L5M2 Paper 12

✅ Correct Answer: A downside outcome such as loss, disruption or harm if the risk materialises

📌 Explanation
Risk is two-sided: its negative consequences are the downside effects — financial loss, disruption or harm — that follow if the risk occurs, while positive consequences are the opportunities risk can create. Recognising both sides underpins a balanced approach to supply chain risk.

❌ Why the other options are wrong:
The premium an insurer charges to cover the risk — that is an underwriting cost, not the consequence of the risk itself.
The number of suppliers listed on the approved-supplier register — a count of suppliers, unrelated to a risk's downside.
The seniority of the manager who first reported the risk — irrelevant to the nature of the consequence.

📋 LO: 1.1.5 — Positive and negative consequences of risk
📑 Indicative content: 1.1.5 Positive and negative consequences of risk

✅ Correct Answer: 1, 2, 3 and 5 only

📌 Explanation
Statements 1 (contract failure), 2 (quality failure), 3 (technology) and 5 (logistics complexity) each correctly name a recognised operational risk. Statement 4 is wrong: an adverse exchange-rate movement is a currency (financial) risk, not a quality failure.

❌ Why the other options are wrong:
1, 3 and 4 only — includes the false statement 4 and omits valid statements 2 and 5.
2, 4 and 5 only — relies on the false statement 4 and drops correct statements 1 and 3.
1, 2 and 4 only — again includes false statement 4 and omits correct statements 3 and 5.

📋 LO: 1.2.1 — Contract failure
📑 Indicative content: 1.2.1 Contract failure; 1.2.3 Quality failure; 1.2.5 Technology; 1.2.6 Logistics complexity

✅ Correct Answer: A supplier discharging untreated effluent into a local river

📌 Explanation
The social (S) pillar of ESG covers people-related issues such as labour conditions, working hours, health and safety and human rights. Discharging effluent is environmental (E) harm, so it is the exception among these social risks.

❌ Why the other options are wrong:
Excessive working hours imposed on a supplier's staff — a labour/working-conditions issue, a clear social risk.
Unsafe working conditions at a lower-tier factory — a health-and-safety issue within the social pillar.
Use of child labour at a raw-material source — a human-rights breach, a core social ESG risk.

📋 LO: 1.1.3 — ESG risks impacting supply chains
📑 Indicative content: 1.1.3 ESG (Environmental, Social, and Governance) risks impacting supply chains

✅ Correct Answer: The cost of urgently renting alternative storage space; Contractual penalties payable for missing agreed delivery dates

📌 Explanation
Direct losses are immediate, measurable costs flowing straight from an event. Emergency storage rental and contractual penalties both arise directly and quantifiably from the closure, so both are direct losses, in contrast to delayed consequential effects.

❌ Why the other options are wrong:
A gradual loss of customer trust over the following year — a delayed, consequential effect, so an indirect loss.
A long-term rise in the cost of borrowing afterwards — a knock-on financial effect over time, so indirect.

📋 LO: 1.1.6 — Direct and indirect losses
📑 Indicative content: 1.1.6 Direct and indirect losses

✅ Correct Answer: Exposure to differing legal jurisdictions and country/political instability

📌 Explanation
Offshoring locates an activity in another country, layering jurisdictional and country/political risk on top of the loss-of-control risks shared by all outsourcing. Differing laws, enforcement and political stability create exposures that purely domestic outsourcing does not.

❌ Why the other options are wrong:
Loss of the ability to set internal performance targets — buyers still set KPIs; offshoring does not remove this.
Removal of any need to manage the provider relationship — reversed logic; offshoring increases the management burden.
An automatic improvement in service quality in every case — an absolute claim; offshoring adds risk rather than guaranteeing gains.

📋 LO: 1.2.7 — Risks in outsourcing and offshoring
📑 Indicative content: 1.2.7 Risks in outsourcing and offshoring

✅ Correct Answer: No, because the Code requires him to declare the conflict of interest and step back from the decision

📌 Explanation
The CIPS Code of Conduct requires members to declare actual or perceived conflicts of interest and to avoid influencing decisions in which they have a personal stake. Declaring the shareholding and recusing himself protects the integrity of the tender and helps eliminate corruption risk.

❌ Why the other options are wrong:
Yes, because owning shares never creates a conflict of interest — an absolute claim; a financial stake in a bidder is a textbook conflict.
Yes, because the Code only applies to gifts, not to shareholdings — the Code covers all conflicts of interest, including financial interests.
No, because the Code bans any member from ever owning shares — correct verdict but invented reasoning; the Code requires declaration, not a ban on share ownership.

📋 LO: 1.3.4 — Ethical codes including the CIPS Code of Conduct
📑 Indicative content: 1.3.4 The use of ethical codes including the CIPS Code of Conduct to support the elimination of risk

✅ Correct Answer: It raises environmental (E) exposure that the organisation must assess and report within its ESG profile

📌 Explanation
Climate-driven flooding is an environmental supply chain risk that flows through to the buyer's environmental (E) pillar, affecting continuity and the resilience disclosures stakeholders expect. Buyers are increasingly judged on environmental exposure across their chain, so it must be assessed and reported.

❌ Why the other options are wrong:
It improves the organisation's social score by creating new jobs — flooding is environmental harm, not a social benefit.
It is solely the supplier's concern and never reaches the buyer's ESG standing — buyers carry ESG responsibility across the supply chain.
It reclassifies the issue as a purely contractual liability matter — the risk is environmental, not merely a question of contract liability.

📋 LO: 1.4.2 — How environmental supply chain risks impact ESG
📑 Indicative content: 1.4.2 How environmental supply chain risks impact organisational ESG considerations

✅ Correct Answer: Publishing clear, objective award criteria before a tender opens

📌 Explanation
Publishing transparent award criteria is a good-practice control that reduces corruption, not a form of it. Kickbacks, market-sharing collusion and facilitation payments are all recognised corrupt practices that distort fair competition and breach ethical codes such as the CIPS Code of Conduct.

❌ Why the other options are wrong:
Offering a kickback to a buyer to secure a contract award — a clear form of bribery and corruption.
Colluding with competitors to carve up a market — anti-competitive collusion, a recognised corrupt practice.
Making a facilitation payment to expedite an official process — a recognised form of corruption, illegal under many regimes.

📋 LO: 1.3.1 — Types of corruption
📑 Indicative content: 1.3.1 Types of corruption

✅ Correct Answer: Cash-flow risk

📌 Explanation
Cash-flow risk arises when the timing of outgoings and incomings leaves an organisation short of working capital, even when it is profitable on paper. It is one of the financial risks and is managed through payment-term negotiation, forecasting and facilities such as debt factoring.

❌ Why the other options are wrong:
Currency risk — arises from exchange-rate movement, not the timing of domestic cash flows.
Quality failure risk — concerns defective goods, not working capital.
Logistics complexity risk — relates to intricate distribution networks, not cash timing.

📋 LO: 1.2.2 — Financial risks: currency, cash flow and insolvency
📑 Indicative content: 1.2.2 Financial risks: currency, cash flow and insolvency

✅ Correct Answer: Local sustainability standards set within that jurisdiction

📌 Explanation
Alongside international frameworks such as ISO standards, UN and ILO instruments, sustainable procurement must also reflect local sustainability standards — the national or regional rules that apply where the organisation operates. Meeting these keeps sourcing compliant and credible in that market.

❌ Why the other options are wrong:
Incoterms 2020 trade terms — define delivery and risk transfer in trade, not sustainability rules.
ISO 9001 quality management systems — addresses quality management, not sustainable procurement.
The Kraljic portfolio matrix — a sourcing-positioning tool, not a sustainability standard.

📋 LO: 1.4.5 — Standards for sustainable procurement
📑 Indicative content: 1.4.5 Standards for sustainable procurement: ISO standards, United Nations (UN) and International Labour Organization (ILO), and local sustainability standards

✅ Correct Answer: It supplies tested, balanced clauses that allocate risk in a recognised way and speed up contracting

📌 Explanation
Model form contracts such as NEC, FIDIC and JCT offer standardised, widely understood clauses refined over time. They reduce drafting errors, speed up negotiation and allocate risk in a balanced, recognised way, lowering contractual risk for organisations new to a sector.

❌ Why the other options are wrong:
It removes the obligation on either party to perform the contract — a contract still binds both parties to perform.
It shifts every liability for loss onto the supplier automatically — model forms aim for balanced, not one-sided, allocation.
It ensures that no dispute can ever arise between the parties — an absolute claim; model forms reduce but cannot remove disputes.

📋 LO: 2.1.1 — Purpose and use of model form contracts
📑 Indicative content: 2.1.1 Purpose and use of model form contracts in managing supply chain risk

✅ Correct Answer: Subrogation following settlement of the claim

📌 Explanation
Within insurance claims handling, subrogation is the insurer's right, after paying the insured, to step into the insured's shoes and recover the loss from the party responsible. It prevents the insured profiting twice and is part of how insurance operates as a supply chain risk-transfer mechanism.

❌ Why the other options are wrong:
Underwriting of the original risk — underwriting assesses and prices the risk before cover, not recovery after a payout.
Debt factoring of the receivable — debt factoring sells trade invoices for cash, unrelated to insurance recovery.
Vulnerability assessment of the loss — a forward-looking susceptibility study, not a post-claim recovery.

📋 LO: 2.3.4 — Insurance claims, underwriting and risk management
📑 Indicative content: 2.3.4 Insurance claims, underwriting, and supply chain risk management

✅ Correct Answer: Objective verification that suppliers meet labour and environmental standards; Visibility of risks at lower tiers the buyer cannot easily reach

📌 Explanation
Independent ESG audits bring impartial expertise and access to sub-tier suppliers, verifying that claimed labour and environmental standards are genuinely met and surfacing risks deep in the chain. This gives more credible assurance than supplier self-declaration.

❌ Why the other options are wrong:
A transfer of the buyer's legal accountability to the auditor — the buyer retains accountability; auditing does not transfer legal liability.
A guarantee that no ESG breach will ever occur again — an absolute claim; audits identify risk, they do not prevent all breaches.

📋 LO: 2.2.2 — Third-party auditing of risks including ESG
📑 Indicative content: 2.2.2 Use of third-party providers for auditing risks including ESG risks in supply chains

✅ Correct Answer: Procedures for restoring IT systems and data from backups after an outage

📌 Explanation
A disaster recovery plan is the narrower discipline focused on restoring IT systems, data and supporting technology after disruption. The wider business continuity plan identifies critical activities, keeps functions running and coordinates communication; DR supports it.

❌ Why the other options are wrong:
A prioritised list of the organisation's critical business activities — a core BCP component, not specific to DR.
Arrangements to keep customer-facing functions running during disruption — a continuity (BCP) aim, broader than DR.
An overall communication plan for all stakeholders during an incident — sits within the wider BCP, not solely DR.

📋 LO: 2.4.1 — Components of a business continuity plan and disaster recovery plan
📑 Indicative content: 2.4.1 Components of a business continuity plan and disaster recovery plan; 2.4.2 Definitions and purpose

✅ Correct Answer: An indemnity clause covering specified losses and third-party claims; A limitation of liability clause capping the supplier's exposure

📌 Explanation
Indemnity and limitation of liability clauses both allocate the financial consequences of default. An indemnity promises to reimburse defined losses and third-party claims, while a liability cap contains how much a party can be required to pay, together shaping how risk is shared.

❌ Why the other options are wrong:
A retention of title clause keeping ownership with the seller until payment — protects the seller's ownership, not the buyer against third-party claims.
A confidentiality clause protecting commercially sensitive information — guards information, not financial liability.

📋 LO: 2.1.2 — Indemnity and liability clauses
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management

✅ Correct Answer: Yes, because live simulations are a recognised method that tests how the plan performs under realistic pressure

📌 Explanation
Testing can range from desktop walkthroughs to full live simulations, and using more than one method strengthens assurance. A realistic live exercise reveals how people and systems actually respond, exposing gaps that a paper review might miss, as part of regular review.

❌ Why the other options are wrong:
No, because contingency plans should only ever be reviewed on paper — an absolute claim; live and scenario testing are valid methods.
No, because once a plan is signed off it needs no further testing — plans must be tested and reviewed regularly to stay effective.
Yes, because a single live test forever removes the need to review the plan again — correct verdict but wrong reasoning; review must be ongoing as risks change.

📋 LO: 2.4.3 — Reviewing and testing contingency plans
📑 Indicative content: 2.4.3 Importance of reviewing and testing contingency plans

✅ Correct Answer: Professional indemnity insurance

📌 Explanation
Professional indemnity insurance covers claims arising from negligent advice, design or professional services that cause a client financial loss. It is distinct from public liability, employers' liability and trade credit cover, each of which responds to a different exposure.

❌ Why the other options are wrong:
Public liability insurance — covers injury or damage to third parties such as the public, not negligent advice.
Employers' liability insurance — covers claims by the organisation's own employees.
Trade credit insurance — covers customers failing to pay, not professional negligence.

📋 LO: 2.3.3 — Categories of insurance
📑 Indicative content: 2.3.3 Categories of insurance: employers and public liability, professional indemnity, product liability and trade credit

✅ Correct Answer: Debt factoring

📌 Explanation
Debt factoring sells outstanding invoices to a third party for immediate cash, less a fee, easing cash-flow strain caused by slow-paying customers. It converts receivables into working capital quickly, addressing a financial supply chain risk.

❌ Why the other options are wrong:
A credit rating agency — assesses creditworthiness; it does not provide cash.
A disaster recovery provider — restores systems after disruption, unrelated to cash flow.
An ESG auditing firm — verifies supplier standards, not invoice financing.

📋 LO: 2.2.1 — Third-party providers for credit rating and debt factoring
📑 Indicative content: 2.2.1 Use of third-party providers for credit rating, debt factoring, and related business services in managing supply chain risk

✅ Correct Answer: A high-priority risk that is both likely and severe, warranting urgent treatment

📌 Explanation
The matrix scores each risk on likelihood and impact; the top-right quadrant holds risks that are both highly likely and highly severe. These are the priority risks for prompt treatment, directing limited resources to the greatest exposure.

❌ Why the other options are wrong:
A risk that can be removed from the register without action — high-high risks need action and continued visibility, not removal.
A risk that is cheap to insure and needs no monitoring — quadrant position reflects severity, not insurance cost, and monitoring remains essential.
A risk whose description happens to be the longest — description length is irrelevant to matrix position.

📋 LO: 3.1.1 — Methodologies for assessing probability and impact
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk

✅ Correct Answer: 0.271

📌 Explanation
For independent years, the probability of at least one occurrence over n years is 1 minus the probability it never occurs: 1 − (1 − p)^n. Here 1 − (1 − 0.1)^3 = 1 − 0.9^3 = 1 − 0.729 = 0.271. This cumulative rule shows how a small annual risk builds over time.

❌ Why the other options are wrong:
0.300 — simply multiplies 0.1 by 3, which ignores that probabilities cannot be added this way.
0.100 — the single-year probability, ignoring the three-year horizon.
0.729 — the probability it never occurs (0.9^3), the complement of the answer.
0.001 — the probability it occurs in all three years (0.1^3), not at least once.

📋 LO: 3.1.4 — Probability theory and statistical methods
📑 Indicative content: 3.1.4 Use of probability theory and statistical distribution methods to determine the likelihood of risk

✅ Correct Answer: The assessed likelihood, impact and a named owner for the risk

📌 Explanation
A risk register template should capture, for each risk, its assessed likelihood and impact, mitigating actions and a named owner accountable for managing it. These fields make risks comparable, prioritised and actively tracked across the organisation.

❌ Why the other options are wrong:
The favourite colour of the buyer who logged the risk — irrelevant data with no bearing on risk management.
The date of the supplier's next staff social event — irrelevant to assessing or tracking risk.
A promise that the risk will never materialise — an absolute claim; registers manage uncertainty, not guarantees.

📋 LO: 3.2.1 — Templates for risk assessments and registers
📑 Indicative content: 3.2.1 Creation and use of templates for risk assessments and risk registers

✅ Correct Answer: Using a regularly updated dashboard with red-amber-green status indicators; Defining escalation thresholds so serious risks reach senior decision-makers quickly

📌 Explanation
Visibility improves when current, easy-to-read reporting such as a RAG dashboard is shared and when clear escalation thresholds route significant risks rapidly to those who can act. Together these turn risk data into timely, accountable decisions across stakeholders.

❌ Why the other options are wrong:
Keeping risk information accessible to only one nominated person — isolates knowledge and destroys visibility.
Reporting risks once a decade with no interim updates — far too infrequent to support timely action.

📋 LO: 3.3.5 — Supply chain risk visibility and reporting
📑 Indicative content: 3.3.5 Supply chain risk visibility and reporting to stakeholders

✅ Correct Answer: To build an objective, data-based foundation for estimating likelihood rather than relying on opinion

📌 Explanation
Collating statistical evidence — delivery records, incident logs and loss histories — gives an objective basis for estimating how likely and how severe risks are. A larger, time-series dataset reduces reliance on guesswork and supports defensible, consistent assessment.

❌ Why the other options are wrong:
To set the selling price of the organisation's finished products — a commercial pricing matter unrelated to risk evidence.
To remove the need ever to assign a risk owner — ownership remains essential; evidence supports rather than replaces it.
To prove that the chosen supplier can never fail to deliver — an absolute claim; evidence informs estimates, it cannot prove certainty.

📋 LO: 3.1.3 — Collating statistical evidence of risks
📑 Indicative content: 3.1.3 Collating statistical evidence of risks

✅ Correct Answer: Tabulate the risk

📌 Explanation
The 4Ts are Tolerate, Treat, Transfer and Terminate. 'Tabulate' is not a recognised risk response — it is a made-up term, whereas the other three are genuine 4Ts options.

❌ Why the other options are wrong:
Tolerate the risk — Tolerate (accept) is one of the 4Ts, used for low, proportionate risks.
Transfer the risk — Transfer, e.g. via insurance, is one of the 4Ts.
Terminate the activity — Terminate (stop the activity) is one of the 4Ts.

📋 LO: 3.3.3
📑 Indicative content: 3.3.3 Risk management process and the development of risk management plans

✅ Correct Answer: Earlier detection of emerging risks so action can be taken sooner

📌 Explanation
Improved visibility means risks deeper in the chain are seen sooner, so the organisation can act before they escalate. Earlier detection and faster response — not a guarantee of zero disruption — is the core benefit.

❌ Why the other options are wrong:
A guarantee that no disruption will ever occur — Visibility supports earlier action; it cannot guarantee zero disruption.
Less need to keep any risk records — Better visibility relies on more, not fewer, risk records.
Higher staff car-parking charges — Parking charges are unrelated to supply chain risk visibility.

📋 LO: 3.3.5
📑 Indicative content: 3.3.5 Supply chain risk visibility and reporting to stakeholders