L5M2 Paper 14

✅ Correct Answer: How much and what type of risk it is prepared to bear to pursue its goals

📌 Explanation
Risk appetite is the amount and kind of risk an organisation is willing to take on to achieve its objectives, set by senior management as part of the risk strategy. It frames consistent choices on whether to accept, treat, transfer or avoid a given supply chain risk.

❌ Why the other options are wrong:
The precise financial value of a loss once an event has occurred — that is the realised impact or loss, not a forward-looking tolerance.
The number of mitigation actions recorded on the register — a count of actions, not a statement of tolerance.
Which insurer will offer the lowest premium for cover — a procurement-of-insurance question, unrelated to appetite.

📋 LO: 1.1.1 — Definition of risks, hazards, exposure and risk appetite
📑 Indicative content: 1.1.1 Definitions of risk, hazard, exposure and risk appetite

✅ Correct Answer: 1, 2, 3 and 5 only

📌 Explanation
The ESG framework splits risks into environmental, social and governance pillars. Statements 1 (E), 2 (S), 3 (G) and 5 (G) are correctly placed. Statement 4 is wrong: carbon emissions are an environmental (E) harm, not a governance matter, so it is the false statement in the list.

❌ Why the other options are wrong:
1, 3 and 4 only — includes the false statement 4 and omits valid statements 2 and 5.
2, 4 and 5 only — relies on the false statement 4 and drops correct statements 1 and 3.
1, 2 and 4 only — again includes the false statement 4 and omits correct statements 3 and 5.

📋 LO: 1.1.3 — ESG risks impacting supply chains
📑 Indicative content: 1.1.3 ESG (Environmental, Social, and Governance) risks impacting supply chains

✅ Correct Answer: An automatic reduction in the buyer's own cost of borrowing

📌 Explanation
Supplier insolvency is a financial risk that disrupts supply, can forfeit prepayments and forces costly emergency re-sourcing. It would not reduce the buyer's borrowing cost — if anything, the disruption raises financial pressure, so this is the exception.

❌ Why the other options are wrong:
Sudden interruption to the supply of contracted goods — a direct continuity consequence when a supplier ceases trading.
Loss of any prepayments or deposits already made — funds paid in advance may rank as unsecured and be lost.
Urgent cost of finding and qualifying a replacement source — a real, immediate cost of replacing the failed supplier.

📋 LO: 1.2.2 — Financial risks: currency, cash flow and insolvency
📑 Indicative content: 1.2.2 Financial risks: currency, cash flow and insolvency

✅ Correct Answer: Over-dependence on one ageing extraction site it owns; Gaps in its own staff's contract-management skills

📌 Explanation
Internal sources of risk stem from the organisation's own assets, people and processes — surfaced as weaknesses in a SWOT analysis. Reliance on a single owned site and skills gaps in its own team are both internal and controllable, unlike macro-environmental forces scanned via STEEPLED.

❌ Why the other options are wrong:
A new export levy imposed by a host government — a political/legal external factor outside the firm's control.
Falling world commodity prices set by global markets — an economic external factor, not an internal source.

📋 LO: 1.1.4 — Tools for assessing internal and external sources of risk
📑 Indicative content: 1.1.4 Tools for assessing internal and external sources of risk

✅ Correct Answer: Poor ventilation and dust exposure for workers on the production line

📌 Explanation
ESG operational risks are environmental, social and governance exposures generated by running operations day to day. Unhealthy working conditions such as dust exposure are a social (worker-welfare) operational risk arising directly from how the site is run, and can disrupt supply and reputation.

❌ Why the other options are wrong:
A sudden adverse swing in the currency used to buy inputs — a financial (currency) risk, not an ESG operational one.
A competitor securing exclusive rights to a key technology — a strategic/competitive risk, not ESG operations.
A bank shortening the organisation's overdraft facility — a financing/cash-flow risk, not an ESG operational issue.

📋 LO: 1.2.8 — ESG risks impacting supply chains
📑 Indicative content: 1.2.8 ESG (Environmental, Social, and Governance) risks impacting supply chains

✅ Correct Answer: No, because approved suppliers can still ship defective batches, so verification controls remain necessary

📌 Explanation
Approval reduces but does not remove quality-failure risk: process drift, materials variation or human error can produce non-conforming batches even from trusted suppliers. Inspection, testing and acceptance controls stay essential to catch defects before they disrupt production.

❌ Why the other options are wrong:
Yes, because approval status removes the possibility of any defect — an absolute claim; approval lowers, not eliminates, defect risk.
Yes, because quality risk only ever arises with new, unapproved suppliers — established suppliers can also fail on quality.
No, because incoming inspection is required by sustainable procurement law — correct verdict but invented reasoning; inspection is good practice, not a sustainability-law mandate.

📋 LO: 1.2.3 — Quality failure
📑 Indicative content: 1.2.3 Quality failure as an operational risk in supply chains

✅ Correct Answer: It clarifies the environmental, social and governance criteria that will shape sourcing decisions

📌 Explanation
Defining ESG considerations means setting out the environmental, social and governance factors the organisation will weigh when choosing and managing suppliers, in line with guidance such as ISO 20400. It gives sustainable procurement a clear, consistent basis rather than leaving sustainability to ad hoc judgement.

❌ Why the other options are wrong:
It fixes the unit prices the organisation will pay for each item — pricing is a commercial matter, not the purpose of defining ESG considerations.
It records the penalties payable if a supplier delivers late — that is a contractual remedy, unrelated to ESG criteria.
It lists the insurers the organisation intends to use — an insurance-arrangement matter, not an ESG definition.

📋 LO: 1.4.1 — Defining ESG considerations in sustainable procurement
📑 Indicative content: 1.4.1 Defining ESG (Environmental, Social, and Governance) considerations in the context of sustainable procurement and supply

✅ Correct Answer: Stronger value for money achieved across the supplier base

📌 Explanation
Corruption distorts competition, exposes the organisation to legal sanction and damages reputation — never improving value for money. Bribery and collusion inflate prices and undermine fair selection, so improved value is the opposite of what corruption produces and is the exception here.

❌ Why the other options are wrong:
Distortion of fair competition between bidders — a core harm of corruption that rigs the market.
Exposure to fines and prosecution under anti-bribery law — a genuine legal consequence of corrupt acts.
Lasting damage to the organisation's reputation and trust — a recognised reputational consequence of corruption.

📋 LO: 1.3.1 — Types of corruption
📑 Indicative content: 1.3.1 Types of corruption; 1.3.3 Governance of fraud and corruption in supply chains

✅ Correct Answer: It weakens the social (S) pillar of its ESG profile and the disclosures stakeholders expect

📌 Explanation
Bonded labour is a human-rights breach within the social (S) pillar of ESG. Because buyers are judged on conditions across their chain, such a finding flows through to the organisation's social performance and the disclosures investors and regulators expect, harming reputation and standing.

❌ Why the other options are wrong:
It strengthens its governance score by adding a supplier policy — a labour abuse is a social harm, not a governance improvement.
It is confined to the supplier and never reaches the buyer's ESG standing — ESG responsibility extends across the supply chain, including sub-tiers.
It converts the matter into a purely environmental reporting issue — labour exploitation is a social, not environmental, risk.

📋 LO: 1.4.3 — How social supply chain risks impact ESG
📑 Indicative content: 1.4.3 How social supply chain risks impact organisational ESG considerations

✅ Correct Answer: Security of supply, because failure of either utility would halt production

📌 Explanation
Reliance on a single grid and one water source creates critical dependencies: losing either utility would stop the plant. This is a security-of-supply (continuity) risk, mitigated through backup power, alternative water supply, buffer arrangements and contingency planning.

❌ Why the other options are wrong:
Currency risk on the plant's input purchases — concerns exchange-rate movement, not utility continuity.
Professional indemnity risk for negligent advice — relates to faulty professional services, not utility dependence.
Insurable interest under the plant's policy — an insurance principle, not the continuity risk described.

📋 LO: 1.2.4 — Security of supply
📑 Indicative content: 1.2.4 Security of supply as an operational risk in supply chains

✅ Correct Answer: To keep ownership of the goods with the seller until the buyer has paid in full

📌 Explanation
A retention of title (Romalpa) clause lets the seller keep legal ownership of goods until payment is received, protecting it against the buyer's insolvency. It allocates financial risk by giving the seller a route to reclaim unpaid goods rather than ranking as an unsecured creditor.

❌ Why the other options are wrong:
To excuse the supplier from performance during extraordinary events — that describes a force majeure clause.
To cap the maximum damages the supplier can be required to pay — that is a limitation of liability clause.
To require the buyer to inspect goods before despatch — that is a testing and inspection clause.

📋 LO: 1.2.2 — Financial risks: currency, cash flow and insolvency
📑 Indicative content: 1.2.2 Financial risks: currency, cash flow and insolvency

✅ Correct Answer: Ensuring the goods comply with the standards and regulations of the destination market

📌 Explanation
Global sourcing exposes a buyer to differing technical, safety and legal standards between jurisdictions. Building compliance with the destination market's standards into the contract protects against rejected goods, customs delays and legal breaches, making it a core global-sourcing control.

❌ Why the other options are wrong:
Choosing the supplier offering the most generous corporate hospitality — irrelevant to compliance and a potential corruption risk.
Selecting whichever supplier has the longest trading history online — history does not guarantee standards compliance.
Picking the supplier whose head office is geographically closest — proximity does not address differing technical standards.

📋 LO: 2.1.5 — Global sourcing considerations and compliance to standards
📑 Indicative content: 2.1.5 Global sourcing considerations and compliance to standards

✅ Correct Answer: On-site verification that suppliers meet labour and environmental standards; Checking the validity of suppliers' claimed certifications

📌 Explanation
Third-party ESG auditors independently verify that suppliers genuinely meet labour and environmental standards and that claimed certifications and controls are real and operating. Both give credible assurance deeper in the chain than supplier self-declaration alone.

❌ Why the other options are wrong:
Releasing immediate cash against the organisation's unpaid invoices — that is debt factoring, a financial service, not ESG auditing.
Restoring the organisation's IT systems after an outage — that is a disaster recovery service, not an ESG audit.

📋 LO: 2.2.2 — Third-party auditing of risks including ESG
📑 Indicative content: 2.2.2 Use of third-party providers for auditing risks including ESG risks in supply chains

✅ Correct Answer: Ongoing credit monitoring from a credit reference agency

📌 Explanation
Credit reference agencies offer continuous monitoring that flags deterioration in a supplier's credit score or financial filings during the contract, giving early warning of insolvency risk on a long agreement. This is a third-party business service used to manage financial risk beyond the initial assessment.

❌ Why the other options are wrong:
A one-off debt factoring transaction — Factoring releases cash from invoices; it does not monitor a supplier's credit health.
A disaster recovery retainer — Disaster recovery restores operations after an incident, not financial monitoring.
An employers' liability policy — That insures staff-injury claims, unrelated to supplier creditworthiness.

📋 LO: 2.2.1
📑 Indicative content: 2.2.1 Use of third-party providers for credit rating, debt factoring and related business services in managing supply chain risk

✅ Correct Answer: A recovery time objective for each critical system; A recovery point objective defining acceptable data loss

📌 Explanation
A DR plan sets measurable targets: a recovery time objective (how quickly a system must be restored) and a recovery point objective (how much data loss is tolerable). These drive backup frequency and recovery design, making recovery testable and accountable.

❌ Why the other options are wrong:
A schedule of the marketing team's campaign deadlines — irrelevant to IT recovery planning.
A pledge that the systems will never suffer an outage — an absolute claim; a DR plan manages outages, it cannot prevent them.

📋 LO: 2.4.1 — Components of a business continuity plan and disaster recovery plan
📑 Indicative content: 2.4.1 Components of a business continuity plan and disaster recovery plan

✅ Correct Answer: No, because contingency plans need periodic re-testing to stay valid as people, systems and risks change

📌 Explanation
A single successful test does not keep a plan effective indefinitely. Staff, systems, suppliers and the risk profile all change, so periodic re-testing and review are needed to surface new gaps, refresh contacts and confirm the plan still works in current conditions.

❌ Why the other options are wrong:
Yes, because a plan that passed one test will always work in future — an absolute claim; conditions change after a single test.
Yes, because re-testing a plan only introduces unnecessary cost — re-testing reduces risk by exposing weaknesses before they matter.
No, because contingency plans must legally be re-tested every week — correct verdict but invented requirement; review is periodic and risk-based, not a weekly legal duty.

📋 LO: 2.4.3 — Reviewing and testing contingency plans
📑 Indicative content: 2.4.3 Importance of reviewing and testing contingency plans

✅ Correct Answer: A liquidated damages clause

📌 Explanation
A liquidated damages clause sets a pre-agreed, genuine pre-estimate of the loss payable for a defined breach such as late delivery, giving certainty and avoiding disputes over proving actual loss. It must be a true estimate, not a penalty, to be enforceable.

❌ Why the other options are wrong:
A force majeure clause — excuses or suspends performance for extraordinary events, the opposite of fixing compensation.
A confidentiality clause — protects sensitive information, not late-delivery compensation.
An assignment clause — governs transfer of contractual rights, unrelated to damages for delay.

📋 LO: 2.1.2 — Indemnity and liability clauses
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management

✅ Correct Answer: To give the buyer defined rights to check goods against specification at agreed points

📌 Explanation
Testing and inspection clauses entitle the buyer to verify that goods or works conform to specification at agreed stages, such as before despatch or on delivery. By catching non-conformance early they directly manage quality-failure risk and support any rejection rights.

❌ Why the other options are wrong:
To transfer ownership of the goods to the buyer at order stage — that concerns title or retention of title, not inspection.
To set the exchange rate used for any cross-border payment — that is a payment or currency term.
To excuse the supplier from delivering during extraordinary events — that describes force majeure.

📋 LO: 2.1.3 — Clauses for testing, inspection and acceptance
📑 Indicative content: 2.1.3 Purpose and use of clauses for testing, inspection, and acceptance

✅ Correct Answer: It shows how often different outcomes have occurred, giving a basis to estimate probability

📌 Explanation
A frequency distribution summarises how often each outcome has happened across past data, letting an analyst estimate the probability of a recurring risk from relative frequencies. Using distribution methods makes likelihood assessment more objective and defensible than judgement alone.

❌ Why the other options are wrong:
It guarantees the exact date the next disruption will happen — distributions express probability, not certainty about timing.
It removes the need to record any future incidents — ongoing data collection improves, not replaces, the analysis.
It sets the premium the insurer will charge for cover — that is underwriting, a separate activity.

📋 LO: 3.1.4 — Probability theory and statistical methods
📑 Indicative content: 3.1.4 Use of probability theory and statistical distribution methods to determine the likelihood of risk

✅ Correct Answer: £68,000

📌 Explanation
The expected cost weights each scenario's cost by its probability and sums them: (0.5 × £20,000) + (0.3 × £60,000) + (0.2 × £200,000) = £10,000 + £18,000 + £40,000 = £68,000. This expected-value approach combines several possible outcomes into one comparable figure for prioritising risk.

❌ Why the other options are wrong:
£60,000 — simply the likely-case cost, ignoring the weighting of all three scenarios.
£93,333 — a plain average of the three costs, ignoring their differing probabilities.
£200,000 — the worst-case cost alone, with no probability weighting applied.
£28,000 — weights only the best and likely cases, omitting the worst-case contribution.

📋 LO: 3.1.4 — Probability theory and statistical methods
📑 Indicative content: 3.1.4 Use of probability theory and statistical distribution methods to determine the likelihood of risk

✅ Correct Answer: How susceptible specific assets, sites or processes are to a given threat

📌 Explanation
A vulnerability assessment examines susceptibility — how exposed and how easily harmed particular assets, sites or processes are by an identified threat — and shows where weaknesses concentrate. It complements likelihood-and-impact scoring by directing mitigation to the most fragile points.

❌ Why the other options are wrong:
The premium an insurer will set for transferring the risk — that is underwriting, not a vulnerability assessment.
The single monetary value that represents the whole risk — that describes expected monetary value.
The order in which risks were first added to the register — register order is irrelevant to susceptibility.

📋 LO: 3.1.2 — Vulnerability assessments
📑 Indicative content: 3.1.2 Vulnerability assessments

✅ Correct Answer: Risks visible only to particular functions or tiers are surfaced and recorded; Assessments become more realistic by drawing on first-hand operational knowledge

📌 Explanation
Different stakeholders see different parts of the chain, so engaging them surfaces risks a single function would miss and grounds likelihood and impact judgements in real operational knowledge. This makes the register more complete and credible, and builds shared ownership of the actions.

❌ Why the other options are wrong:
It removes the need to give any risk an owner — ownership remains essential; engagement supports it rather than replacing it.
It allows the register to be withheld from senior management — reporting to decision-makers is a core purpose, not something engagement avoids.

📋 LO: 3.2.2 — Engaging stakeholders in risk assessment and registers
📑 Indicative content: 3.2.2 Engaging stakeholders in the development and review of risk assessment and registers

✅ Correct Answer: Visible senior-management commitment backed by adequate people, tools and budget

📌 Explanation
Effective supply chain risk management depends above all on resourcing: leadership commitment plus competent people, suitable tools and data, and an adequate budget. Without visible sponsorship and these resources, processes and registers are not used in practice.

❌ Why the other options are wrong:
A one-off announcement circulated to all staff by email — a single message does not sustain a programme without resources and leadership.
Delegating all risk decisions permanently to a single supplier — core risk decisions and appetite must stay with the organisation.
Removing the risk register to reduce administrative effort — the register is a key tool; removing it undermines the programme.

📋 LO: 3.3.4 — Resource requirements for risk management
📑 Indicative content: 3.3.4 Resource requirements for effective supply chain risk management

✅ Correct Answer: To create a record that justifies taking no further action on a risk

📌 Explanation
Reporting and action plans exist to keep risks visible and actively managed — informing decision-makers, assigning ownership with deadlines and tracking whether mitigation works. Using documentation to justify inaction defeats their purpose, so it is the exception here.

❌ Why the other options are wrong:
To keep decision-makers informed of changing risk exposure — a genuine purpose of regular reporting.
To assign clear ownership and deadlines for agreed mitigations — action plans allocate accountability, a real purpose.
To track whether mitigation is actually reducing the risk — monitoring effectiveness is a key purpose of reporting.

📋 LO: 3.2.3 — Reporting and action plans in risk management
📑 Indicative content: 3.2.3 Importance of reporting and action plans in risk management

✅ Correct Answer: Risks are considered as decisions are made, so they are caught and managed earlier

📌 Explanation
Embedding risk thinking in everyday sourcing and contracting decisions — a strategic, integrated approach — means risks are spotted and addressed at the point of choice rather than after the fact. This proactive, continuous handling is more effective than a once-a-year exercise.

❌ Why the other options are wrong:
It guarantees that no supplier will ever cause disruption — an absolute claim; embedding improves management, not certainty.
It allows the organisation to abandon its risk register — the register supports the approach; it is not replaced by it.
It confines risk responsibility to one specialist team — embedding spreads responsibility into routine decisions, the opposite of confining it.

📋 LO: 3.3.1 — Developing a strategic approach to risk management
📑 Indicative content: 3.3.1 Developing a strategic approach to risk management