L5M2 Paper 1

✅ Correct Answer: Risk tolerance

📌 Explanation
Risk tolerance is the acceptable level of variation around a specific objective, usually set as a measurable band with a trigger for escalation. The two-day band around the on-time target is exactly that: it turns the organisation's broad risk appetite into a working limit that tells the buyer when to act.

❌ Why the other options are wrong:
Board risk appetite — appetite is the broad amount and type of risk the organisation will pursue overall, not a measurable band around one target.
Risk capacity limit — capacity is the most loss the business could absorb and survive, a ceiling rather than an accepted variation.
Gross risk exposure — exposure is how far the business is open to a risk before controls, not the variation it is prepared to accept.

📋 LO: 1.1.1 — Definition of risks, hazards, exposure and risk appetite
📑 Indicative content: 1.1.1 Definition of risks, hazards, exposure and risk appetite: risk appetite and risk tolerance

✅ Correct Answer: 1 and 3 only

📌 Explanation
Pure risks offer only a loss or no loss, and hazard risks such as fire and flood are the classic example, which is why they are usually insurable. Speculative risks can produce a gain or a loss: a strategic move into a new supply market may pay off or fail. Knowing which risks are speculative shows buyers where the upside should be managed rather than simply avoided.

❌ Why the other options are wrong:
1 and 2 only — statement 2 is false: currency movements can work in the buyer's favour as well as against it, so currency risk is speculative.
3 and 4 only — statement 4 is false: pure risks are the ones normally insurable, as their likely losses can be estimated from claims history.
2 and 4 only — Statement 2 is false: currency movements can work in the buyer's favour as well as against it, so currency risk is speculative. Statement 4 is false: pure risks are the ones normally insurable, as their likely losses can be estimated from claims history.

📋 LO: 1.1.2 — Categories of risk: financial, strategic, operational and hazard
📑 Indicative content: 1.1.2 Categories of risk: financial, strategic, operational and hazard: financial, strategic, operational and hazard risk; pure and speculative risk

✅ Correct Answer: Reviewing internal audit findings; Flowcharting the order-to-pay process

📌 Explanation
Internal sources of risk sit in the organisation's own processes, people and systems. Flowcharting the order-to-pay process shows where controls are missing or hand-offs fail, and internal audit findings record control weaknesses that have already been found. Both point the team at risks it creates itself.

❌ Why the other options are wrong:
STEEPLED analysis of markets — STEEPLED scans the external macro-environment, so it surfaces outside sources of risk rather than internal ones.
Five Forces industry analysis — Porter's Five Forces examines competitive pressure in the industry, which is an external view.
Horizon scanning for trends — horizon scanning looks for emerging external developments, not weaknesses in the firm's own processes.

📋 LO: 1.1.4 — Tools for assessing internal and external sources of risk
📑 Indicative content: 1.1.4 Tools for assessing internal and external sources of risk: tools for assessing internal sources of risk

✅ Correct Answer: Counterfeit or remarked parts with no traceability

📌 Explanation
Independent brokers sit outside the manufacturer's authorised distribution chain, so the buyer loses the traceability that franchised distributors provide. During shortages, counterfeit and remarked parts circulate widely in the broker market; they may pass visual checks yet fail in service. This quality failure risk is created directly by the change of channel.

❌ Why the other options are wrong:
Design changes made without customer notice — change control is a risk with any source; buying through brokers does not make it more likely.
Process variation between production batches — process variation arises at the chip maker and is not created by the choice of a broker channel.
Superseded drawings used at goods inward — using out-of-date drawings is an internal document-control failure, not a risk created by the source of supply.

📋 LO: 1.2.3 — Quality failure
📑 Indicative content: 1.2.3 Quality failure: quality failure from counterfeit and non-conforming parts

✅ Correct Answer: Yes - it keeps the data portable at exit

📌 Explanation
Technology risk includes vendor lock-in: a firm whose data is held in a proprietary format may be unable to switch provider, or may face high exit costs. Requiring export in an open, standard format at exit keeps the data portable, so the buyer can move to another system if the provider fails or performs poorly.

❌ Why the other options are wrong:
No - data held in the cloud remains the provider's property — the customer's operational data stays its own; the clause makes that ownership usable at exit.
No - open formats leave the data easier to steal — format affects portability, not protection; security comes from access controls and encryption.
Yes - it removes the need to check provider security — an exit clause does nothing for security during the contract, which still needs its own checks.

📋 LO: 1.2.5 — Technology
📑 Indicative content: 1.2.5 Technology: technology risk: system dependency and vendor lock-in

✅ Correct Answer: Erosion of in-house skills to manage or reverse it

📌 Explanation
Long-term outsourcing can hollow out the buyer's own capability. Once the staff who understood the service have left, the firm cannot set realistic standards, challenge the provider's reports or run the work itself, so it becomes dependent on the provider. Keeping a small intelligent-client team is the usual control.

❌ Why the other options are wrong:
Hidden costs from charges for out-of-scope work — hidden costs are a common outsourcing risk, but they would not stop the firm judging performance.
Exposure to currency moves on the service fee — currency exposure is a financial risk of offshoring and is not described here.
Leakage of confidential data held by the provider — a data breach is a real outsourcing risk, but it is not what the scenario describes.

📋 LO: 1.2.7 — Risks in outsourcing and offshoring
📑 Indicative content: 1.2.7 Risks in outsourcing and offshoring: risks in outsourcing: loss of capability and dependency

✅ Correct Answer: Order splitting

📌 Explanation
Order splitting breaks one requirement into several smaller orders so that each falls under an approval threshold. It defeats the control that should have sent a $27,000 purchase to a more senior approver or to competition. Spend analysis that groups orders by supplier, date and item is the usual way to detect it.

❌ Why the other options are wrong:
Duplicate invoicing — duplicate invoicing means paying the same invoice twice; here three separate orders were raised for parts of one requirement.
Mandate fraud — mandate fraud redirects payments through a fake change of bank details, which plays no part here.
Inflated invoicing — inflated invoicing charges more than the agreed price; the prices here are genuine, but the approval control was bypassed.

📋 LO: 1.3.2 — Types of fraud
📑 Indicative content: 1.3.2 Types of fraud: types of procurement fraud, including order splitting

✅ Correct Answer: Refuse and keep each bid confidential

📌 Explanation
The CIPS Code of Conduct requires members to treat suppliers fairly and to protect confidential information. Revealing any part of a rival's bid would distort competition and could be corruption. The buyer should refuse, keep each bidder's information confidential, and record the approach and the hint of hospitality.

❌ Why the other options are wrong:
Share a price range without naming the rival — any hint of a rival's price breaches confidentiality and the fair treatment of bidders.
Accept the hospitality but give no information — accepting hospitality from a live bidder creates a conflict of interest that the Code tells members to avoid.
Share the price once the tender has closed — bids stay confidential after the deadline too; revealing a rival's price at any stage breaches the Code.

📋 LO: 1.3.4 — The use of ethical codes including the CIPS Code of Conduct to support the elimination of risk
📑 Indicative content: 1.3.4 The use of ethical codes including the CIPS Code of Conduct to support the elimination of risk: the CIPS Code of Conduct: confidentiality and fair competition

✅ Correct Answer: ISO 37001 anti-bribery management

📌 Explanation
ISO 37001 specifies requirements for an anti-bribery management system, including due diligence on business associates, financial controls and whistleblowing routes, and it can be certified by an accredited body. It addresses governance risk directly, both inside the group and in its dealings with subcontractors and suppliers.

❌ Why the other options are wrong:
ISO 20400 sustainable procurement — ISO 20400 is guidance on sustainable procurement and cannot be certified.
ISO 14001 environmental management — ISO 14001 manages environmental aspects, not bribery.
ISO 37301 compliance management — ISO 37301 covers compliance in general; it does not set the specific anti-bribery controls the group needs.

📋 LO: 1.4.5 — Standards for sustainable procurement: ISO, UN and ILO, and local sustainability standards
📑 Indicative content: 1.4.5 Standards for sustainable procurement: ISO, UN and ILO, and local sustainability standards: ISO standards for sustainable procurement: ISO 37001

✅ Correct Answer: 2 and 4 only

📌 Explanation
Social supply chain risks reach the buyer's ESG profile because investors, customers and regulators judge a brand by conditions in its supply chain. Recruitment fees paid by workers are a recognised indicator of debt bondage and forced labour. Pay at the legal minimum can still fall well below a living wage, which many buyers' ESG commitments treat as a social risk to manage.

❌ Why the other options are wrong:
2 and 3 only — statement 3 is false: interviews away from managers make findings more reliable, as workers can speak freely.
1 and 4 only — statement 1 is false: a certificate shows compliance on one date; it does not remove ongoing health and safety risk at the site.
1 and 3 only — Statement 1 is false: a certificate shows compliance on one date; it does not remove ongoing health and safety risk at the site. Statement 3 is false: interviews away from managers make findings more reliable, as workers can speak freely.

📋 LO: 1.4.3 — How social supply chain risks impact organisational ESG considerations
📑 Indicative content: 1.4.3 How social supply chain risks impact organisational ESG considerations: social risks: forced labour indicators and living wage

✅ Correct Answer: An exclusion of indirect and consequential loss

📌 Explanation
Lost profits after a breakdown are usually indirect or consequential losses. A clause excluding indirect and consequential loss, often alongside an overall cap on liability, is how a supplier limits its exposure to losses that can far exceed the contract value. Buyers should test whether such exclusions are reasonable before agreeing them.

❌ Why the other options are wrong:
A liquidated damages clause for late delivery — liquidated damages pre-agree compensation for delay; they deal with late delivery, not breakdown losses.
A force majeure clause covering machine breakdowns — force majeure covers events beyond the parties' control; a breakdown of the supplier's own machine is not one.
A twelve-month warranty to repair any defect — a warranty promises repair; it does not by itself limit liability for the customer's lost profits.

📋 LO: 2.1.2 — Purpose and development of indemnity and liability clauses in supply chain risk management
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management: development of liability clauses: exclusions and caps

✅ Correct Answer: The Incoterms rule agreed in the contract

📌 Explanation
Incoterms rules set out the point at which risk of loss or damage passes from seller to buyer, along with who arranges and pays for carriage, insurance and export or import clearance. Naming the agreed rule, with its place and version, tells the importer exactly when it must have its own cover in place.

❌ Why the other options are wrong:
The bill of lading issued by the carrier — the bill of lading is a receipt and document of title; it does not allocate risk between seller and buyer.
The certificate of marine cargo insurance — insurance provides cover but does not decide when risk passes.
The retention of title clause in the contract — retention of title concerns ownership until payment, not the transfer of risk in transit.

📋 LO: 2.1.5 — Global sourcing considerations and compliance to standards
📑 Indicative content: 2.1.5 Global sourcing considerations and compliance to standards: global sourcing considerations: Incoterms and transfer of risk

✅ Correct Answer: A hot standby site

📌 Explanation
A hot standby site is a fully equipped duplicate facility with systems and data kept up to date, so processing can switch over within minutes. It is the most expensive option, justified where even short downtime causes severe financial and reputational harm, as with card payments.

❌ Why the other options are wrong:
A cold standby site — a cold site offers space and power but no ready systems, so recovery takes days or weeks.
A warm standby site — a warm site is partly equipped, so recovery takes hours or days rather than minutes.
A mobile recovery unit — a mobile unit must be delivered and set up, which takes far longer than minutes.

📋 LO: 2.2.3 — Use of third-party providers for disaster recovery services
📑 Indicative content: 2.2.3 Use of third-party providers for disaster recovery services: third-party disaster recovery services: hot, warm and cold sites

✅ Correct Answer: Worker interviews held off-site; Unannounced visits to the factories

📌 Explanation
Clean audits that conflict with NGO reports suggest that sites prepare for visits and that workers do not feel free to speak. Unannounced visits show normal conditions, and interviews held away from the site and from managers let workers describe problems without fear of reprisal. Both improve the reliability of third-party ESG audits.

❌ Why the other options are wrong:
Supplier self-assessment questionnaires — self-assessment relies on the supplier's own account, the opposite of independent assurance.
Audit dates agreed in advance — advance notice gives sites time to hide problems before the visit.
Interviews with line supervisors — supervisors have an interest in concealing abuses they oversee.
Document reviews at head office — records at head office do not show conditions on the production floor.
Larger samples of payroll records — records can be falsified or kept in two sets, so a bigger sample of documents still hides real conditions.

📋 LO: 2.2.2 — Use of third-party providers for auditing risks including ESG risks in supply chains
📑 Indicative content: 2.2.2 Use of third-party providers for auditing risks including ESG risks in supply chains: use of third-party providers for ESG audits

✅ Correct Answer: Retain them and budget for the cost

📌 Explanation
Insurance suits losses that are uncertain and potentially severe. Frequent, small and predictable losses are better retained and budgeted for, as a premium for them would cover the expected losses plus the insurer's administration and profit. Retention, backed by loss-prevention measures, is usually the cheaper response.

❌ Why the other options are wrong:
Insure them under a goods-in-transit policy — for frequent, predictable losses the premium would cover the losses plus the insurer's costs and profit.
Avoid them by stopping parcel deliveries — avoidance would mean abandoning a core service, out of proportion to small losses.
Transfer them through a high-excess policy — each small claim would fall below the excess, so the cover would pay almost nothing.

📋 LO: 2.3.1 — Use of insurance in managing supply chain risk
📑 Indicative content: 2.3.1 Use of insurance in managing supply chain risk: when to insure and when to retain risk

✅ Correct Answer: No - it must notify promptly and limit the loss

📌 Explanation
Insurance policies require the insured to notify the insurer promptly and to take reasonable steps to mitigate the loss, as a prudent uninsured owner would. Delaying notice can breach a policy condition, and leaving wet stock in place lets the damage grow, so the insurer may reduce or refuse the claim. Photographs and records preserve the evidence instead.

❌ Why the other options are wrong:
Yes - leaving stock in place preserves the evidence — evidence can be kept with photographs and samples; the insured must still limit further loss.
No - flood damage is excluded from property cover — flood is commonly insured; the problem is the delay and the failure to mitigate.
Yes - claims are settled at each quarter end — policies require prompt notification; there is no quarterly claims cycle.

📋 LO: 2.3.4 — Insurance claims, underwriting and supply chain risk management
📑 Indicative content: 2.3.4 Insurance claims, underwriting and supply chain risk management: insurance claims: notification and mitigation duties

✅ Correct Answer: Maximum tolerable period of disruption

📌 Explanation
The maximum tolerable period of disruption (MTPD) is the time after which the impact of losing an activity becomes unacceptable to the organisation. It sets the outer limit for continuity planning: the recovery time objective must be shorter than the MTPD, so the bakery restores packaging before customers and income are lost.

❌ Why the other options are wrong:
Recovery time objective for the line — the recovery time objective is the target time to restore the line, set shorter than the maximum tolerable period.
Recovery point objective for its data — the recovery point objective is the maximum acceptable data loss, measured back in time.
Mean time between failures of the packaging line — mean time between failures measures reliability, not how long disruption can be tolerated.

📋 LO: 2.4.1 — Components of a business continuity plan and disaster recovery plan
📑 Indicative content: 2.4.1 Components of a business continuity plan and disaster recovery plan: components of a business continuity plan: maximum tolerable period of disruption

✅ Correct Answer: Tracking each exercise action to closure; Including key suppliers in the scenario

📌 Explanation
An exercise only improves a contingency plan if what it finds is acted on. Giving each action an owner and date and tracking it to closure stops the same gaps reappearing, and bringing key suppliers into the scenario tests the hand-offs and workarounds that depend on them, which an internal exercise cannot check.

❌ Why the other options are wrong:
Briefing players on the scenario in advance — advance briefing lets players rehearse their answers, so the exercise no longer tests real decisions.
Repeating the same scenario for comparison — a repeated scenario tests the same parts of the plan each year and lets familiarity hide gaps.

📋 LO: 2.4.3 — Importance of reviewing and testing contingency plans
📑 Indicative content: 2.4.3 Importance of reviewing and testing contingency plans: testing contingency plans: exercise follow-up and supplier participation

✅ Correct Answer: About 2.5%

📌 Explanation
24 days is two standard deviations above the mean of 20 days. In a normal distribution about 95% of values fall within two standard deviations of the mean, leaving 5% outside, split equally between the two tails. So about 2.5% of shipments take longer than 24 days.

❌ Why the other options are wrong:
About 5% — the 5% outside two standard deviations covers both tails; only the upper tail counts here.
About 16% — 16% is the share above one standard deviation, that is above 22 days.
About 0.15% — 0.15% is the share above three standard deviations, that is above 26 days.

📋 LO: 3.1.4 — Use of probability theory and statistical distribution methods to determine the likelihood of risk
📑 Indicative content: 3.1.4 Use of probability theory and statistical distribution methods to determine the likelihood of risk: statistical distribution methods: the normal distribution

✅ Correct Answer: Sensitivity analysis

📌 Explanation
Sensitivity analysis changes one input at a time, for example steel prices up or down by 10%, and measures how far the total moves. The inputs that move the result most are the ones the contractor should estimate with most care, monitor closely and cover with contingency or contract terms such as price adjustment clauses.

❌ Why the other options are wrong:
Fault tree analysis — a fault tree maps the combinations of failures that lead to one top event, not the effect of each cost input.
Expected monetary value — expected monetary value gives one probability-weighted figure; it does not show which input drives the result.
Bow-tie analysis — a bow-tie shows the causes and consequences either side of one event and the controls on each side, not cost drivers.

📋 LO: 3.1.1 — Methodologies for assessing the probability and impact of risk
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk: methodologies for assessing probability and impact: sensitivity analysis

✅ Correct Answer: Risk velocity

📌 Explanation
Risk velocity is the speed at which a risk affects the organisation once it occurs. Two risks with the same probability and impact scores can need very different responses: a fast-onset cyber-attack leaves no time to react, so preventive controls and rehearsed responses matter more than for a slow regulatory change.

❌ Why the other options are wrong:
Risk appetite — appetite is the organisation's willingness to take risk, not a property of each risk.
Inherent risk — inherent risk is the level before controls; it does not capture speed of onset.
Risk detectability — detectability, used in FMEA, is how likely a failure is to be spotted, not how fast it strikes.

📋 LO: 3.1.1 — Methodologies for assessing the probability and impact of risk
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk: dimensions of risk assessment beyond probability and impact

✅ Correct Answer: Cause, event and effect in one statement

📌 Explanation
A well-formed risk description links cause, event and effect, for example: 'Because our sole resin supplier has one plant (cause), a fire there (event) would halt our moulding lines for weeks (effect).' This tells the owner what to monitor and what is at stake, and makes it easier to choose controls.

❌ Why the other options are wrong:
A single keyword naming the risk category — a category label is what the vague entries already are; it shows neither cause nor consequence.
A numerical score for likelihood and impact — scores show the size of a risk, not what triggers it or what it would do.
The owner's name and a review date — these are useful fields, but they do not describe the risk itself.

📋 LO: 3.2.1 — Creation and use of templates for risk assessments and risk registers
📑 Indicative content: 3.2.1 Creation and use of templates for risk assessments and risk registers: templates for risk registers: writing risk descriptions

✅ Correct Answer: 1 and 2 only

📌 Explanation
Stakeholders hold knowledge of risks that a central team cannot see, but their input has to be managed. A power-interest grid sets how closely each group is involved, from active partners in the review to those simply kept informed. Telling contributors how their points changed the register shows that their effort counted, which keeps them engaged in later reviews.

❌ Why the other options are wrong:
1 and 3 only — statement 3 is false: ratings from each group need challenge and moderation, as groups score their own areas inconsistently and may play risks down.
2 and 4 only — statement 4 is false: engagement should match each group's power and interest; identical treatment wastes effort and misses key players.
3 and 4 only — Statement 3 is false: ratings from each group need challenge and moderation, as groups score their own areas inconsistently and may play risks down. Statement 4 is false: engagement should match each group's power and interest; identical treatment wastes effort and misses key players.

📋 LO: 3.2.2 — Engaging stakeholders in the development and review of risk assessment and registers
📑 Indicative content: 3.2.2 Engaging stakeholders in the development and review of risk assessment and registers: engaging stakeholders in reviewing risk registers: planning and feedback

✅ Correct Answer: Yes - it stops buyers trading hidden risk for price

📌 Explanation
Culture follows what people are measured and rewarded on. If buyers are judged on savings alone, they may choose cheap single sources or financially weak suppliers and leave the organisation carrying hidden risk. Adding supply-risk measures alongside savings makes risk part of everyday sourcing decisions, the mark of a healthy risk culture.

❌ Why the other options are wrong:
No - risk measures belong to finance, not to buyers — buyers make the sourcing decisions that create supply risk, so ownership belongs with them.
Yes - it lets the risk team stop monitoring suppliers — buyer objectives support the risk function; they do not replace central monitoring.
No - adding risk measures will weaken the savings drive — the aim is balance; savings that create hidden risk are not real savings.

📋 LO: 3.3.2 — Role of organisation culture in management of supply chain risk
📑 Indicative content: 3.3.2 Role of organisation culture in management of supply chain risk: the role of culture and performance measures in managing supply risk

✅ Correct Answer: A supply chain control tower

📌 Explanation
A supply chain control tower brings data from suppliers, logistics providers and internal systems into one hub, giving live, end-to-end visibility of orders, inventory and disruption alerts. It lets the business spot problems early, report risk status to stakeholders and coordinate responses across tiers.

❌ Why the other options are wrong:
A quarterly supplier scorecard — a scorecard is periodic and backward-looking, not a live view across tiers.
An enterprise risk register — a risk register lists assessed risks; it does not track orders and stock live.
A spend analytics dashboard — spend analytics shows historic spend, not live orders and disruptions.

📋 LO: 3.3.5 — Supply chain risk visibility and reporting to stakeholders
📑 Indicative content: 3.3.5 Supply chain risk visibility and reporting to stakeholders: supply chain risk visibility and reporting