losses

✅ Correct Answer: SWOT analysis for internal sources and STEEPLED for external sources

📌 Explanation
SWOT (strengths, weaknesses, opportunities, threats) surfaces internal capabilities and vulnerabilities, while STEEPLED (social, technological, economic, environmental, political, legal, ethical, demographic) scans the external macro-environment for sources of risk. Used together they cover both internal and external risk origins.

❌ Why the other options are wrong:
STEEPLED for internal sources and a Gantt chart for external sources — reverses STEEPLED's external role; a Gantt chart is a scheduling tool, not a risk scan.
A risk register for internal sources and a Kraljic matrix for external sources — a register records risks rather than identifying sources; Kraljic positions purchases, not external risk.
A balanced scorecard for both internal and external sources — the scorecard measures performance, not sources of risk.

📋 LO: 1.1.4 — Tools for assessing internal and external sources of risk
📑 Indicative content: 1.1.4 Tools for assessing internal and external sources of risk

✅ Correct Answer: Security of supply

📌 Explanation
Dependence on a single source for a critical component means any failure at that supplier — capacity loss, insolvency, a port closure — could halt production. This is the operational risk of security (continuity) of supply, typically mitigated through dual sourcing, buffer stock or contingency arrangements.

❌ Why the other options are wrong:
Currency speculation gains — a potential upside, not the operational risk created by single sourcing.
Over-diversification of the supply base — the opposite of the situation described, where the base is too narrow.
Excessive internal stakeholder consultation — an internal process issue, not the supply continuity risk in this scenario.

📋 LO: 1.2.4 — Security of supply
📑 Indicative content: 1.2.4 Security of supply as an operational risk in supply chains

✅ Correct Answer: Supplier insolvency risk

📌 Explanation
Insolvency risk is the danger that a supplier cannot meet its financial obligations and may cease trading, disrupting supply. It is one of the financial risks (alongside currency and cash flow risk) and is commonly monitored through credit checks and financial-ratio analysis.

❌ Why the other options are wrong:
Force majeure risk — relates to extraordinary events beyond a party's control, not a supplier's financial standing.
Quality failure risk — concerns defective goods or services, not solvency.
Logistics complexity risk — arises from intricate distribution networks, not the supplier's ability to pay debts.

📋 LO: 1.2.2 — Financial risks: currency, cash flow and insolvency
📑 Indicative content: 1.2.2 Financial risks: currency, cash flow and insolvency

✅ Correct Answer: Longer and less responsive lines of communication across time zones; Exposure to exchange-rate movements and country/political risk

📌 Explanation
Offshoring moves activity to another country, so it adds geographic and jurisdictional risks on top of the loss-of-control risks common to all outsourcing. Time-zone, language and distance issues weaken communication, while currency volatility and country/political instability create financial and continuity exposure.

❌ Why the other options are wrong:
Loss of the ability to record risks on a register — offshoring does not prevent risk recording; this is not a recognised risk.
Removal of the need for any contract with the provider — reversed logic; offshoring increases, not removes, the need for robust contracting.

📋 LO: 1.2.7 — Risks in outsourcing and offshoring
📑 Indicative content: 1.2.7 Risks in outsourcing and offshoring

✅ Correct Answer: No, because systems integration creates new technology risks such as cyber-security and data exposure

📌 Explanation
Linking systems can improve visibility but it widens the attack surface: shared access introduces cyber-security, data-protection and system-failure risks that must be actively managed. Integration changes the technology risk profile rather than removing it.

❌ Why the other options are wrong:
Yes, because integrated systems are automatically secure — uses an absolute claim; integration does not guarantee security.
Yes, because technology risk only applies to logistics providers — technology risk applies across the supply chain, not just logistics.
No, because technology risk can never be reduced by any control — correct verdict but wrong reasoning; controls such as access management and testing do reduce technology risk.

📋 LO: 1.2.5 — Technology
📑 Indicative content: 1.2.5 Technology risk; 1.2.3 Quality failure

✅ Correct Answer: Carrying out enhanced due diligence on a new supplier

📌 Explanation
Due diligence is a control that helps prevent fraud and corruption — it is good practice, not corruption itself. Bribery, facilitation payments and bid collusion are all recognised corrupt practices that distort fair competition and breach ethical codes such as the CIPS Code of Conduct.

❌ Why the other options are wrong:
Bribery to influence the award of a contract — a core form of corruption prohibited by anti-bribery legislation.
Facilitation payments to speed up routine processes — a form of corruption, illegal under many anti-bribery regimes.
Collusion between bidders to fix prices — anti-competitive corrupt behaviour that undermines fair tendering.

📋 LO: 1.3.1 — Types of corruption
📑 Indicative content: 1.3.1 Types of corruption; 1.3.2 Types of fraud

✅ Correct Answer: ISO 20400 sustainable procurement guidance

📌 Explanation
ISO 20400 provides guidance on integrating sustainability into procurement, helping organisations address environmental, social and governance risks across the supply chain. It complements wider frameworks such as the UN Global Compact and ILO core labour conventions.

❌ Why the other options are wrong:
ISO 9001 quality management systems — addresses quality management, not sustainability or ESG.
Incoterms 2020 trade terms — define delivery responsibilities and risk transfer in trade, not sustainable procurement.
ISO 31000 risk management guidance — a general risk-management framework, not specific to sustainable procurement.

📋 LO: 1.4.5 — Standards for sustainable procurement
📑 Indicative content: 1.4.5 Standards for sustainable procurement: ISO standards, UN and ILO, and local sustainability standards

✅ Correct Answer: It provides pre-drafted, industry-tested terms that allocate risk fairly and consistently

📌 Explanation
Model form contracts (such as NEC, FIDIC and JCT) offer standardised, widely understood clauses that have been refined over time. They speed up contracting, reduce drafting errors and allocate risk in a balanced, recognised way, which lowers contractual risk.

❌ Why the other options are wrong:
It removes the need for either party to perform the contract — a contract still creates binding obligations to perform.
It transfers all liability for any loss onto the buyer — model forms aim for balanced allocation, not one-sided liability.
It guarantees that no dispute can ever arise — an absolute claim; model forms reduce but cannot eliminate disputes.

📋 LO: 2.1.1 — Purpose and use of model form contracts
📑 Indicative content: 2.1.1 Purpose and use of model form contracts in managing supply chain risk

✅ Correct Answer: An indemnity clause

📌 Explanation
An indemnity is a contractual promise to compensate the other party for defined losses or liabilities, often including third-party claims. It shifts specified risk to the supplier and provides a clearer route to recovery than relying on a general damages claim.

❌ Why the other options are wrong:
A force majeure clause — excuses performance during extraordinary events; it does not provide compensation.
A retention of title clause — keeps ownership of goods with the seller until payment, unrelated to compensating for losses.
A confidentiality clause — protects sensitive information, not financial recovery for default.

📋 LO: 2.1.2 — Indemnity and liability clauses
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management

✅ Correct Answer: No, because force majeure typically suspends or excuses performance rather than creating a right to damages

📌 Explanation
A force majeure clause relieves a party from liability for non-performance caused by defined extraordinary events outside its control, such as floods. It generally suspends obligations or allows termination after a period — it does not give the other side a right to damages for that excused event.

❌ Why the other options are wrong:
Yes, because force majeure guarantees compensation for every delay — the opposite of the clause's effect, and uses an absolute claim.
Yes, because a flood is always the supplier's responsibility — a flood is usually an excusing event, not the supplier's fault.
No, because force majeure clauses are not legally permitted — correct verdict but wrong reasoning; such clauses are commonly used and enforceable.

📋 LO: 2.1.4 — Force majeure clauses
📑 Indicative content: 2.1.4 Impact of force majeure clauses in managing supply chain risk

✅ Correct Answer: Testing and inspection clauses; Acceptance (and rejection) clauses

📌 Explanation
Testing and inspection clauses let the buyer verify goods against specification before or on delivery, while acceptance/rejection clauses define when goods are deemed accepted and the buyer's right to reject non-conforming items. Together they directly manage the risk of quality failure.

❌ Why the other options are wrong:
Assignment clauses — govern transfer of contractual rights to a third party, not product quality.
Entire agreement clauses — confirm the written contract is the whole agreement; they do not address defects.

📋 LO: 2.1.3 — Clauses for testing, inspection and acceptance
📑 Indicative content: 2.1.3 Purpose and use of clauses for testing, inspection and acceptance

✅ Correct Answer: A credit rating agency

📌 Explanation
Credit rating agencies assess and score an organisation's creditworthiness, giving the buyer independent insight into the supplier's financial stability and insolvency risk before committing to a long-term contract.

❌ Why the other options are wrong:
A debt factoring provider — buys a company's receivables to improve its cash flow; it does not assess a supplier's stability for a buyer.
A disaster recovery provider — restores operations after a disruption, unrelated to credit assessment.
A freight forwarder — arranges transport and logistics, not financial assurance.

📋 LO: 2.2.1 — Third-party providers for credit rating and debt factoring
📑 Indicative content: 2.2.1 Use of third-party providers for credit rating, debt factoring and related business services

✅ Correct Answer: Auditing supply chain ESG risks such as labour standards; Providing disaster recovery services to restore operations after disruption

📌 Explanation
Third parties add specialist capacity an organisation may lack: independent auditors verify ESG and other risks deep in the supply chain, and disaster recovery specialists provide the systems and processes to resume operations quickly after an incident.

❌ Why the other options are wrong:
Setting the organisation's own risk appetite on its behalf — risk appetite is an internal governance decision for senior management, not something to outsource.
Guaranteeing that no supply chain risk will ever occur — an absolute claim; no provider can eliminate all risk.

📋 LO: 2.2.2 — Third-party auditing of risks including ESG
📑 Indicative content: 2.2.2 Third-party auditing of risks including ESG risks; 2.2.3 Disaster recovery services

✅ Correct Answer: Insurable interest

📌 Explanation
Insurable interest means the insured must stand to suffer a genuine financial loss if the insured event occurs; without it the contract is not valid. It prevents insurance being used as a wager on something the policyholder has no stake in.

❌ Why the other options are wrong:
Subrogation — lets the insurer pursue the party responsible after paying a claim, not the requirement for a financial stake.
Contribution — shares a loss proportionally between insurers when cover overlaps.
Utmost good faith — requires full disclosure of material facts, a different principle from having a financial interest.

📋 LO: 2.3.2 — Legal principles of insurance
📑 Indicative content: 2.3.2 Legal principles of insurance

✅ Correct Answer: A BCP keeps critical functions running during disruption, while a DR plan focuses on restoring systems and operations afterwards

📌 Explanation
Business continuity planning aims to maintain delivery of critical activities throughout an incident; disaster recovery is the subset concerned with recovering specific systems, data and operations after disruption. DR supports the wider BCP.

❌ Why the other options are wrong:
A BCP and a DR plan are identical and interchangeable terms — they are related but have distinct scopes.
A DR plan keeps the whole business trading, while a BCP only restores IT — reverses the two definitions.
A BCP is only required for financial risks, while a DR plan covers all others — both apply across risk types, not split by category.

📋 LO: 2.4.2 — Definitions and purpose of disaster recovery and business continuity planning
📑 Indicative content: 2.4.1 Components of a business continuity plan and disaster recovery plan; 2.4.2 Definitions and purpose

✅ Correct Answer: By combining the likelihood of the risk with the severity of its impact

📌 Explanation
A probability and impact (risk) matrix plots each risk by how likely it is and how serious its consequences would be. Multiplying or cross-referencing the two dimensions produces a rating used to prioritise which risks need the most urgent treatment.

❌ Why the other options are wrong:
By counting how many stakeholders mention the risk — popularity is not a measure of probability or impact.
By ranking risks alphabetically by description — an arbitrary order unrelated to risk severity.
By using only the financial value of the contract — ignores likelihood and non-financial impact.

📋 LO: 3.1.1 — Methodologies for assessing probability and impact
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk

✅ Correct Answer: £30,000

📌 Explanation
Expected monetary value is calculated as probability × impact. Here EMV = 0.2 × £150,000 = £30,000. EMV converts a risk into a single weighted figure so that risks of different likelihood and size can be compared and prioritised.

❌ Why the other options are wrong:
£15,000 — uses a probability of 0.1 rather than the stated 0.2.
£120,000 — applies 0.8 (the probability of non-occurrence) instead of 0.2.
£150,000 — the full impact, ignoring probability altogether.
£750,000 — divides impact by probability instead of multiplying.

📋 LO: 3.1.4 — Probability theory and statistical methods
📑 Indicative content: 3.1.4 Use of probability theory and statistical distribution methods to determine the likelihood of risk

✅ Correct Answer: Vulnerability assessment

📌 Explanation
A vulnerability assessment identifies weaknesses and the degree of exposure of assets or processes to specific threats, helping the organisation target mitigation where it is most needed. It complements probability and impact analysis by focusing on susceptibility.

❌ Why the other options are wrong:
Debt factoring review — concerns selling receivables for cash flow, not assessing exposure to threats.
Subrogation claim — an insurance recovery action after a loss, unrelated to assessing vulnerability.
Value engineering exercise — seeks better value/function at lower cost, not threat exposure.

📋 LO: 3.1.2 — Vulnerability assessments
📑 Indicative content: 3.1.2 Vulnerability assessments

✅ Correct Answer: A risk owner responsible for managing the risk; The assessed likelihood and impact of the risk

📌 Explanation
A risk register records, for each risk, its description, assessed likelihood and impact, the mitigating actions, and a named owner accountable for managing it. Ownership and scoring are essential so risks are actively tracked and prioritised.

❌ Why the other options are wrong:
The home address of the supplier's directors — irrelevant personal data that has no place in a risk register and raises data-protection concerns.
A guarantee that the risk will never occur — registers manage uncertainty; they cannot guarantee outcomes.

📋 LO: 3.2.1 — Templates for risk assessments and registers
📑 Indicative content: 3.2.1 Creation and use of templates for risk assessments and risk registers

✅ Correct Answer: They surface risks and local knowledge a single function would miss, improving completeness and ownership

📌 Explanation
Different stakeholders see different parts of the supply chain, so involving them produces a more complete picture of risks and more realistic assessments. It also builds shared ownership, making mitigation actions more likely to be implemented.

❌ Why the other options are wrong:
It allows the register to be kept secret from senior management — reporting to senior management is a core purpose of a register, not something to avoid.
It removes the need to assess likelihood and impact — assessment is still essential; engagement supports it rather than replacing it.
It guarantees that every identified risk will be eliminated — an absolute claim; engagement improves management, not certainty.

📋 LO: 3.2.2 — Engaging stakeholders in risk assessment and registers
📑 Indicative content: 3.2.2 Engaging stakeholders in the development and review of risk assessment and registers

✅ Correct Answer: It allows risks to be ignored once they are written down

📌 Explanation
Reporting and action plans exist precisely to keep risks visible and actively managed — informing decision-makers, assigning accountability and tracking progress. Treating documentation as a reason to stop acting is a misconception, not a benefit.

❌ Why the other options are wrong:
It keeps decision-makers informed of changing risk exposure — a genuine benefit of regular reporting.
It assigns accountability for agreed mitigation actions — action plans allocate responsibility, a real benefit.
It tracks whether mitigation is reducing risk over time — monitoring effectiveness is a key benefit of reporting.

📋 LO: 3.2.3 — Reporting and action plans in risk management
📑 Indicative content: 3.2.3 Importance of reporting and action plans in risk management

✅ Correct Answer: Transfer

📌 Explanation
The 4Ts framework offers four responses: Tolerate, Treat, Transfer and Terminate. Buying insurance passes the financial consequences of the risk to a third party (the insurer), which is the Transfer response — appropriate for low-likelihood, high-impact risks.

❌ Why the other options are wrong:
Terminate — would mean stopping the activity that creates the risk, e.g. closing the warehouse, not insuring it.
Tolerate — means accepting the risk without action, the opposite of taking out insurance.
Treat — means applying controls to reduce likelihood or impact, such as sprinklers, rather than transferring the financial loss.

📋 LO: 3.3.3 — Risk management process and plans
📑 Indicative content: 3.3.1 Developing a strategic approach to risk management; 3.3.3 Risk management process and the development of risk management plans