L5M2 Paper 13

✅ Correct Answer: Upside (opportunity) risk, where a calculated exposure may yield gain as well as loss

📌 Explanation
The positive consequences of risk arise with speculative, two-sided risk, where deliberately accepting uncertainty can deliver reward as well as downside. Backing a promising but unproven supplier is opportunity-seeking risk-taking, weighing potential market gain against the chance of failure.

❌ Why the other options are wrong:
Pure hazard risk, where only loss is ever possible — pure risk has no upside, the opposite of a two-way bet.
Residual risk, the exposure remaining after controls are applied — that describes risk left after treatment, not the opportunity dimension.
Inherent risk, the exposure before any control is applied — describes untreated exposure, not the upside of a speculative choice.

📋 LO: 1.1.5 — Positive and negative consequences of risk
📑 Indicative content: 1.1.5 Positive and negative consequences of risk

✅ Correct Answer: 1, 2, 3 and 5 only

📌 Explanation
Statements 1, 2, 3 and 5 correctly define risk appetite, hazard, exposure and risk in the standard risk-management vocabulary. Statement 4 is wrong: a hazard is a source of potential harm, not the loss itself, which is better described as the loss or impact when a risk crystallises.

❌ Why the other options are wrong:
1, 3 and 4 only — includes the false statement 4 and omits valid statements 2 and 5.
2, 4 and 5 only — relies on the false statement 4 and drops correct statements 1 and 3.
1, 2 and 4 only — again includes false statement 4 and omits correct statements 3 and 5.

📋 LO: 1.1.1 — Definition of risks, hazards, exposure and risk appetite
📑 Indicative content: 1.1.1 Definitions of risk, hazard, exposure and risk appetite

✅ Correct Answer: A pallet of stock damaged by a forklift in the warehouse

📌 Explanation
Strategic risks threaten the organisation's long-term direction and ability to meet its objectives, such as backing the wrong region, market or technology. A pallet damaged by a forklift is a day-to-day operational risk, so it is the exception here.

❌ Why the other options are wrong:
Committing to a sourcing region that later becomes uncompetitive — a long-term direction choice, so a strategic risk.
Vertically integrating into a market that subsequently declines — a strategic structural decision that can undermine objectives.
Building the supply base around a technology heading for obsolescence — a strategic positioning risk affecting the future.

📋 LO: 1.1.2 — Categories of risk
📑 Indicative content: 1.1.2 Categories of risk: financial, strategic, operational and hazard

✅ Correct Answer: A supplier keeping no audit trail for its high-value payments; A supplier whose directors hold undisclosed interests in its sub-contractors

📌 Explanation
The governance (G) pillar concerns how an organisation is directed, controlled and held to account — transparency, accountability and oversight. Absent payment audit trails and undisclosed director interests are governance failures that flow through to the buyer's own ESG profile, risking corruption, sanctions and reputational harm.

❌ Why the other options are wrong:
A supplier emitting high levels of particulates from its kilns — an environmental (E) risk, not governance.
A supplier paying below the legal minimum wage to its staff — a social (S) labour-conditions risk, not governance.

📋 LO: 1.4.4 — How governance supply chain risks impact ESG
📑 Indicative content: 1.4.4 How governance supply chain risks impact organisational ESG considerations

✅ Correct Answer: Security of supply

📌 Explanation
A single qualified source pausing output with no substitute directly threatens continued availability of a critical input, which is the operational risk to security of supply. It is mitigated through qualifying alternative sources, buffer stock and contractual continuity obligations.

❌ Why the other options are wrong:
Currency translation risk — a financial risk from exchange-rate movement, not single-source continuity.
Over-diversification of the supply base — the opposite of this concentrated, single-source position.
Excessive internal approval layers — an internal process issue, not the continuity risk described.

📋 LO: 1.2.4 — Security of supply
📑 Indicative content: 1.2.4 Security of supply as an operational risk in supply chains

✅ Correct Answer: No, because even short delays can trigger penalties, lost sales and downstream disruption that must be assessed

📌 Explanation
Logistics complexity and transit delay are operational risks whose impact depends on context, not just duration. A few days' delay can breach service commitments, incur penalties, lose perishable value and ripple through the chain, so the exposure must still be assessed and managed.

❌ Why the other options are wrong:
Yes, because a delay measured in days is never an operational risk — an absolute claim; short delays can carry significant impact.
Yes, because operational risk applies only to manufacturing, not logistics — logistics delay is a recognised operational risk.
No, because route disruptions are always covered free of charge by carriers — correct verdict but invented reasoning; carriers do not absorb such losses automatically.

📋 LO: 1.2.6 — Logistics complexity
📑 Indicative content: 1.2.6 Logistics complexity as an operational risk

✅ Correct Answer: Technology and data-security risk from widening system access

📌 Explanation
Granting a supplier direct access to live planning data widens the attack surface and exposes sensitive information, a technology and data-security risk. It is managed through access controls, monitoring, data-handling clauses and supplier IT assurance rather than assumed away.

❌ Why the other options are wrong:
Currency risk on the goods purchased — arises from exchange-rate movement, not system access.
Insurable interest risk under its policy — an insurance principle, not an operational technology risk.
Over-specification of the requirement — a specification issue, unrelated to data access.

📋 LO: 1.2.5 — Technology
📑 Indicative content: 1.2.5 Technology risk in supply chains

✅ Correct Answer: Routine three-way matching of orders, receipts and invoices before payment

📌 Explanation
Three-way matching is a preventive control that detects and deters fraud, not a warning sign of it. Unexplained write-offs, reluctance to take leave and unsupported stock adjustments are recognised red flags of asset misappropriation that controls and audit are designed to surface.

❌ Why the other options are wrong:
Inventory write-offs rising without a clear operational explanation — a recognised red flag that stock may be diverted.
An employee reluctant to take leave or hand over their duties — a classic indicator someone is concealing wrongdoing.
Frequent adjustments to stock records that lack supporting evidence — a documented sign of possible misappropriation.

📋 LO: 1.3.2 — Types of fraud
📑 Indicative content: 1.3.2 Types of fraud; 1.3.3 Governance of fraud and corruption

✅ Correct Answer: ISO 14001 environmental management systems

📌 Explanation
ISO 14001 sets out requirements for an environmental management system, helping organisations control and improve their environmental performance and address the E pillar of ESG across operations and sourcing. It complements sustainable-procurement guidance such as ISO 20400.

❌ Why the other options are wrong:
ISO 27001 information security management — addresses information security, not environmental management.
Incoterms 2020 trade terms — define delivery and risk transfer in trade, not environmental systems.
The Kraljic portfolio matrix — a sourcing-positioning tool, not an environmental standard.

📋 LO: 1.4.5 — Standards for sustainable procurement
📑 Indicative content: 1.4.5 Standards for sustainable procurement: ISO standards, UN and ILO, and local sustainability standards

✅ Correct Answer: An accidental fire is a fortuitous hazard event, whereas a deliberate act is intentional and generally uninsurable

📌 Explanation
Hazard (pure) risks are sudden accidental events that can only cause loss; insurance covers fortuitous loss, not intentional wrongdoing. An accidental fire is therefore a classic insurable hazard, while a deliberate act by the insured falls outside cover, which is why the two are treated differently.

❌ Why the other options are wrong:
Both are speculative risks offering potential financial gain — fire is a pure risk with no upside, not speculative.
An accidental fire is a strategic risk, while arson is an operational risk — both are hazard-type events, not strategic or operational categories.
Neither has any bearing on continuity of supply — either can halt production and disrupt continuity.

📋 LO: 1.1.2 — Categories of risk
📑 Indicative content: 1.1.2 Categories of risk: financial, strategic, operational and hazard; pure vs speculative risk

✅ Correct Answer: A liquidated damages clause

📌 Explanation
A liquidated damages clause sets out an agreed, genuine pre-estimate of the loss payable for a defined breach such as late delivery, giving certainty and avoiding the need to prove actual loss. It allocates and contains that risk, provided the figure is a true estimate rather than a penalty.

❌ Why the other options are wrong:
A force majeure clause — excuses performance during extraordinary events, the opposite of fixing damages for delay.
A retention of title clause — keeps ownership with the seller until payment, unrelated to late-delivery compensation.
An assignment clause — governs transfer of contractual rights, not pre-agreed damages.

📋 LO: 2.1.2 — Indemnity and liability clauses
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management

✅ Correct Answer: Confirming each part meets the technical and safety standards of the destination market

📌 Explanation
Global sourcing exposes a buyer to differing technical, safety and regulatory standards across jurisdictions. Verifying conformity before shipment — through certification and pre-shipment checks — prevents goods being detained, rejected or barred, so it is the core control for this risk.

❌ Why the other options are wrong:
Selecting the supplier offering the longest payment terms — a commercial term that does not address safety approvals.
Choosing the supplier with the most modern website — cosmetic and irrelevant to compliance.
Picking whichever supplier is closest to head office — irrelevant for overseas sourcing compliance.

📋 LO: 2.1.5 — Global sourcing considerations and compliance to standards
📑 Indicative content: 2.1.5 Global sourcing considerations and compliance to standards

✅ Correct Answer: Failover to replicated systems hosted at a standby site; Recovery of data from off-site backups to an agreed recovery point

📌 Explanation
Third-party disaster recovery providers specialise in resuming IT after disruption: switching processing to replicated standby systems and restoring data from off-site backups to a defined recovery point. Both reduce downtime and support the wider business continuity plan.

❌ Why the other options are wrong:
Setting the organisation's overall risk appetite — an internal governance decision, not a recovery service.
Negotiating the organisation's customer sales contracts — a commercial activity unrelated to disaster recovery.

📋 LO: 2.2.3 — Third-party disaster recovery services
📑 Indicative content: 2.2.3 Use of third-party providers for disaster recovery services

✅ Correct Answer: An assignment (and novation) clause

📌 Explanation
An assignment clause governs whether and how a party may transfer its contractual rights (and, via novation, its obligations) to a third party, such as a group company after restructuring. Controlling assignment manages the risk of the contract ending up with an unsuitable counterparty.

❌ Why the other options are wrong:
A testing and inspection clause — gives rights to verify goods against specification, not to transfer the contract.
A force majeure clause — excuses performance during extraordinary events, unrelated to transfer.
An indemnity clause — promises to reimburse defined losses, not to govern assignment.

📋 LO: 2.1.1 — Purpose and use of model form contracts
📑 Indicative content: 2.1.1 Purpose and use of model form contracts in managing supply chain risk

✅ Correct Answer: Advancing cash against outstanding sales invoices; Taking over collection of the factored receivables

📌 Explanation
Invoice (debt) factoring eases cash-flow risk by advancing most of an invoice's value immediately and, typically, taking over collection of those receivables. It converts slow-paying invoices into working capital, addressing a financial supply chain risk.

❌ Why the other options are wrong:
Restoring IT systems after a cyber incident — that is a disaster-recovery service, not factoring.
Auditing a supplier's labour standards on site — that is third-party ESG auditing, a different specialist service.

📋 LO: 2.2.1 — Third-party providers for credit rating and debt factoring
📑 Indicative content: 2.2.1 Use of third-party providers for credit rating, debt factoring and related business services

✅ Correct Answer: No, because insurance only funds covered losses after the event; quality controls still reduce the chance and size of claims

📌 Explanation
Insurance is a risk-transfer mechanism that pays for covered losses after they occur; it does not stop the event or replace risk control. Maintaining quality assurance over advice reduces the likelihood and scale of claims, helps keep premiums affordable and protects reputation.

❌ Why the other options are wrong:
Yes, because holding cover removes any need to manage the underlying risk — reversed logic; insurers price on the risk presented, so control still matters.
Yes, because professional indemnity insurance prevents negligent advice occurring — insurance funds losses, it cannot prevent the act.
No, because professional indemnity insurance is not permitted for consultancies — correct verdict but invented reasoning; such cover is standard for consultancies.

📋 LO: 2.3.1 — Use of insurance in managing supply chain risk
📑 Indicative content: 2.3.1 Use of insurance in managing supply chain risk; 2.3.3 Categories of insurance

✅ Correct Answer: Each insurer pays a fair, proportionate share of the loss rather than the insured recovering twice

📌 Explanation
Contribution applies where more than one policy covers the same risk: the insurers share the loss proportionately so the insured is indemnified once, not twice. It works alongside indemnity to prevent the insured profiting from a loss.

❌ Why the other options are wrong:
The insured may claim the full amount from both insurers and keep the surplus — that would breach indemnity by allowing a profit.
The insurer recovers its payout from the party that caused the loss — that describes subrogation, not contribution.
The insured must disclose all material facts before cover begins — that describes utmost good faith.

📋 LO: 2.3.2 — Legal principles of insurance
📑 Indicative content: 2.3.2 Legal principles of insurance

✅ Correct Answer: To identify critical activities and how quickly their loss would harm the organisation, setting recovery priorities

📌 Explanation
A business impact analysis determines which activities are critical and how fast their disruption would cause harm, producing the recovery priorities and recovery time objectives that shape the continuity plan. It is the analytical foundation that makes a business continuity plan focused and realistic.

❌ Why the other options are wrong:
To negotiate the unit price of raw materials with suppliers — a sourcing activity, not continuity analysis.
To choose the organisation's advertising channels for the year — a marketing task unrelated to continuity.
To select the colours used in the organisation's branding — irrelevant to continuity planning.

📋 LO: 2.4.1 — Components of a business continuity plan and disaster recovery plan
📑 Indicative content: 2.4.1 Components of a business continuity plan and disaster recovery plan; 2.4.2 Definitions and purpose

✅ Correct Answer: It visually groups risks by combined severity so attention goes to the highest-rated first

📌 Explanation
A colour-banded matrix translates each risk's likelihood and impact scores into bands, making it easy to see which risks fall in the high-severity zone and should be treated first. The visual grouping supports consistent, proportionate prioritisation under a probability and impact methodology.

❌ Why the other options are wrong:
It fixes the exact insurance premium for each risk — that is underwriting, not matrix banding.
It removes the need to estimate likelihood or impact — the bands are built from those very estimates.
It ranks risks by the order they were entered on the register — entry order has no link to severity.

📋 LO: 3.1.1 — Methodologies for assessing probability and impact
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk

✅ Correct Answer: Risk W, with a score of 16

📌 Explanation
A two-factor risk score is likelihood × impact. Risk W = 4 × 4 = 16; Risk X = 5 × 2 = 10; Risk Y = 2 × 5 = 10; Risk Z = 3 × 3 = 9. Risk W scores highest at 16, so it is prioritised — showing how multiplying the two factors ranks risks on a single scale.

❌ Why the other options are wrong:
Risk X, with a score of 10 — the score is correct but 10 is lower than Risk W's 16.
Risk Y, with a score of 10 — correctly scored but tied at 10, below Risk W.
Risk Z, with a score of 9 — correctly scored but the lowest of the four.
Risk W, with a score of 8 — adds the two factors (4 + 4) instead of multiplying them.

📋 LO: 3.1.1 — Methodologies for assessing probability and impact
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk

✅ Correct Answer: It shows not only how likely and severe a threat is, but how easily specific assets could be harmed by it

📌 Explanation
Probability and impact assessment rates how likely and how serious a threat is, while a vulnerability assessment adds susceptibility — how exposed and easily harmed particular assets or processes are. Together they give a fuller picture, so mitigation targets the most fragile points.

❌ Why the other options are wrong:
It guarantees the threat will not materialise once assessed — an absolute claim; assessment informs management, not certainty.
It sets the premium an insurer will charge for the threat — that is underwriting, not assessment.
It replaces the need to assign an owner to the risk — ownership remains essential; assessment supports it.

📋 LO: 3.1.2 — Vulnerability assessments
📑 Indicative content: 3.1.2 Vulnerability assessments

✅ Correct Answer: Treating reported near-misses as learning rather than grounds for blame; Senior leaders consistently modelling the risk behaviours they expect

📌 Explanation
Organisational culture shapes whether people surface or conceal risk. A just, learning culture that treats near-misses as lessons, combined with leaders who visibly model risk-aware behaviour, encourages early honest reporting so risks are managed rather than hidden — the cultural foundation of effective risk management.

❌ Why the other options are wrong:
Rewarding staff who hide problems to protect the team's reputation — reversed logic; concealment worsens exposure.
Confining all risk awareness to a single specialist post — risk culture must be organisation-wide, not isolated.

📋 LO: 3.3.2 — Role of organisation culture in managing risk
📑 Indicative content: 3.3.2 Role of organisation culture in management of supply chain risk

✅ Correct Answer: Linking each entry to an action with a named owner and review date

📌 Explanation
A register only reduces risk when its entries drive action: tying each risk to a defined mitigating action, a named owner and a review date creates accountability and lets progress be tracked. This is how reporting and action plans turn documented risk into delivered mitigation.

❌ Why the other options are wrong:
Sorting entries by the length of their description — description length has no link to action or priority.
Recording entries but circulating them to no one — uncirculated entries cannot prompt action.
Listing every entry without any assessment of severity — without severity, effort cannot be prioritised.

📋 LO: 3.2.3 — Reporting and action plans in risk management
📑 Indicative content: 3.2.3 Importance of reporting and action plans in risk management

✅ Correct Answer: Delaying reports until a risk has already caused a loss

📌 Explanation
Good reporting is timely and forward-looking: it tailors detail to the audience, highlights changes in status and flags risks that have breached escalation thresholds so decision-makers can act early. Reporting only after a loss defeats the purpose of visibility, so it is the exception.

❌ Why the other options are wrong:
Tailoring the level of detail to each audience — a genuine feature that keeps reports useful and read.
Highlighting changes in risk status since the last report — shows where exposure is moving, a real benefit.
Flagging risks that have breached their escalation threshold — routes serious risks quickly to decision-makers.

📋 LO: 3.3.5 — Supply chain risk visibility and reporting
📑 Indicative content: 3.3.5 Supply chain risk visibility and reporting to stakeholders

✅ Correct Answer: Skilled people with time, reliable data and systems, and leadership commitment with budget

📌 Explanation
Delivering a risk management plan depends on real resources: competent people with the time to act, dependable data and tools, and visible senior commitment backed by adequate budget. Together these turn a plan on paper into sustained, effective risk management.

❌ Why the other options are wrong:
A promise from the board that no risk will ever occur, plus a one-off email — no board can guarantee zero risk, and a single email does not sustain a programme.
A single locked spreadsheet and a ban on escalating risks upward — banning escalation destroys the visibility risk management needs.
Outsourcing every risk decision and deleting the risk register — core decisions and the register must be retained, not removed.

📋 LO: 3.3.4 — Resource requirements for risk management
📑 Indicative content: 3.3.4 Resource requirements for effective supply chain risk management