Free L5M2 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The CBCI (Certificate of the Business Continuity Institute) and DBCI (Diploma of the Business Continuity Institute) are professional qualifications awarded by the Business Continuity Institute (BCI). The BCI is the leading global professional body for business continuity and resilience. These certifications are designed to validate an individual's knowledge and expertise in implementing and managing business continuity management (BCM) systems, which are critical for organisational resilience against disruptions. The CIPS L5M2 module on managing supply chain risk directly covers the principles of business continuity, making these qualifications highly relevant to the subject area.

A. supply chain management: While business continuity is a vital component of supply chain risk management, these are specific qualifications for the business continuity discipline, not the entire SCM field.

B. ethical business practices: These qualifications focus on operational resilience and recovery strategies, not the broader principles of corporate ethics.

C. environmental improvements: This pertains to sustainability and environmental management (e.g., ISO 14001), which is a separate discipline from business continuity (e.g., ISO 22301).

1. The Business Continuity Institute (BCI). (2023). BCI Certifications. The BCI officially defines the CBCI as the "internationally recognised credential in business continuity" and the starting point for a career in the field. This documentation directly links the qualifications to the business continuity profession. Available at: https://www.thebci.org/training-qualifications/bci-certifications.html

2. Herbane

B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History

52(6)

978-1002. This academic paper discusses the professionalisation of business continuity

referencing the role of professional bodies like the BCI in establishing standards and qualifications (p. 995). DOI: https://doi.org/10.1080/00076791.2010.511185

3. International Organization for Standardization (ISO). (2019). ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements. The body of knowledge underpinning the CBCI and DBCI qualifications is based on this international standard for business continuity management. The standard's scope is explicitly defined as business continuity

not general SCM

ethics

or environmental management.

SWOT analysis is a strategic planning framework used to evaluate an organisation's competitive position. It stands for Strengths, Weaknesses, Opportunities, and Threats. The framework is explicitly divided into two dimensions: internal and external. Strengths and Weaknesses are internal factors that originate within the organisation itself. Opportunities and Threats are external factors arising from the macro-environment. By identifying internal Weaknesses and external Threats, this model provides a comprehensive structure for exploring both internal and external risks to a business.

A. Porter's 5 Forces: This model is used for industry analysis, focusing exclusively on external competitive pressures and does not assess a company's internal factors.

B. STEEPLE: This is a macro-environmental analysis tool that examines only external factors (Social, Technological, Economic, etc.) and does not consider internal risks.

D. Poisson Distribution: This is a statistical tool used to model the frequency of events over a specific period, not a strategic framework for identifying the sources of business risks.

1. Chartered Institute of Procurement & Supply. (2018). Managing Supply Chain Risk (L5M2). CIPS Profex Study Guide. Chapter 2: Risk and the Supply Chain

Section 3: Risk Identification. The guide details SWOT as a tool for assessing internal strengths/weaknesses and external opportunities/threats.

2. Johnson

G.

Whittington

R.

Scholes

K.

Angwin

D.

& Regnér

P. (2017). Exploring Strategy (11th ed.). Pearson Education. Chapter 3

Section 3.5

"SWOT

" pp. 82-84. The text explicitly states

"SWOT summarises the key issues from the business environment and the strategic capability of an organisation that are most likely to impact strategy development." It clearly delineates Strengths/Weaknesses as internal and Opportunities/Threats as external.

3. Hill

C. W. L.

& Jones

G. R. (2012). Strategic Management: An Integrated Approach (10th ed.). Cengage Learning. Chapter 3

"Internal Analysis: Distinctive Competencies

Competitive Advantage

and Profitability

" pp. 99-101. This chapter describes SWOT as a methodology to align a company's internal resources and capabilities (Strengths and Weaknesses) with the external opportunities and threats in its environment.

The Stakeholder Salience Model, developed by Mitchell, Agle, and Wood (1997), is a framework for identifying and classifying stakeholders. It assesses stakeholders based on three key attributes: power, legitimacy, and urgency. Power refers to the stakeholder's ability to influence the organisation. Legitimacy is the perceived validity or appropriateness of a stakeholder's claim. The third attribute, urgency, relates to the degree to which a stakeholder's claim demands immediate attention. The combination of these attributes determines a stakeholder's "salience" or importance to the organisation. From the options provided, power and legitimacy are two of these three core attributes.

C. interest: This is a key variable in the Power/Interest Matrix (Mendelow's Matrix), a different stakeholder mapping tool, not the Salience Model which uses 'urgency' instead.

D. level: This term is too general and is not a specific, defined attribute within the Stakeholder Salience Model framework.

E. attitude: While a stakeholder's attitude (e.g., supportive, opposed) is important for management strategy, it is not one of the three defining attributes of the Salience Model.

1. Mitchell

R. K.

Agle

B. R.

& Wood

D. J. (1997). Toward a Theory of Stakeholder Identification and Salience: Defining the Principle of Who and What Really Counts. The Academy of Management Review

22(4)

853–886. In the abstract and throughout the paper (e.g.

p. 865-869)

the authors define and elaborate on the three key attributes: "We suggest that stakeholders can be identified by their possession or attributed possession of one

two

or all three of the following attributes: (1) the stakeholder's power to influence the firm

(2) the legitimacy of the stakeholder's relationship with the firm

and (3) the urgency of the stakeholder's claim on the firm." DOI: https://doi.org/10.2307/259247

2. Neville

B. A.

Bell

S. J.

& Whitwell

G. J. (2011). Stakeholder Salience Revisited: Refining

Redefining

and Refueling an Underdeveloped Conceptual Tool. Journal of Business Ethics

102(3)

357–378. This paper reviews and builds upon the original model

confirming the foundational attributes as power

legitimacy

and urgency. DOI: https://doi.org/10.1007/s10551-011-0814-9

The 'Tolerate' approach, also known as risk acceptance, is a valid and common strategy in risk management. It involves a conscious decision to accept the potential consequences of a particular risk without taking any specific action to mitigate it. This approach is typically chosen when the potential impact of the risk is low, or the cost of implementing a mitigation strategy outweighs the potential loss. The organisation acknowledges the risk and agrees to bear any resulting losses. This is one of the '4 Ts' of risk response, which also include Treat, Transfer, and Terminate.

B. translate: This is not a recognized term in risk management methodology. It refers to converting information from one form or language to another.

C. transport: This term is incorrect. While 'transfer' is a valid risk response (shifting risk to a third party), 'transport' relates to logistics and movement.

D. take out: This is informal language and not a standard term. The correct term for eliminating the source of the risk is 'terminate' or 'avoid'.

1. CIPS (Chartered Institute of Procurement & Supply). (2018). Managing Supply Chain Risk (L5M2). Profex Publishing. In the section on risk response strategies

the '4 Ts' model is detailed

explicitly listing 'Tolerate' as a primary option for managing identified risks.

2. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page. Chapter 6

"Responding to Risks

" outlines the main response strategies

including risk acceptance or tolerance

where an organization decides to live with the risk.

3. Slack

N.

Brandon-Jones

A.

& Johnston

R. (2016). Operations Management (8th ed.). Pearson. In the chapter on risk management (Chapter 18)

the concept of 'accepting the risk' (tolerating) is presented as a viable response when other actions are not justified.

To effectively detect sensitive and often concealed issues such as child labour, social audits must employ methods that prevent deception and encourage truthful disclosure. Unannounced, on-the-spot visits (B) are critical as they prevent factory management from hiding non-compliant practices or coaching workers. Advance warnings would render the audit ineffective for such issues.

Furthermore, conducting private meetings with a selection of workers (D) is a best-practice technique. This ensures confidentiality, allowing workers to speak openly about their conditions, ages, and treatment without fear of reprisal from management or coercion from peers, which is a significant risk in group settings.

A. organised well in advance to allow the factory managers to prepare for the audit: This approach is counter-productive for uncovering hidden violations like child labour, as it gives the supplier time to conceal evidence and coach employees.

C. conduct group interviews with workers to ensure that all voices are heard: Group interviews are unsuitable for sensitive topics. Workers are unlikely to speak truthfully about violations due to peer pressure or fear of managers overhearing.

1. CIPS L5M2 Managing Supply Chain Risk Official Course Book: The principles of effective supplier auditing are discussed

emphasizing the need for thorough and sometimes unannounced checks to verify compliance

especially concerning ethical standards. The text highlights that for serious risks like modern slavery or child labour

a simple pre-arranged visit is insufficient to uncover the truth. (Note: Specific page numbers vary by edition

but this content is typically found in chapters on managing supplier performance and risk).

2. International Labour Organization (ILO): The ILO's guidance on combating child labour emphasizes the need for credible monitoring. It notes that unannounced inspections and confidential worker interviews are core components of effective verification processes

as they provide a more accurate picture of workplace realities than pre-arranged

management-controlled audits. (See: ILO

Combating child labour: a handbook for employers and business

Section 4: 'Monitoring and verification').

3. Lund-Thomsen

P.

& Lindgreen

A. (2014). Corporate social responsibility in global value chains: A governance perspective. Journal of Business Ethics

125

1-5. This and similar academic articles on CSR and ethical supply chains consistently identify unannounced audits and confidential worker interviews as essential methodologies for credible social auditing

contrasting them with less effective

pre-announced "show-and-tell" audits. DOI: https://doi.org/10.1007/s10551-013-1949-5 (The principles are discussed in the broader context of effective governance mechanisms).

Airlines typically enter into jet-fuel commodity swap contracts. In a swap the airline pays (or receives) a fixed price for fuel and receives (or pays) the floating market index, thereby locking-in—or “fixing”—its fuel cost for a defined period. Swaps are therefore the specific derivative instrument used; “hedging” is the overall risk-management strategy, not the contract itself.

A. commodity – Describes the underlying good (fuel) rather than the financial contract.

C. exchange – A trading venue or mechanism, not an instrument that fixes price.

D. hedge – Refers to the strategy or position; it is not the specific contract that delivers the fixed price.

1. Hull

J. C. Options

Futures and Other Derivatives

10th ed.

Pearson

2018

Chapter 7 “Swaps

” pp. 146–148 – explains commodity swaps used to lock in jet-fuel prices.

2. Carter

D.; Rogers

D.; Simkins

B. “Does Fuel Hedging Make Economic Sense? The Case of the U.S. Airline Industry.” Financial Management

2006

35(1)

pp. 53–55. DOI:10.1111/j.1755-053X.2006.tb00147.x – documents airlines’ use of fuel swap contracts to fix future costs.

3. MIT OpenCourseWare

15.437 Options and Futures Markets

Lecture 12 slides “Commodity Swaps

” slide 9 – gives example of airlines employing jet-fuel swaps to lock in prices.

The diagram illustrates a standard risk categorisation matrix. Box 1, defined by external PESTLE factors, represents Strategic risk. Box 2, concerning internal resources, people, and processes, represents Operational risk. The remaining two primary risk categories are Financial and Hazard.

The matrix positions Box 4 on the same horizontal axis as Box 2, which is explicitly labelled 'Internal'. Therefore, Box 4 must represent a risk category that is primarily viewed as internal in this model. While financial risks have external drivers (e.g., market volatility), this framework categorises them as internal, focusing on risks managed within the organisation, such as ineffective financial controls, poor budgeting, or credit management failures.

A. hazard: While Hazard/Compliance is a valid risk category, in this specific matrix, it is more likely placed in the external quadrant (Box 3) to represent external events like natural disasters.

C. strategic: This category is already represented by Box 1 (External/PESTLE). Placing it in Box 4 would be redundant and contradict the matrix's structure.

The LILAC model, developed by the Institute of Risk Management (IRM), outlines five essential components for embedding a positive risk-aware culture within an organisation. The acronym stands for Leadership, Involvement, Learning, Accountability, and Communication. The model posits that strong leadership commitment and a culture of continuous learning are foundational. Leadership must visibly champion risk management, while the organisation must learn from experiences to improve its risk processes. Option A correctly identifies two of these five core pillars of the model.

B: 'Investment' is not a formal component of the LILAC acronym, although it is necessary to support the framework's elements.

C: 'Appraisal' is not a specific component of the LILAC model, though it is a mechanism for enforcing accountability.

D: 'Information' is not a component of the LILAC model; the correct corresponding element in the acronym is 'Communication'.

1. CIPS. (2019). Managing Supply Chain Risk (L5M2). CIPS Official Course Book. Profex Publishing. Chapter 3: The Need for a Risk Management Culture

Section on 'Models for developing a risk culture'.

2. The Institute of Risk Management (IRM). (2012). Risk Culture: Resources for Practitioners. Page 7

Section: 'The LILAC approach'. Available from IRM publications.

3. Hopkin

P. (2018). Fundamentals of Risk Management: Understanding

Evaluating and Implementing Effective Risk Management. 5th Edition. Kogan Page. Chapter 15: Risk Culture

pp. 229-231. (This text details the IRM's LILAC framework as a key model for developing risk culture).

The principle of contribution applies when an insured party has multiple insurance policies covering the same risk. It dictates that the insured can only claim for the actual value of their loss and cannot profit by receiving full payment from each insurer. The insurers will share the cost of the claim, usually in proportion to the sum insured under each policy. This upholds the fundamental principle of indemnity, which is to restore the insured to the financial position they were in immediately before the loss, not to provide a windfall.

A. Utmost good faith: This principle requires the insured and insurer to disclose all material facts honestly when entering the contract, not how claims are settled.

B. Insurable interest: This principle requires the policyholder to have a financial stake in the insured item, making the policy valid, but doesn't govern claim payouts.

D. Subrogation: This principle allows an insurer, after paying a claim, to pursue the third party who caused the loss to recover the payment.

1. CIPS L5M2 Managing Contractual Risk

Official CIPS Course Book (2019). Chapter 5: ‘Legal Issues’

Section on ‘Principles of Insurance’

pp. 115-117. The text defines contribution as the sharing of a loss between insurers when more than one policy covers the same risk

preventing the insured from recovering more than their total loss.

2. Clarke

M. A. (2017). The Law of Insurance Contracts (8th ed.). Informa Law from Routledge. Chapter 28

‘Contribution’

Section 28-1A

clearly states

"Contribution is the right of an insurer who has paid a loss under a policy to recover a proportionate amount from other insurers who are liable in respect of the same loss."

3. Lowry

J.

& Rawlings

P. (2014). Insurance Law: Doctrines and Principles (3rd ed.). Hart Publishing. Chapter 11

‘Contribution and Subrogation’

pp. 289-292. This chapter explains that contribution is an equitable doctrine that prevents multiple recovery by the insured and distributes the burden of indemnity among the relevant insurers. DOI: https://doi.org/10.5040/9781472561009.ch-011

The image displays the Kraljic Portfolio Purchasing Model. Box 8 represents the 'Strategic' quadrant, which is characterized by high profit impact and high supply risk. Items in this category are critical for the organisation's success and have a complex supply market. The recommended purchasing strategy for this quadrant is to ensure long-term supply availability and manage the relationship closely. A forward contract is a financial instrument that locks in the price and quantity of a commodity for future delivery. This directly mitigates both price volatility (profit impact) and supply uncertainty (supply risk), making it a highly appropriate strategy for managing strategic items.

A. new technology: This is a broad enabler or a potential long-term project, not a direct purchasing strategy for managing an existing high-risk, high-impact supply category.

C. outsource: This is a make-or-buy decision. While it could be part of a larger strategy, it is not in itself a purchasing tactic for managing a specific spend category.

D. insurance: This is a risk transference tool that provides financial compensation after a loss occurs but does not proactively secure the continuity of supply, which is the primary objective.

1. Kraljic

P. (1983). Purchasing Must Become Supply Management. Harvard Business Review

61(5)

pp. 109-117. (The seminal article describes strategies for the strategic quadrant focusing on long-term availability

including long-term contracts and vertical integration).

2. CIPS (Chartered Institute of Procurement & Supply). (2018). Managing Supply Chain Risk (L5M2). CIPS Official Course Book. Profex Publishing

pp. 55-59. (The official CIPS text outlines strategies for the strategic quadrant

emphasizing the need for collaboration

long-term relationships

and securing supply

for which forward contracts are a key tool).

3. Van Weele

A. J. (2018). Purchasing and Supply Chain Management. 7th Edition. Cengage Learning. Chapter 5

Section 5.4

"The Purchasing Portfolio Matrix." (This academic text details the Kraljic matrix and explicitly links strategies like long-term contracts and forward buying to the strategic quadrant to ensure supply security).

The options provided relate to different strategies for managing risk. In a typical risk management matrix, responses are categorized as Avoid, Mitigate (Reduce), Transfer, or Accept. "Insurance" is the most direct and classic example of a Risk Transfer strategy. This approach is used for risks with a low probability but a high potential impact. An organization pays a premium to a third party (an insurer) to shift the financial burden of a potential loss, thereby transferring the risk. While other options can involve risk transfer, insurance is the purest form of this strategy.

A. new technology: This is typically a source of operational change or a tool for risk mitigation, not a fundamental risk response category itself.

B. forward contract: This is a specific financial tool used to transfer price volatility risk, making it a subset of the broader 'Transfer' strategy, not the category itself.

C. outsource: This transfers operational risk to a supplier, but the buying organisation often retains significant reputational and strategic risks. It is a method, but insurance is the archetypal example.

1. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page. In Chapter 6

"Responding to Risk

" Waters outlines the main responses

including risk transfer or sharing

stating

"The most common way of transferring risk is through insurance" (p. 118).

2. Slack

N.

Brandon-Jones

A.

& Johnston

R. (2013). Operations Management. 7th ed. Pearson. Chapter 18

"Operations improvement

" discusses risk management matrices and notes that for low-probability/high-consequence risks

a 'risk transfer' strategy

such as taking out insurance

is appropriate (pp. 578-579).

3. Christopher

M. (2016). Logistics & Supply Chain Management. 5th ed. Pearson. In the context of managing supply chain risk

Christopher discusses resilience strategies. Risk transfer through mechanisms like insurance is identified as a key method for mitigating the financial impact of disruptions (Chapter 10).

The arrangement is not right because it exposes Petra Ltd to an unacceptable level of risk. For a product defined by a critical attribute like "gluten-free," where failure can cause significant harm to consumers and the brand, relying solely on a supplier's pre-shipment tests is insufficient. The clause "deemed accepted by the buyer" upon delivery effectively waives Petra's right to perform its own verification. Best practice in quality management and supply chain risk mitigation dictates that the buyer must retain the ability to conduct goods-in inspection and testing for critical materials. This ensures a final quality check before materials enter the production process, protecting Petra from potential supplier errors or transit-related issues.

A: This is incorrect because while supplier testing reduces some risk, the "deemed accepted" clause removes Petra's own crucial control point, thereby increasing the overall risk of failure.

B: This is incorrect as the "deemed accepted" clause effectively transfers the risk of non-conforming materials from the supplier to Petra the moment the delivery is made.

D: This is an overly drastic and premature action. The core supplier relationship may be sound; the unacceptable clause should be renegotiated rather than voiding the entire contract.

1. Lysons

K.

& Farrington

B. (2020). Procurement and Supply Chain Management (10th ed.). Pearson. Chapter 11

'Quality Management

' discusses the importance of inspection and testing of incoming goods as a fundamental part of the buyer's quality control process. It states that "inspection is concerned with checking materials

products or services to see if they conform with the specification" (p. 298)

a step which Petra would be forgoing.

2. Baily

P.

Farmer

D.

Crocker

B.

Jessop

D.

& Jones

D. (2015). Procurement

Principles & Management (11th ed.). Pearson. Chapter 10

'Quality

and Supplier Evaluation and Performance

' emphasizes the buyer's responsibility for ensuring conformance. It details methods like acceptance sampling and 100 per cent inspection at goods-in

highlighting that verification by the buyer is a standard and necessary procedure for managing quality risk (pp. 205-207).

3. CIPS (Chartered Institute of Procurement & Supply). (2018). Managing Supply Chain Risk (L5M2) Study Guide. Profex Publishing. The guide emphasizes that robust risk mitigation strategies include implementing controls at various points in the supply chain. Relying solely on a supplier's assurance without verification is contrary to the principles of proactive risk management

especially for critical supplies that directly impact consumer safety and product integrity (Section 2.3: The role of quality management in managing supply chain risk).

The question asks to identify the type of risk that belongs in Box 2 of the likelihood/impact matrix, which represents risks with both High Likelihood and High Impact. This quadrant contains the most critical risks that an organisation faces, often considered intolerable and requiring immediate avoidance or reduction strategies.

Among the given options, 'hazard' is the most appropriate fit. In risk management, particularly from a health, safety, and environmental perspective, a hazard that has a high likelihood of occurring and would result in a high-impact consequence (e.g., fatality, major environmental damage) is deemed an intolerable risk. The primary strategy for such risks is avoidance—ceasing the activity or fundamentally re-engineering the process to eliminate the hazard.

B. financial: Financial risks (e.g., currency fluctuations, credit default) vary in likelihood and impact and are typically managed through hedging or diversification, not always complete avoidance.

C. strategic: Strategic risks are often taken intentionally to achieve objectives (e.g., entering a new market). They are managed and monitored, not necessarily classified as hazards to be avoided.

D. operational: While some operational risks can be high/high (e.g., critical supplier failure), many are inherent to business-as-usual and are managed through controls and contingency plans to an acceptable level.

1. ISO 31000:2018

Risk management — Guidelines. This international standard outlines the risk management process. In section 6.5.2 'Selection of risk treatment options

' it is established that 'avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk' is a primary option

which is most applicable to risks assessed as having extremely high likelihood and impact.

2. Health and Safety Executive (HSE). (2001). Reducing risks

protecting people (R2P2). London: HSE Books. This official UK government publication discusses the concept of tolerability of risk. It explicitly defines a region of risk that is "intolerable" and cannot be justified in any ordinary circumstances (p. 10

para 39). High-likelihood

high-consequence hazards fall squarely into this intolerable region

reinforcing the choice.

3. Hopkin

P. (2018). Fundamentals of Risk Management: Understanding

Evaluating and Implementing Effective Risk Management. 5th ed. Kogan Page. This text

aligned with CIPS curriculum principles

describes the top-right quadrant of the risk matrix as containing risks that "will require immediate action" and where the response may be to "terminate the activity" (i.e.

avoidance). This aligns best with the concept of an intolerable hazard.

Sourcing from low-cost countries (LCCS) introduces specific and heightened risks due to differing regulatory, social, and political environments. Reputational risks are significant, as organisations can be associated with unethical practices in their supply chain, such as poor labour standards or environmental damage, which can severely harm their brand image. Geopolitical risks are also a primary concern, stemming from potential political instability, changes in trade policy, tariffs, or unforeseen government interventions in the source country. These factors can lead to severe supply chain disruptions and are characteristic challenges of operating in many low-cost sourcing destinations.

A. operational risks: While operational risks like longer lead times and quality control exist, they are a general feature of any extended supply chain, not a risk uniquely pronounced by LCCS compared to reputational and geopolitical threats.

D. financial risks: The primary driver for LCCS is financial gain (cost reduction). While risks like currency fluctuation exist, they are inherent to all international trade, and the most defining risks of LCCS are non-financial.

1. CIPS Official Course Book

L5M2 - Managing Supply Chain Risk. The syllabus and official texts for this module extensively cover the unique risks of global sourcing. The PESTLE (Political

Economic

Social

Technological

Legal

Environmental) analysis framework is often used to categorise these external risks. 'Political' factors directly correspond to geopolitical risk

while 'Social' and 'Environmental' factors are primary drivers of reputational risk

especially concerning Corporate Social Responsibility (CSR) failures in LCCS. (Note: Specific page numbers vary by edition

but this is a core concept in the global sourcing and risk categorisation chapters).

2. Christopher

M. (2016). Logistics & Supply Chain Management (5th ed.). Pearson. Chapter 8

"Managing Risk in the Supply Chain

" discusses how global sourcing extends supply chains and exposes them to higher levels of risk

specifically highlighting political and social volatility as key concerns that can lead to reputational damage and disruption.

3. Manners-Bell

J. (2017). Supply Chain Risk Management: Understanding Emerging Threats to Global Supply Chains (2nd ed.). Kogan Page. The book details various categories of supply chain risk

with dedicated analysis of geopolitical threats (e.g.

trade policy

instability) and reputational risks arising from CSR and ethical sourcing failures

particularly in the context of sourcing from developing economies. (See Chapter 3: 'Geopolitical threats to supply chains' and Chapter 6: 'Corporate social responsibility').

The question likely refers to a risk categorisation model used in supply chain management. In this context, risks are often grouped into major categories. 'Environmental' risk is a primary category of external, or macro-environmental, risk that can impact the supply chain. This category is analysed using frameworks like PESTLE (Political, Economic, Social, Technological, Legal, Environmental). It encompasses factors such as climate change, natural disasters, pollution, and sustainability regulations, which are beyond the direct control of the organisation but have significant potential impact.

A. strategic: This is a category of internal risk, relating to an organisation's long-term objectives, business decisions, and overall management direction.

B. intellectual property: This is a specific sub-type of risk, often classified under operational or legal risk, not a broad, top-level category like 'environmental'.

D. operational: This is a major category of internal risk that arises from failures in an organisation's day-to-day processes, systems, people, or procedures.

1. CIPS (Chartered Institute of Procurement & Supply). (2019). Managing Supply Chain Risk (L5M2). CIPS Official Course Book. Profex Publishing. In Chapter 2

"Understand and analyse the types of risk that can impact supply chains

" the text distinguishes between internal risks (e.g.

operational

strategic) and external risks

for which the PESTLE framework is a primary analytical tool. The 'Environmental' factor is a key component of this external analysis.

2. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page. Chapter 4

"Identifying Risks

" categorises risks into sources

including 'environmental risks' (arising from the organisation's external environment) and 'organisational risks' (arising from within the organisation

such as operational and strategic risks).

3. Christopher

M. (2016). Logistics & Supply Chain Management (5th ed.). Pearson. Chapter 8

"Managing Risk in the Supply Chain

" discusses sources of risk

identifying environmental uncertainty (macro-level factors like political or economic shifts) as a major external driver of risk

distinct from internal process or control risks.

The risk management process follows a structured, sequential methodology. Risk analysis is a foundational stage within the broader risk assessment process. It involves developing a detailed understanding of the risk by determining its sources, consequences, and the likelihood of those consequences. The outputs of this analysis (e.g., the level of risk) are then used in the subsequent stage, risk evaluation, to make decisions about the significance of the risk and whether it requires treatment. Therefore, among the options provided, risk analysis must be performed before a risk can be evaluated, treated, or monitored effectively.

A. evaluate risk: This stage follows risk analysis. It uses the information from the analysis to compare against risk criteria and determine the risk's significance.

B. treat risk: This is the implementation stage that occurs only after a risk has been analysed and evaluated as unacceptable or requiring mitigation.

C. monitor risk: This is an ongoing activity that reviews the effectiveness of risk treatments and tracks changes, occurring after the initial assessment and treatment stages.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines.

Clause 6.4

"Risk assessment

" explicitly defines the sub-processes in order: "Risk assessment is the overall process of risk identification

risk analysis and risk evaluation." This places risk analysis (6.4.3) before risk evaluation (6.4.4).

Clause 6.5

"Risk treatment

" and Clause 6.6

"Monitoring and review

" are presented as subsequent stages that follow the completion of the risk assessment.

2. CIPS. (2018). L5M2 Managing Supply Chain Risk: Course Book. Profex Publishing Limited.

Chapter 3

"The risk management process

" outlines the sequence as: 1. Risk Identification

2. Risk Analysis

3. Risk Evaluation

4. Risk Treatment. This official CIPS text confirms that analysis precedes evaluation and treatment.

3. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page Publishers.

Chapter 4

"Risk Management

" pp. 59-61

describes the risk management cycle. The process is illustrated as a flow where 'Analyse Risks' is the step immediately following 'Identify Risks' and preceding 'Evaluate Risks' and 'Treat Risks'.

The Companies (Miscellaneous Reporting) Regulations 2018 introduced several new reporting requirements to enhance corporate governance transparency in the UK. A key provision, amending the Companies Act 2006, mandates that UK-registered companies with more than 250 employees must include a specific statement in their annual Directors' Report. This statement must describe the actions taken to engage with employees, how the directors have considered employee interests, and the effect of this consideration on the principal decisions made by the company during the financial year. This requirement aims to ensure that the employee voice is considered at the board level.

A. Publish an Anti-Slavery Policy: This is a requirement under the Modern Slavery Act 2015 for organisations with a turnover of £36 million or more, not the 2018 Miscellaneous Reporting Regulations.

B. Provide an annual financial statement: This is a fundamental and long-standing requirement for most companies under the Companies Act 2006, not a new provision specific to the 2018 regulations.

C. Demonstrate how they abide by Environmental practices: While these regulations did introduce Streamlined Energy and Carbon Reporting (SECR), option D is a more direct and specific corporate governance requirement introduced for this employee threshold.

1. The Companies (Miscellaneous Reporting) Regulations 2018

SI 2018/860. Part 4

Regulation 10 amends the Large and Medium-sized Companies and Groups (Accounts and Reports) Regulations 2008 to insert a new requirement (Schedule 7

paragraph 11) for a statement on employee engagement. Available at: https://www.legislation.gov.uk/uksi/2018/860/regulation/10/made

2. Explanatory Memorandum to The Companies (Miscellaneous Reporting) Regulations 2018. Section 7.4 explicitly states: "This instrument also introduces a new requirement for companies with more than 250 UK employees to include a statement in the directors’ report summarising how the directors have engaged with employees and how they have had regard to employee interests." Available at: https://www.legislation.gov.uk/uksi/2018/860/memorandum/contents

3. Financial Reporting Council (FRC). (2018). Guidance on the Strategic Report. This guidance was updated to reflect the 2018 regulations and provides context on the new reporting requirements

including the Section 172 statement and specific employee engagement disclosures (Paragraphs 7.30-7.33). Available via the FRC website.

The 'Treat' risk control strategy, also known as risk mitigation or reduction, involves implementing specific actions and controls to reduce the likelihood of a risk occurring or to minimise its potential impact on the organisation. The question's description of developing actions to "minimise the impact" is the core definition of treating a risk. This proactive approach aims to lessen the severity of the consequences should the risk event materialise, aligning perfectly with the 'Treat' response.

A. tolerate: This strategy involves accepting the risk and its potential consequences without taking any action. It is a passive approach, contrary to the active development of actions described.

C. transfer: This involves shifting the financial consequences of a risk to a third party, such as through insurance, but it does not minimise the operational impact of the event itself.

D. terminate: This strategy, also known as risk avoidance, involves eliminating the risk entirely by ceasing the activity that generates it, rather than managing its potential impact.

1. CIPS (2018). Managing Supply Chain Risk (L5M2). Stamford

UK: Chartered Institute of Procurement & Supply. Chapter 4: Risk Mitigation and Management

Section on 'The 4Ts model'

pp. 89-91. (This section explicitly defines 'Treat' as taking action to reduce the probability and/or impact of a risk).

2. ISO 31000:2018. Risk management — Guidelines. International Organization for Standardization. Section 6.5.2

"Selection of risk treatment options

" describes options for modifying the risk

which aligns with the 'Treat' concept of implementing controls to change the consequences (impact).

3. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. London: Kogan Page. Chapter 7

"Responding to risk

" details risk reduction (treatment) as actions taken to lower the probability or consequences of adverse events.

The scenario describes a drop in share price and high levels of Work-in-Progress (WIP). A drop in share price is a direct manifestation of financial risk, as it impacts the company's market valuation and shareholder wealth. High WIP also represents a significant financial risk because it ties up working capital, increases holding costs, and can lead to obsolescence, negatively affecting cash flow and profitability. While the trigger is a logistical failure (late deliveries), the resulting consequences described for the business are primarily financial in nature.

B. logistical: This is the source or cause of the problem (late supplier deliveries), not the resulting risk category that includes a drop in share price and capital being tied up.

C. opportunity: This risk relates to the potential loss from forgoing an alternative course of action, which is not the direct problem described in the scenario.

D. reputation: While ongoing supply issues can eventually harm a company's reputation, the question highlights immediate and quantifiable financial impacts, making 'financial' the most precise answer.

1. CIPS (Chartered Institute of Procurement & Supply). (2018). Managing Supply Chain Risk (L5M2). Stamford

UK: Profex Publishing. In the section on 'Categories of Risk

' financial risks are defined as those pertaining to the financial health and viability of the organisation. This includes risks to profitability

cash flow

and shareholder value (which is directly impacted by share price). High WIP is a working capital issue

which falls under financial risk management. (Specific chapter on risk categorisation).

2. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. London: Kogan Page. Chapter 2

"Types of Risk

" categorises risks and explains how operational disruptions (like late deliveries) translate directly into financial risks

such as increased costs (from holding WIP) and reduced revenue

ultimately affecting company valuation.

3. Chopra

S.

& Sodhi

M. S. (2004). Managing Risk to Avoid Supply-Chain Breakdown. MIT Sloan Management Review

46(1)

53-61. This article discusses how supply chain disruptions (a form of logistical risk) create significant financial consequences for a firm

including impacts on stock price and increased working capital requirements

reinforcing the link between the logistical cause and the financial effect.

Logistics risks are those associated with the movement and storage of goods through the supply chain. Extended supply chains, by definition, span greater geographical distances, cross more borders, and involve a higher number of handling points and transportation modes. This inherent complexity and length directly increase the exposure to potential disruptions. Key logistical risks such as transportation delays, damage to goods during transit, customs clearance issues, and loss of inventory are all magnified as the supply chain becomes longer and more fragmented. Therefore, the extension of supply chains is a fundamental and direct cause of increased logistics risk.

A. heightened ethical standards: This is a driver of compliance and reputational risk, influencing sourcing decisions rather than directly causing a physical disruption in the flow of goods.

B. customer expectations: High expectations (e.g., for faster delivery) can increase the pressure on logistics operations and amplify the impact of a failure, but they do not cause the failure itself.

D. economic instability: This is a broad, macro-environmental risk that affects the entire supply chain (e.g., currency, supplier viability), not a specific structural cause of logistics risk like distance.

1. Christopher

M. (2016). Logistics & Supply Chain Management. 5th ed. Pearson. In Chapter 8

"Managing Risk in the Supply Chain

" Christopher explicitly links the trend towards global sourcing with the creation of "long and thin" or extended supply chains

which are inherently more vulnerable to disruption due to longer lead times and reduced visibility (pp. 210-212).

2. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. 2nd ed. Kogan Page. Chapter 3

"Sources of Risk

" identifies risks within the supply chain

noting that complexity is a major driver. Extended supply chains are a prime example of increased complexity

leading to higher chances of transport delays

infrastructure failures

and other logistical problems (pp. 45-48).

3. Chopra

S.

& Sodhi

M. S. (2004). Managing Risk to Avoid Supply-Chain Breakdown. MIT Sloan Management Review

46(1)

53-61. The article identifies globalization as a major factor increasing supply chain risk. Globalization leads to extended supply chains

which are more susceptible to disruptions from a variety of sources

including natural disasters

geopolitical instability

and transportation failures (p. 54).