CIPS LEVEL 5 – ADVANCED DIPLOMA IN

PROCUREMENT AND SUPPLY

MANAGING SUPPLY CHAIN RISK [L5M2]

OBJECTIVE RESPONSE
Q1Which of the following is an example of an operational risk?

a. Unexpected interest costs.

b. Internal technology failure.

c. Increased competitor activities.

d. Fluctuating exchange rates

Q2The Sarbanes-Oxley regulations are mostly focused on:

1. Investor protection

2. Product quality

3. Clear commercial advertising

4. Corporate financial disclosure

a. 2 and 3 only

b. 1 and 2 only

c. 3 and 4 only

d. 1 and 4 only

Q3. A supplier's terms and conditions include provision in respect of tsunami, earthquakes and
volcanic eruption. This type of provision is known as …

A. a liquidated damages clause

B. an exclusion clause
C. an indemnity clause
D. an insurance provision clause

Q4. An uncertain event or condition that, if it occurs, has a positive or negative effect on one or
more projects objectives is called:

A. An issue

B. A risk

C. An uncertainty

D. A sponsor

Q5. ManCo Inc is a global manufacturing organisation. It has a highly integrated supply chain. All
parties are interconnected with the result that data availability and transparency are high. Its CPO
however is concerned about technological risk. Which of the following is such a risk for ManCo?
a. Cyber crime
b. Global economics
c. Labour standards
d. Economic uncertainty

Q6. A document you use to capture all known risks is called:

A. Risk Log

B. Risk Register

C. Risk List

D. Risk Diary

Q7. Product Manufacturing Group (PMG) is UK based and has just started sourcing materials from
Europe and has to pay its supplier in Euros. This is PMG's first exposure to Euro denominated
payments. It does however sell its products into European markets and has Euro receivables. Which
of the following will be the most appropriate for PMG to manage its Euro currency risk exposure?

a. Forward contract
b. Swap
c. Currency account
d. Option

Q8. On a Friday evening John (your best engineer in the team) comes to you and says he quits. You
have two weeks to find a substitution. What would reduce the chances of such an event? Why?

A. Regular one-on-ones with John

B. Comprehensive professional development plan

C. The highest salary in the team

D. More responsibility

Q9. Dick Group Chemicals (DGC) is conducting a review of its key contracts, part of which involves a
detailed risk assessment of supplier and supply chain risks in respect of a number of its most
important products. DGC’s CPO is anxious to ensure that changes in DGC’s external environment are
closely monitored and any risks arising from the changes are acted on accordingly. The findings in
respect of DGC’s top five products are:

Product 1 – Most significant exposure is to exchange rate fluctuations. Recommended that currency
options are used.
Product 2 – The countries where the product is used have changing population age profiles which
could impact on demand. However, this is not a significant risk so the recommendation is to do
nothing at this stage.

Product 3 – We have been aware of previous mistreatment of workers within the supply chain.
Despite our best efforts this does not seem to have been resolved, the supplier has been informed
that the contract will be ended and the contingency supplier used given their track record of
impeccable conduct.

Product 4 – Local government interference has been a problem on this contract. Third party
guarantees are to be taken to help manage the risk.

For each of the products, you are required to match the external factors with the risk action taken.
Choose from these options and drag and drop your answers into the table below. [8]

You can only use each option once.

External factor Risk Management

Demographic Terminate
Economic Tolerate
Ethical Transfer
Political Treat

Product External factor Risk Management

1
2
3
4

Q10. Which of the following are potential risks that are directly associated with a company's brand?
1. Marketing
2. Reputation
3. Positioning
4. Support
a. 1 and 2 only
b. 2 and 3 only
c. 3 and 4 only
d. 1 and 4 only

Q11. A process that involves prioritizing risks for further action or analysis by assessing the impact
and the probability of occurrence is called

A. Risk Analysis

B. Risk Brainstorming

C. Risk identification
D. Risk appetite

Q12. Is it usual to encourage whistle-blowing amongst employees working in the supply chain if they
suspect unethical behaviour in the supply chain?
a. Yes, because these staff are more likely to be aware of such malpractices
b. Yes, because they will always know if there is unethical behaviour
c. No, because there is usually no means of them doing so confidentially
d. No, because in many countries this will be illegal as it is confidential information

Q13. During the Qualitative Risk Analysis, you assess Impact and Probability of a risk using simple
grades like Low, Medium, High.

When do you perform Risk Identification?

A. At the beginning of a project.

B. During project planning.

C. During the whole lifetime of a project.

D. During project execution.

Q14. As a part of your project, you need to organize a conference. You learn that in the place that
you rented there’s a 70% chance of a tropical storm on the selected dates. How should you handle
such risk?

A. Change the location of the conference.

B. Buy insurance to cover possible damage.

C. Book another place nearby to mitigate the risk of the first location unavailable due to the storm.

D. Inform all participants of the possible storm.

Q15. A procurement manager is responsible for a high-risk and medium-value contract for which the
procurement organisation is critically dependent on the supplier. The procurement manager has
instructed the supplier to submit a disaster recovery plan. Is this action appropriate?
a. Yes - disaster recovery plans should be a standard requirement for all suppliers on all contracts
b. No - the procurement manager is responsible for creating the disaster recovery plan
c. No - disaster recovery planning is only required on high-risk and high-value contracts
d. Yes - the plan will show how the supplier will continue to operate and deliver the service in a
disaster situation
Q16. Who should be involved in Risk Management activities?

A. Only Project Team.

B. Only Project Manager.

C. As many stakeholders as practical.

D. All stakeholder except clients.

Q17. Recognised risk management strategies to mitigate risks include which of the following? Select
TWO that apply.
a. Treat
b. Trust
c. Translate
d. Test
e. Transfer

Q18. You acquired an expensive piece of equipment for your project. It is know to be sensitive and
fragile in work. Several tasks that require this equipment are on a critical path. What’s the BEST
action you can do to improve project’s chances for success?

A. Buy insurance to cover the costs of repairs.

B. Hire a technical support team to quickly fix the equipment if needed.

C. Find a good expert to operate the equipment.

D. There’s nothing you can do.

Q19. Which of the following are types of intellectual property protection?

1. Indemnity.
2. Warranty.
3. Copyright.
4. Trademark.
a. 1 and 2.
b. 2 and 4.
c. 3 and 1.
d. 3 and 4.

Q20. You are on the call with clients. They say the vendor team they hired to create designs is
behind schedule. What should you do?

A. State that your project is also behind the schedule because of it.

B. Log the risk into Risk Register to assess impact.

C. Do nothing. It’s not your problem.

D. Contact the vendor to help them out.

Q21. The principle of ‘utmost good faith’ lies at the heart of contracts for the provision of insurance.
Is this correct?
a. No, caveat emptor is the fundamental principle of all insurance related contracts. b. Yes, it places
the burden of responsibility on the insurance company to check the facts.
c. No, it is always assumed that there are no material facts unless they are expressly stated.
d. Yes, all relevant information must be fully disclosed otherwise the insurance will be void.

Q22. After you performed Qualitative Risk Analysis you need to create:

A. A prioritized list of risks.

B. List of risk for additional analysis and investigation.

C. List of urgent risks

D. Watch list

E. All the above

Q23. Unforeseen events that arise during a contract will be treated as ‘force majeure’ and all parties
will be excluded from liability. Is this correct?
a. Yes, but only if the event is genuinely beyond the control of one or all of the parties.
b. No, a contract is legally binding and the parties cannot be excluded from any liability.
c. Yes, it is not possible for liability to arise for any party if something unexpected happens.
d. No, it is not possible to exclude responsibility for liability that might arise under a contract.

Q24. The conventional methodology for assessing risks involves the evaluation of which of the
following? Select TWO that apply.
a. Contingency.
b. Responsibility.
c. Probability.
d. Recovery.
e. Impact.
f. Accountability

Q25. After reviewing Risk Register you see two critical risks that you anticipate during the next week.
What should you do with this knowledge?

A. Do nothing. Your Risk Register is shared with the team and stakeholders.
B. Reach out to the stakeholders and the responsible person with a reminder.
 Which of the following is true about the concept of ‘normal distribution’? Select THREE that apply.
a. It is based on probability.
b. It is depicted as a straight line.
c. The values are evenly distributed.
d. It is symmetric in shape.
e. It shows the variation in extreme points.
f. Most values are around the mean.

Q26. "A network of manufacturers and service providers that work together to convert and move
goods from the raw materials stage through to the end user" is the definition of

A. Supply chain.

B. Operations management.

C. Service operations.

D. Operations function.

Q27. Major International Manufacturing (MIM) has a strict risk management policy, requiring all
risks to be fully evaluated and appropriate action taken. A recent example was a risk that for which
MIM was able to take out insurance to provide full protection. Another risk arose because a trusted
supplier had short-term performance issues. MIMG was comfortable accepting this risk as the
supplier was aware of the issue and had promised it was now resolved. MIM’s approaches to dealing
with these two risks can be best described as which of the following?
1. Terminate.
2. Tolerate.
3. Transfer.
4. Treat.
a. 1 and 2.
b. 2 and 3.
c. 3 and 4.
d. 4 and 1

Q28. Which of these is NOT a flow that moves up and down the supply chain?

A. Procedural

B. Monetary

C. Information

D. Physical
Q29. Green Power Group (GPG) manufactures different types of wind turbines and solar panels. A
number of changes in GPG’s external environment have been identified as creating potential risks.
GPG has a risk framework which sets out its policy for responding to such risks. Relevant information
is as follows:-

Risk 1 – Extreme volatility in USD currency rates, against other major currencies, has had an impact
on GPG’s costs. The risk has a medium to high rating (probability/impact). In accordance with the
GPG risk framework, the risk is too great to be ignored and so a detailed plan with specific actions of
mitigation is being implemented.

Risk 2 – Recent changes in demographics indicate potential future changes in consumer spending
patterns which might impact on the pricing of GPG’s products. The risk has been assessed as very
low (probability/impact). The risk has been noted in the GPG risk register, but no further action is
required apart from monitoring the situation annually.

Risk 3 – Due to pressure from lobby groups, GPG has changed its sourcing strategy to ensure that all
components are compatible with its sustainability policy. To accommodate its requirements GPG has
started using some new suppliers which has created additional transit and storage risks, for which
GPG has taken out insurance cover from a third-party specialist provider.

Risk 4 – Systems developments are now facilitating end-to-end supply chain integration. GPG is
under pressure to achieve such integration so it does not fall behind its rivals. However, not all GPG
suppliers have compatible systems. This has been recognised as a potential risk for GPG and the
impact is potentially very significant as the board considers GPG’s survival is dependent on full
systems integration. The board has already decided that any suppliers which are unable to comply
with GPG’s requirements will have to be replaced.

You are required, for each risk, to determine the relevant external factor and the most appropriate
risk response.

You can only use each option once.

Response External factor

Terminate Economic
Treat Technology
Transfer Social
Tolerate Environmental

Risk Response External Factor

1
2
3
4

Q30. Purchasing insurance is a technique used to

A. Treat
B. Transfer
C. Tolerate
D. Terminate
Q31. Which of the following are areas of potential technology risk for a procurement organisation?
1. Cyber-crime.
2. Cargo theft.
3. Ransomware attack.
4. Under-investment.
a. 1 and 2.
b. 2 and 4.
c. 3 and 1.
d. 3 and 4.

Q32. Dr Dick decided to stop practising when malpractice insurance premiums became too high for
him to afford. He is managing risk by
A. Transferring
B. Tolerating
C. Terminating
D. Treating

Q33. A fire at the depot of a transport company destroys its vehicle fleet. It is insured and so in time
the vehicles can be replaced. However, in the short-term it cannot fulfil customer orders and so
loses business. This loss of business is known as which of the following?
a. Consequential loss.
b. Direct loss.
c. Positive loss.
d. Reputational loss.

Q34. Software Development Inc (SDI) develops and markets a range of business applications and
products. It has its own product development resource but also uses external contractors where
expertise is not available in house. SDI is just about to start working with a small organisation called
XNX Developers (XNX) on a highly secret new development currently known as Project Y. SDI and
XNX have worked together successfully in the past. Ultimately, when the development is completed,
SDI will pay XNX a one-off fee for exclusive and full ownership of Project Y.

XNX is happy with this arrangement as it needs an injection of funds to support the development of
its own product range and bank finance is not available. SDI and XNX have also reached agreement
on XNX’s acceptance to compensate SDI for potential future liability on Project Y in respect of the
development work it has undertaken.

Based on the information provided, which of the following clauses will be a priority for SDI to include
in the contract to address its specific needs?
1. Intellectual property rights
2. Force majeure
3. Jurisdiction
4. Indemnity
a. 1 and 2 only
b. 2 and 3 only
c. 3 and 4 only
d. 1 and 4 only