Risk Mitigation, Compliance Management, and Legal Coordination
This domain tests whether you can quantify supply risk, choose a mitigation that fits, and coordinate with legal and compliance without practicing law yourself. Expect scenario questions on risk scoring, contract clauses, Incoterms and third-party compliance exposure.
The risk process
Identify (supplier financial health, single-source exposure, capacity, quality, geography, logistics, cyber, regulatory) → assess → mitigate → monitor. Score likelihood × impact on a 5×5 grid, then dollarize: expected monetary value = probability × impact. Mitigation options are avoid, reduce, transfer (insurance, contract terms, consignment), accept - and monitor residual risk after each.
- Map to sub-tier, not just tier one. A single-source component three levels down is still your disruption.
- Financial health signals: credit and payment behavior, leverage ratios, customer concentration, dependency on you as a share of their revenue.
- Continuity planning: dual sources, strategic buffer, qualified alternate sites, ISO 22301-style business continuity plans, tested recovery times.
Legal coordination - clauses that carry the risk
Scope and specifications, price and adjustment mechanism, Incoterms 2020, title and risk of loss, warranty, indemnification, limitation of liability, liquidated damages, force majeure, termination for convenience and cause, audit rights, IP ownership, confidentiality, governing law and arbitration.
- Incoterms allocate cost and risk, never title. CIF risk passes at shipment; DDP risk passes at destination. Confusing the two moves the loss to your books.
- UCC Article 2 governs domestic US goods contracts; the CISG governs many international goods sales. The battle of the forms means acceptance terms can overwrite your purchase order - control the flow of documents.
- Force majeure does not excuse foreseeable events, and rarely relieves payment obligations.
Compliance
FCPA and UK Bribery Act (strict liability; facilitation payments are not a safe harbour in the UK), sanctions and denied-party screening, export controls (EAR, ITAR, dual-use), customs classification and country of origin, conflict minerals, forced-labor import rules, RoHS/REACH, records retention and data privacy. Controls are third-party due diligence, contractual declarations and audit rights, training and a reporting channel.
Worked example
Single-source valve: 8% annual probability of a six-week disruption costing $250,000 per week = 0.08 × $1.5M = $120,000 expected annual loss. Qualifying a second source costs $90,000 per year. Dual sourcing is the rational mitigation; accepting the risk is defensible only if the $120,000 is below your risk appetite or the mitigation is unaffordable - and either way the decision is documented.
Traps that cost marks
- Presenting a risk register with no dollars attached.
- Treating a supplier's ISO certificate as evidence of sub-tier compliance.
- Assuming force majeure covers a foreseeable supply shortage or a price spike.
- Using Incoterms as a title-transfer mechanism.