L5M2 Paper 15

✅ Correct Answer: Its risk appetite for the type and level of risk worth bearing for objectives

📌 Explanation
Risk appetite is the amount and type of risk an organisation is willing to take on in pursuit of its objectives. Accepting more uncertainty to gain access to scarce innovation is a deliberate appetite statement, set by leadership to guide consistent accept, treat, transfer or avoid decisions.

❌ Why the other options are wrong:
The total monetary value of losses it has already absorbed — that is loss history, a backward-looking figure rather than a forward tolerance.
A single hazard present within one of its processes — that defines a hazard, the source of harm, not appetite.
The extent of assets exposed to one named threat — that describes exposure, not the willingness to bear risk.

📋 LO: 1.1.1 — Definition of risks, hazards, exposure and risk appetite
📑 Indicative content: 1.1.1 Definitions of risks; hazards; exposure; and risk appetite

✅ Correct Answer: 1, 2, 3 and 5 only

📌 Explanation
Statements 1, 2, 3 and 5 correctly pair each tool with the source it surfaces: SWOT and mapping look inward, while STEEPLED and Porter's Five Forces look outward. Statement 4 is wrong because McKinsey 7S examines internal alignment of structure, systems and shared values, not external political or economic sources.

❌ Why the other options are wrong:
1, 3 and 4 only — includes the false statement 4 and omits valid statements 2 and 5.
2, 4 and 5 only — relies on the false statement 4 and drops correct statements 1 and 3.
1, 2 and 4 only — again includes the false statement 4 and omits correct statements 3 and 5.

📋 LO: 1.1.4 — Tools for assessing internal and external sources of risk
📑 Indicative content: 1.1.4 Tools for assessing internal and external sources of risk

✅ Correct Answer: An unrecoverable write-off of stock damaged in a warehouse fire

📌 Explanation
The positive consequences of risk are the gains that speculative (two-sided) risk-taking can deliver, such as cost advantage, market share or resilience. A fire write-off is a pure downside (hazard) loss with no upside, so it is the exception here.

❌ Why the other options are wrong:
Securing a cost advantage by adopting a new material early — a genuine upside of accepting calculated risk.
Gaining market share by entering a region ahead of rivals — a first-mover opportunity from speculative risk.
Building resilience by qualifying an innovative second source — a beneficial outcome of taking a measured sourcing risk.

📋 LO: 1.1.5 — Positive and negative consequences of risk
📑 Indicative content: 1.1.5 Positive and negative consequences of risk

✅ Correct Answer: Security of supply if that single site is disrupted; Technology risk from the site's outdated, failure-prone systems

📌 Explanation
Leaning on one ageing site concentrates exposure: any disruption threatens continuity (security of supply), while obsolete, unreliable systems at that site create technology risk. Both are operational risks managed through dual sourcing, redundancy and IT assurance.

❌ Why the other options are wrong:
An automatic gain in negotiating leverage over the supplier — dependence usually weakens, not strengthens, the buyer's leverage.
The removal of any need to hold contingency stock — reversed logic; concentration increases the case for contingency stock.

📋 LO: 1.2.4 — Security of supply
📑 Indicative content: 1.2.4 Security of supply; 1.2.5 Technology

✅ Correct Answer: An environmental ESG risk that flows through to the buyer's ESG position

📌 Explanation
Carbon-pricing rules that raise a supplier's costs are an environmental (E) pressure within the ESG framework. Because buyers are increasingly judged on the environmental exposure across their chain, this risk flows through to the organisation's own ESG performance and the resilience it must report.

❌ Why the other options are wrong:
A pure cash-flow risk arising from payment timing — the driver is environmental regulation, not the timing of the buyer's own payments.
A quality-failure risk from non-conforming goods — the issue is compliance cost and continuity, not defective products.
A confidentiality risk over shared technical data — relates to information misuse, not carbon regulation.

📋 LO: 1.4.2 — How environmental supply chain risks impact ESG
📑 Indicative content: 1.4.2 How environmental supply chain risks impact organisational ESG (Environmental, Social, and Governance) considerations

✅ Correct Answer: No, because the Code sets professional ethical duties that apply to every procurement decision and help eliminate risk

📌 Explanation
The CIPS Code of Conduct binds members to integrity, honesty and avoidance of conflicts in all professional dealings, supporting the elimination of fraud and corruption risk. A sustainability report communicates performance; it does not replace the everyday ethical obligations the Code imposes on buyers.

❌ Why the other options are wrong:
Yes, because a published report discharges all ethical obligations — an absolute claim; reporting does not substitute for ethical conduct.
Yes, because the Code applies only to senior leaders, not buyers — the Code applies to all members, including operational buyers.
No, because the Code prohibits organisations from publishing any reports — correct verdict but invented reasoning; the Code does not forbid reporting.

📋 LO: 1.3.4 — Ethical codes including the CIPS Code of Conduct
📑 Indicative content: 1.3.4 The use of ethical codes including the CIPS Code of Conduct to support the elimination of risk

✅ Correct Answer: A financial risk from being locked into an unfavourable price

📌 Explanation
Being committed to a fixed price while market prices fall is a financial risk: the organisation bears a higher cost than the prevailing market, eroding margin. Such price exposure is managed through price-review mechanisms, indexation or shorter commitment periods.

❌ Why the other options are wrong:
A hazard risk from a sudden accidental event — hazard risks are physical accidents such as fire or flood, not adverse pricing.
A quality-failure risk on the goods received — concerns conformance to specification, not price.
A logistics complexity risk in distribution — arises from intricate transport networks, not a fixed price.

📋 LO: 1.1.2 — Categories of risk
📑 Indicative content: 1.1.2 Categories of risk: financial, strategic, operational, and hazard

✅ Correct Answer: The immediate cost of expediting replacement materials by air

📌 Explanation
Indirect (consequential) losses are the delayed knock-on effects of an event, such as lost market share, costlier borrowing and eroded confidence. Expediting replacement materials by air is an immediate, measurable cost flowing straight from the event, so it is a direct loss, not an indirect one.

❌ Why the other options are wrong:
A lasting decline in the organisation's share of the market — a delayed, consequential loss of future revenue.
A long-term increase in the cost of borrowing — a knock-on financial effect over time.
Erosion of customer confidence over the following year — a delayed indirect effect on reputation.

📋 LO: 1.1.6 — Direct and indirect losses
📑 Indicative content: 1.1.6 Direct and indirect losses

✅ Correct Answer: Security of supply

📌 Explanation
Depending on a sole supplier with no qualified substitute and a long approval lead time means any interruption could halt production for an extended period. This is the operational risk to security (continuity) of supply, mitigated through early qualification of alternatives, buffer stock and contractual continuity obligations.

❌ Why the other options are wrong:
Currency translation risk — a financial risk from exchange-rate movement, not single-source continuity.
Professional indemnity exposure — relates to negligent advice or services, not supply continuity.
Over-diversification of the supply base — the opposite of the concentrated position described.

📋 LO: 1.2.4 — Security of supply
📑 Indicative content: 1.2.4 Security of supply

✅ Correct Answer: The Ethical Trading Initiative (ETI) Base Code

📌 Explanation
The ETI Base Code sets internationally recognised labour standards — covering working hours, fair pay and freedom from forced and child labour — that buyers can require of suppliers. It gives a credible basis for managing the social (S) pillar of ESG risk in the supply chain, alongside ILO conventions.

❌ Why the other options are wrong:
Incoterms 2020 trade terms — define delivery and risk transfer in trade, not labour standards.
ISO 27001 information security management — addresses information security, not labour rights.
The Kraljic portfolio matrix — a sourcing-positioning tool, not a labour-standards framework.

📋 LO: 1.4.5 — Standards for sustainable procurement
📑 Indicative content: 1.4.5 Standards for sustainable procurement: ISO standards, United Nations (UN) and International Labour Organization (ILO), and local sustainability standards

✅ Correct Answer: Service-level agreements with measurable KPIs and remedies

📌 Explanation
For an outsourced service, service-level agreements set measurable performance standards (KPIs) and the remedies that apply if they are missed, giving the buyer ongoing control and recourse over a long contract. This directly manages the loss-of-control risk characteristic of outsourcing.

❌ Why the other options are wrong:
A retention of title clause over the provider's equipment — concerns ownership of goods until payment, not service performance.
An Incoterms rule governing delivery of goods — addresses delivery and risk transfer for goods, not a services contract.
A confidentiality clause protecting shared information — guards information, not service quality.

📋 LO: 2.1.1 — Purpose and use of model form contracts
📑 Indicative content: 2.1.1 Purpose and use of model form contracts in managing supply chain risk; 1.2.7 Risks in outsourcing and offshoring

✅ Correct Answer: A liquidated damages clause

📌 Explanation
A liquidated damages clause fixes in advance a sum payable for a defined breach, such as late delivery, provided it is a genuine pre-estimate of loss rather than a penalty. It gives certainty of recovery and avoids the need to prove actual loss, allocating delay risk to the supplier.

❌ Why the other options are wrong:
A force majeure clause — excuses performance during extraordinary events, the opposite of compensating for delay.
A retention of title clause — keeps ownership with the seller until payment, unrelated to late-delivery compensation.
An assignment clause — governs transfer of contractual rights, not pre-set damages.

📋 LO: 2.1.2 — Indemnity and liability clauses
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management

✅ Correct Answer: Advancing cash against a company's outstanding invoices; Taking over collection of the factored receivables

📌 Explanation
Debt factoring releases working capital by advancing cash against outstanding invoices, and the factor typically also manages collection of those receivables. Both ease the cash-flow risk that arises when customers pay slowly.

❌ Why the other options are wrong:
Scoring a prospective supplier's creditworthiness — that is a credit-rating agency service, not factoring.
Restoring IT systems and data after an outage — that is a disaster-recovery service, not factoring.

📋 LO: 2.2.1 — Third-party providers for credit rating and debt factoring
📑 Indicative content: 2.2.1 Use of third-party providers for credit rating, debt factoring, and related business services in managing supply chain risk

✅ Correct Answer: Utmost good faith, breached by non-disclosure of a material fact

📌 Explanation
Utmost good faith obliges the insured to disclose all material facts honestly when arranging cover. Failing to reveal that the site sat on a known floodplain breaches that duty, allowing the insurer to reduce or refuse the claim, which is central to how insurance handles supply chain risk transfer.

❌ Why the other options are wrong:
Subrogation, recovering the loss from a third party — concerns recovery from whoever caused the loss, not non-disclosure.
Contribution, sharing the loss between insurers — applies where two policies overlap, not to disclosure failures.
Insurable interest, requiring a financial stake in the property — concerns having a stake in the subject matter, not honesty of disclosure.

📋 LO: 2.3.4 — Insurance claims, underwriting and risk management
📑 Indicative content: 2.3.4 Insurance claims, underwriting, and supply chain risk management; 2.3.2 Legal principles of insurance

✅ Correct Answer: An indemnity clause covering specified third-party claims; A limitation of liability clause capping recoverable amounts

📌 Explanation
Indemnity and limitation of liability clauses both allocate the financial consequences of default: an indemnity promises to reimburse defined losses and third-party claims, while a liability cap contains the maximum a party can be required to pay. Together they shape how financial risk is shared in the contract.

❌ Why the other options are wrong:
A variation clause governing how the contract may change — manages changes to scope or terms, not loss allocation.
An entire agreement clause confirming the written terms — fixes the contract's scope, not who bears losses.

📋 LO: 2.1.2 — Indemnity and liability clauses
📑 Indicative content: 2.1.2 Purpose and development of indemnity and liability clauses in supply chain risk management

✅ Correct Answer: No, because self-declarations lack independent verification and may miss risks deep in the chain

📌 Explanation
Supplier self-declarations are unverified and can mask non-compliance, especially at lower tiers the buyer cannot easily see. An independent third-party audit provides objective assurance and reach into sub-tier suppliers, giving more credible evidence that ESG standards are genuinely met.

❌ Why the other options are wrong:
Yes, because a self-declaration is always as reliable as an independent audit — an absolute claim; unverified declarations are less reliable than independent checks.
Yes, because ESG risk only ever exists at the first-tier supplier — ESG risk extends across all tiers of the chain.
No, because organisations are forbidden from ever auditing suppliers — correct verdict but invented reasoning; auditing suppliers is encouraged good practice.

📋 LO: 2.2.2 — Third-party auditing of risks including ESG
📑 Indicative content: 2.2.2 Use of third-party providers for auditing risks including ESG risks in supply chains

✅ Correct Answer: It identifies critical activities and quantifies how their loss would escalate over time

📌 Explanation
A Business Impact Analysis determines which activities are critical and how quickly and severely their disruption would harm the organisation. This analysis underpins continuity planning, informing recovery priorities and recovery time objectives within the business continuity plan.

❌ Why the other options are wrong:
It sets the insurance premium for the year ahead — that is underwriting, not a BIA.
It negotiates the unit price of raw materials — a sourcing activity, unrelated to impact analysis.
It records the contractual penalties for late delivery — a contractual matter, not continuity analysis.

📋 LO: 2.4.1 — Components of a business continuity plan and disaster recovery plan
📑 Indicative content: 2.4.1 Components of a business continuity plan and disaster recovery plan; 2.4.2 Definitions and purpose

✅ Correct Answer: A due-diligence and beneficial-ownership screening service

📌 Explanation
Due-diligence providers screen ownership structures, sanctions lists and adverse media to reveal a supplier's true beneficial owners and any compliance red flags. This related business service helps the buyer manage governance, sanctions and corruption risk before committing to a contract.

❌ Why the other options are wrong:
A debt-factoring facility for its own receivables — releases the buyer's own cash, not ownership intelligence on a supplier.
A disaster recovery provider for its IT systems — restores systems after disruption, unrelated to ownership checks.
A freight forwarder arranging transport — handles logistics, not supplier screening.

📋 LO: 2.2.1 — Third-party providers for credit rating and debt factoring
📑 Indicative content: 2.2.1 Use of third-party providers for credit rating, debt factoring, and related business services in managing supply chain risk

✅ Correct Answer: Because the mix of likelihood and impact behind an equal score points to different treatments

📌 Explanation
Two risks can reach the same score by different routes — one rare-but-severe, the other frequent-but-minor. A rare, catastrophic risk may suit transfer or contingency, while a frequent, minor one suits treating the cause, so the underlying likelihood–impact mix shapes a proportionate response.

❌ Why the other options are wrong:
Because the matrix ranks risks alphabetically once scored — the matrix ranks by score, not alphabetically.
Because an equal score guarantees neither risk will occur — a score prioritises risk; it does not prevent occurrence.
Because the older entry on the register is always treated first — age does not determine treatment priority.

📋 LO: 3.1.1 — Methodologies for assessing probability and impact
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk

✅ Correct Answer: 3 to 1

📌 Explanation
A benefit-cost ratio divides the expected benefit by the cost: £90,000 ÷ £30,000 = 3, expressed as 3 to 1. A ratio above 1 to 1 means the control returns more than it costs, so a 3 to 1 ratio shows the mitigation is clearly worthwhile.

❌ Why the other options are wrong:
1 to 3 — inverts the ratio, dividing cost by benefit instead of benefit by cost.
2 to 1 — would arise from subtracting cost from benefit first (£60,000) before dividing, which is not the ratio.
1 to 1 — would mean benefit equals cost, but £90,000 is three times £30,000.
30 to 1 — drops a zero from the cost, miscomputing the division.

📋 LO: 3.1.1 — Methodologies for assessing probability and impact
📑 Indicative content: 3.1.1 Methodologies for assessing the probability and impact of risk; benefit-cost ratio of a control

✅ Correct Answer: It pinpoints how exposed and easily harmed specific assets or processes are to that threat

📌 Explanation
A vulnerability assessment focuses on susceptibility — how exposed and how easily harmed particular assets, sites or processes are by an identified threat. It complements likelihood-and-impact scoring by showing where weaknesses concentrate, so mitigation can be targeted at the most fragile points.

❌ Why the other options are wrong:
It converts the risk into a single weighted monetary figure — that describes expected monetary value, not a vulnerability assessment.
It sets the premium an insurer will charge for cover — that is underwriting.
It removes the need to assign an owner to the risk — ownership remains essential; the assessment informs rather than replaces it.

📋 LO: 3.1.2 — Vulnerability assessments
📑 Indicative content: 3.1.2 Vulnerability assessments

✅ Correct Answer: Several years of the organisation's own recorded incident logs; Published industry loss and disruption datasets for the sector

📌 Explanation
Collating statistical evidence means drawing on objective, sizeable datasets: the organisation's own multi-year incident logs and credible published industry datasets both give a defensible, data-based foundation for estimating likelihood. Larger, structured sources reduce reliance on anecdote and bias.

❌ Why the other options are wrong:
A single colleague's recollection of one past event — too small and biased a sample to estimate likelihood reliably.
The order in which suppliers happen to appear in the system — an arbitrary ordering unrelated to disruption frequency.

📋 LO: 3.1.3 — Collating statistical evidence of risks
📑 Indicative content: 3.1.3 Collating statistical evidence of risks

✅ Correct Answer: So one person is accountable for monitoring the risk and driving its agreed mitigation

📌 Explanation
Assigning a named owner creates clear accountability: someone is responsible for tracking the risk, progressing the agreed actions and reporting changes. Without ownership, register entries tend to stall, which is why ownership is a core field in any risk register template.

❌ Why the other options are wrong:
So the register can be hidden from senior decision-makers — registers exist to make risks visible, not to conceal them.
So the likelihood and impact no longer need to be assessed — assessment remains essential; ownership supports it.
So the risk is guaranteed never to materialise — an absolute claim; ownership manages risk, it cannot prevent it.

📋 LO: 3.2.1 — Templates for risk assessments and registers
📑 Indicative content: 3.2.1 Creation and use of templates for risk assessments and risk registers

✅ Correct Answer: Treating each risk in isolation only after it has already caused harm

📌 Explanation
A strategic approach is proactive and integrated: it aligns risk management with objectives and appetite, embeds it in everyday decisions and is championed by leadership. Reacting to each risk only after harm occurs is the ad hoc, reactive opposite, so it is the exception.

❌ Why the other options are wrong:
Aligning risk management with the organisation's objectives and risk appetite — a defining feature of a strategic approach.
Embedding risk thinking into routine procurement decisions — makes risk management consistent and proactive.
Securing leadership commitment to a consistent, organisation-wide approach — leadership sponsorship is central to embedding strategy.

📋 LO: 3.3.1 — Developing a strategic approach to risk management
📑 Indicative content: 3.3.1 Developing a strategic approach to risk management

✅ Correct Answer: Leaders modelling open reporting and rewarding staff who raise risks early

📌 Explanation
Organisational culture is set from the top: when leaders visibly value openness and reward early reporting, staff feel safe to surface risks rather than hide them, so risks are caught and managed sooner. Culture, not process alone, determines whether risk management works day to day.

❌ Why the other options are wrong:
Penalising anyone who flags a potential problem — reversed logic; a blame culture suppresses reporting and worsens exposure.
Confining all risk discussion to one annual board meeting — too infrequent to embed risk in daily decisions.
Handing the entire risk function to an outside consultant — outsourcing ownership undermines an internal risk culture.

📋 LO: 3.3.2 — Role of organisation culture in managing risk
📑 Indicative content: 3.3.2 Role of organisation culture in management of supply chain risk