Build and manage a live supply chain risk register — score likelihood and impact, get RAG status and log mitigations. Plus an interactive guide to risk categories, the 5x5 matrix and mitigation strategies for CIPS exam prep.
Supply chain risk management is not a separate activity — it runs through every procurement decision. Selecting a single-source supplier, accepting a long lead time, choosing a low-cost country — each is a risk decision. The CIPS framework expects procurement professionals to identify, assess, prioritise and mitigate risk systematically, not reactively.
Risk can be quantified — we know the probability and impact. Uncertainty cannot be quantified because we don't know what we don't know (unknown unknowns). Knight (1921) made this distinction. CIPS expects you to know it. Black swan events (Taleb) represent extreme uncertainty — low probability, catastrophic impact — and cannot be fully managed through standard risk registers.
| Score range | RAG status | Typical response |
|---|---|---|
| 1–4 | Green | Accept — monitor periodically. Low priority. |
| 5–9 | Amber | Reduce or monitor closely — assign risk owner, review quarterly. |
| 10–14 | Amber / High | Treat urgently — develop and implement mitigation plan. |
| 15–25 | Red | Immediate action required — escalate to senior management, implement controls now. |
Inherent risk is the risk before any controls or mitigations are applied. Residual risk is the risk that remains after mitigations. Your risk register should show both — the gap between them demonstrates the value of your controls. CIPS expects you to know that residual risk is never zero — the goal is to reduce it to an acceptable level.
| Risk type | Typical mitigations | 4T response |
|---|---|---|
| Single-source supplier | Dual/multi-sourcing, approved vendor list development, safety stock, make-or-buy review | Treat / Terminate |
| Geopolitical / country risk | Nearshoring, supply chain mapping, country risk scoring, alternative sourcing strategy | Treat / Terminate |
| Financial failure of supplier | Financial health checks (Dun & Bradstreet), parent company guarantee, advance payment bond, step-in rights in contract | Transfer / Treat |
| Currency / FX risk | Currency hedging, Incoterms selection, invoicing in home currency, FX clauses in contract | Transfer / Treat |
| Quality failure | Supplier audits, incoming inspection, approved manufacturer list, right of rejection clauses, warranty/liability clauses | Treat / Transfer |
| Demand volatility | Flexible contracts, call-off agreements, safety stock, demand forecasting, collaboration with stakeholders | Treat / Tolerate |
| Logistics / transport disruption | Multiple carrier relationships, safety stock, port diversification, alternative routing, Incoterms review | Treat |
| Cyber / data risk | Supplier cyber security assessments, contract data protection clauses, ISO 27001 requirements, incident response plan | Transfer / Treat |
| Regulatory / compliance | Legal monitoring, contract update clauses, compliance audits, GDPR/Modern Slavery Act due diligence | Treat / Terminate |
| Reputational / ESG risk | Supplier code of conduct, ethical audits, Modern Slavery Act compliance, Scope 3 emissions monitoring | Treat / Terminate |
A common exam mistake is treating insurance as removing a risk. Insurance transfers the financial consequence — it does not reduce likelihood or prevent the event. Always distinguish between risk transfer (insurance, Incoterms, liability clauses) and risk reduction (controls, dual sourcing, audits). In your exam answers, be specific about what mechanism achieves what outcome.
ProcurePass (Level 4) or PassLevel5 (Level 5) for £9.99, distance learning for £150 a level, or live online classes with Tim Young FCIPS for £500 a level. Level 6 classes are free — live online, Thursday evenings.