Risk, Sustainability, and Compliance
Domain 9 tests risk identification and mitigation, sustainability measurement, and compliance obligations across the supply chain.
Risk and resilience
Use a risk matrix of probability and impact; expected monetary value (EMV) = probability × impact. Keep a risk register with owners, triggers, and mitigation. Common mitigations are dual sourcing, buffer inventory, capacity redundancy, nearshoring, and business continuity plans. Resilience costs money, so compare mitigation cost with residual risk.
Sustainability and compliance
Greenhouse gas reporting separates Scope 1 direct emissions, Scope 2 purchased energy, and Scope 3 value-chain emissions. Scope 3 usually dominates and is hardest to measure. Compliance covers customs, Incoterms, product safety, conflict minerals, forced labor, and data privacy. Due diligence should extend beyond tier 1 suppliers.
Worked example
Supplier A has a 20% disruption probability and $1M impact, so EMV = 0.20×$1M = $200,000. Supplier B has 50% probability and $300,000 impact, so EMV = $150,000. A looks worse by EMV. If mitigation for A costs $50,000 and cuts probability to 5%, residual EMV is 0.05×$1M = $50,000; total $100,000, saving $100,000 versus the original EMV. The reasoning is to compare expected loss with the cost and residual risk of mitigation.
Traps that cost marks
Risk registers without owners; ignoring Scope 3; treating compliance as procurement-only; assuming Incoterms transfer title; claiming green performance without measurement.