L5M2 Practice Questions

The Sarbanes-Oxley Act (SOX), specifically Section 404, mandates that the management of public companies establish and maintain an adequate internal control structure for financial reporting. A fundamental principle of effective internal controls is the separation of duties (also known as segregation of duties). This principle is a key control activity designed to prevent fraud and error by ensuring that no single individual has control over all aspects of a transaction. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, which is the most widely used framework for SOX compliance, explicitly identifies separation of duties as a critical control activity.

B. ethical business practices: This is a broad outcome of SOX (e.g., Section 406 Code of Ethics), but 'separation of duties' is a more specific, mandated internal control mechanism.

C. elimination of bribery: This is the primary objective of specific anti-corruption laws like the U.S. Foreign Corrupt Practices Act (FCPA), not the Sarbanes-Oxley Act.

D. environmental protection: This falls under the purview of separate environmental legislation and regulatory bodies and is outside the financial reporting scope of SOX.

1. U.S. Securities and Exchange Commission (SEC). (2003). Final Rule: Management's Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports. Release No. 33-8238. Section II.A.2

"The Framework for Evaluation

" states that management must base its evaluation on a suitable

recognized control framework

citing the COSO framework as an example. Available at: https://www.sec.gov/rules/final/33-8238.htm

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary. Page 6. The framework outlines "Control Activities" as one of the five essential components of internal control. The detailed principles supporting this component explicitly include the "segregation of duties."

3. Ramos

M. (2004). Auditor's Responsibility for Fraud Detection. Journal of Accountancy

American Institute of Certified Public Accountants (AICPA). This article discusses how SOX increased auditor responsibilities and emphasizes the importance of internal controls like segregation of duties in preventing and detecting fraud.

4. Grama

J. L. (2015). Legal and Privacy Issues in Information Security. Jones & Bartlett Learning. Chapter 2

"Laws and Regulations

" clearly distinguishes the purpose of SOX (financial reporting integrity) from the purpose of the FCPA (prohibiting bribery of foreign officials).

The Poisson distribution is the most appropriate methodology. It is a discrete probability distribution used to model the number of times an event occurs within a specified interval of time or space. In this scenario, the 'event' is a supplier's failure to deliver, and the 'interval' is a two-day period. The Poisson distribution is ideal for calculating the probability of such occurrences, assuming they happen independently and at a constant average rate. It is a standard tool in operations and supply chain management for modeling events like equipment failures, customer arrivals, or, as in this case, delivery failures.

A. value at risk: This is a financial risk management tool that measures potential monetary loss on an investment, not the probability of an operational failure.

B. normal distribution: This is a continuous probability distribution used for variables that can take any value, not for discrete, countable events like the number of delivery failures.

C. binomial distribution: This models the number of successes in a fixed number of independent trials (e.g., defective items in a batch), not the number of events over a time continuum.

1. Chopra

S.

& Meindl

P. (2016). Supply Chain Management: Strategy

Planning

and Operation (6th ed.). Pearson. Chapter 12 discusses the use of probability distributions for managing safety inventory

where Poisson is cited for modeling demand or failure events over time.

2. Stevenson

W. J. (2018). Operations Management (13th ed.). McGraw-Hill Education. In the chapter on "Queuing

" the Poisson distribution is presented as the primary model for the arrival rate of events (e.g.

customers

jobs

or failures) in a system over time (Section 18-3

pp. 798-799).

3. MIT OpenCourseWare. (2006). 15.762J / ESD.262J Supply Chain Planning. Fall 2006. Lecture notes on "Inventory Management I" introduce the Poisson distribution as a model for demand when it is intermittent or involves a low number of discrete units per period

analogous to modeling failures.

The options provided relate to different strategies for managing risk. In a typical risk management matrix, responses are categorized as Avoid, Mitigate (Reduce), Transfer, or Accept. "Insurance" is the most direct and classic example of a Risk Transfer strategy. This approach is used for risks with a low probability but a high potential impact. An organization pays a premium to a third party (an insurer) to shift the financial burden of a potential loss, thereby transferring the risk. While other options can involve risk transfer, insurance is the purest form of this strategy.

A. new technology: This is typically a source of operational change or a tool for risk mitigation, not a fundamental risk response category itself.

B. forward contract: This is a specific financial tool used to transfer price volatility risk, making it a subset of the broader 'Transfer' strategy, not the category itself.

C. outsource: This transfers operational risk to a supplier, but the buying organisation often retains significant reputational and strategic risks. It is a method, but insurance is the archetypal example.

1. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page. In Chapter 6

"Responding to Risk

" Waters outlines the main responses

including risk transfer or sharing

stating

"The most common way of transferring risk is through insurance" (p. 118).

2. Slack

N.

Brandon-Jones

A.

& Johnston

R. (2013). Operations Management. 7th ed. Pearson. Chapter 18

"Operations improvement

" discusses risk management matrices and notes that for low-probability/high-consequence risks

a 'risk transfer' strategy

such as taking out insurance

is appropriate (pp. 578-579).

3. Christopher

M. (2016). Logistics & Supply Chain Management. 5th ed. Pearson. In the context of managing supply chain risk

Christopher discusses resilience strategies. Risk transfer through mechanisms like insurance is identified as a key method for mitigating the financial impact of disruptions (Chapter 10).

The FIDIC Yellow Book, formally the "Conditions of Contract for Plant and Design-Build," is the most suitable contract for an offshore wind project. This type of project is a complex engineering undertaking where the contractor is responsible for both designing the facility (e.g., turbine foundations, array layout, electrical systems) and executing the works, which includes procuring and installing major plant and equipment (e.g., wind turbines, substations). The Yellow Book is specifically structured for such design-build arrangements, where the contractor delivers a turnkey project based on the employer's requirements.

A. Construction Contract: This contract (the Red Book) is used when the employer provides the design, which is unsuitable for complex projects like offshore wind where contractor design expertise is critical.

B. Measured Term Contract: This is for recurring maintenance or minor works over a set period, not for a large-scale, new-build capital project.

C. Minor Works Contract: This contract (the Green Book) is intended for simple, short-duration, and low-value projects, making it entirely inappropriate for a major infrastructure project.

1. FIDIC (International Federation of Consulting Engineers). (2017). Conditions of Contract for Plant and Design-Build (2nd ed.

Yellow Book). In the introduction and guidance notes

the book is described as suitable for the provision of electrical and mechanical plant and for the design and execution of building or engineering works

where the contractor takes on the majority of the design responsibility. This aligns perfectly with the scope of an offshore wind project.

2. Bunni

N. G. (2013). The FIDIC Forms of Contract (4th ed.). Wiley-Blackwell. Chapter 4

"The FIDIC Suite of Agreements and Contracts

" explains that the Yellow Book is intended for projects where the contractor has a dual obligation to design and build the works

a common model for power plants and complex industrial facilities.

3. Glover

J. (2015). FIDIC Contracts: Law and Practice. Informa Law from Routledge. The text differentiates the contract forms

specifying that the Yellow Book is the standard choice for EPC (Engineering

Procurement

and Construction) or turnkey projects where the contractor

not the employer

is responsible for the design to meet a performance specification. Offshore wind farms are typically procured on this basis.

The question refers to the 11 guiding principles of the ISO 31000:2009 standard. According to this standard, effective risk management should:

1. Create and protect value (A).

2. Explicitly address uncertainty (C).

3. Take human and cultural factors into account (B).

These three options are direct restatements of the core principles outlined in the standard. The goal of these principles is to ensure that risk management is not a standalone activity but an integrated, dynamic, and tailored part of an organisation's governance, strategy, and culture, ultimately contributing to the achievement of its objectives.

D. Risk Management should be done annually: This is incorrect. A key principle is that risk management must be dynamic, iterative, and responsive to change, not confined to a rigid annual schedule.

E. Risk Management should include only the Departments affected by risk: This is incorrect. The standard mandates that risk management be an integral part of all organisational processes and be inclusive, not siloed within specific departments.

1. International Organization for Standardization. (2009). ISO 31000:2009 Risk management — Principles and guidelines. Clause 3

Principles

pp. 3-4.

2. Lalonde

C.

& Boiral

O. (2012). Managing risks through ISO 31000: A critical analysis. Risk Management

14(4)

272–300. (The 11 principles are listed and discussed on p. 275). https://doi.org/10.1057/rm.2012.9

3. Purdy

G. (2010). ISO 31000:2009—Setting a new standard for risk management. Risk Analysis: An International Journal

30(6)

881-886. (Discusses the principles

including value creation

addressing uncertainty

and human/cultural factors on pp. 882-883). https://doi.org/10.1111/j.1539-6924.2010.01442.x

The statement that the US FCPA is more far-reaching than the UK Bribery Act 2010 is incorrect. The UK Bribery Act is widely considered one of the strictest and most extensive anti-corruption laws globally. A key reason for this is the introduction of the corporate offence of 'failure of a commercial organisation to prevent bribery' under Section 7. This creates strict liability for bribery committed by an 'associated person' (including third-party agents, subsidiaries, and contractors) acting on the organisation's behalf, anywhere in the world. While the FCPA also has provisions for third-party liability, the UK Act's 'failure to prevent' offence establishes a broader and more stringent basis for corporate accountability.

A: This is factually incorrect. The UK Bribery Act covers both public and private (commercial) bribery, whereas the FCPA's anti-bribery provisions are focused specifically on the bribery of foreign public officials.

B: An exemption for facilitation payments makes a law less strict, not more far-reaching. The UK Bribery Act has no such exemption, making it stricter than the FCPA on this point.

D: This is misleading. The UK Bribery Act does account for facilitation payments by making them illegal without exception. The FCPA, by contrast, has a narrow exemption for such payments.

1. UK Ministry of Justice. (2011). The Bribery Act 2010 - Guidance about procedures which relevant commercial organisations can put in place to prevent persons associated with them from bribing. Page 10

Paragraph 36 states

"The Act is also wider than previous legislation as it creates a new offence of failure of a commercial organisation to prevent bribery... This addresses the question of corporate liability for bribery." Page 24

Paragraph 81 clarifies that 'associated persons' is a broad term covering those who perform services for the organisation

including agents and subsidiaries.

2. U.S. Department of Justice and U.S. Securities and Exchange Commission. (2020). A Resource Guide to the U.S. Foreign Corrupt Practices Act

Second Edition. Page 25 discusses the narrow exception for "Facilitating or Expediting Payments" for "routine governmental action

" a provision not present in the UK Bribery Act. Pages 21-22 discuss liability for third-party agents

which is typically based on a "knowing" state of mind

a different standard from the UK's strict liability 'failure to prevent' offence.

3. Ryder

N. (2011). The UK Bribery Act 2010: A British Revolution?. Journal of Financial Crime

18(4)

pp. 339-351. https://doi.org/10.1108/13590791111173686. This article compares the two acts

noting the UK Act's broader scope

including its application to private-sector bribery and the creation of the Section 7 corporate offence

which it describes as a "revolutionary" and far-reaching provision.

Appraisal costs are incurred to determine the degree of conformance to quality requirements. They involve measuring, evaluating, or auditing products to assure they meet quality standards before reaching the customer. Quality control inspections are a primary example of an appraisal activity, as their purpose is to detect non-conforming products, such as those with dangerous small parts, before they are shipped. This directly addresses the company's need to mitigate the risk of poor quality by identifying defects during or after the production process but before market entry. The other options represent prevention costs, which are aimed at stopping defects from occurring in the first place.

B: A pro-active quality management system is a prevention cost, as it focuses on designing processes to avoid defects from the outset.

C: A 'zero defects' approach is a prevention-oriented philosophy aimed at eliminating the root causes of errors, making it a prevention cost.

D: Staff training is a classic prevention cost, incurred to equip employees with the skills to produce high-quality products and prevent errors.

1. CIPS. (2018). Managing Supply Chain Risk (L5M2). Profex Publishing. In the section on 'The cost of quality' (Chapter 5)

appraisal costs are defined to include inspection

testing

and other activities to detect defects. Prevention costs are defined to include quality planning

training

and process control.

2. Slack

N.

Brandon-Jones

A.

& Johnston

R. (2016). Operations Management. 8th ed. Pearson Education. In Chapter 17

'Quality Management'

the authors classify costs of quality. They explicitly list 'Inspection' and 'Testing' under Appraisal Costs

while 'Quality planning'

'Process control'

and 'Training' are listed under Prevention Costs (p. 568

Table 17.1).

3. Dale

B. G.

& Plunkett

J. J. (1999). Quality Costing. 3rd ed. Gower Publishing

Ltd. Chapter 2

'The A. V. Feigenbaum approach to quality costing'

categorises 'inspection and test of incoming material'

'product inspection and test'

and 'materials and services consumed' as typical appraisal cost elements. In contrast

'quality planning' and 'quality training' are classified as prevention costs.

SWOT analysis is a strategic planning framework used to evaluate an organisation's competitive position. It stands for Strengths, Weaknesses, Opportunities, and Threats. The framework is explicitly divided into two dimensions: internal and external. Strengths and Weaknesses are internal factors that originate within the organisation itself. Opportunities and Threats are external factors arising from the macro-environment. By identifying internal Weaknesses and external Threats, this model provides a comprehensive structure for exploring both internal and external risks to a business.

A. Porter's 5 Forces: This model is used for industry analysis, focusing exclusively on external competitive pressures and does not assess a company's internal factors.

B. STEEPLE: This is a macro-environmental analysis tool that examines only external factors (Social, Technological, Economic, etc.) and does not consider internal risks.

D. Poisson Distribution: This is a statistical tool used to model the frequency of events over a specific period, not a strategic framework for identifying the sources of business risks.

1. Chartered Institute of Procurement & Supply. (2018). Managing Supply Chain Risk (L5M2). CIPS Profex Study Guide. Chapter 2: Risk and the Supply Chain

Section 3: Risk Identification. The guide details SWOT as a tool for assessing internal strengths/weaknesses and external opportunities/threats.

2. Johnson

G.

Whittington

R.

Scholes

K.

Angwin

D.

& Regnér

P. (2017). Exploring Strategy (11th ed.). Pearson Education. Chapter 3

Section 3.5

"SWOT

" pp. 82-84. The text explicitly states

"SWOT summarises the key issues from the business environment and the strategic capability of an organisation that are most likely to impact strategy development." It clearly delineates Strengths/Weaknesses as internal and Opportunities/Threats as external.

3. Hill

C. W. L.

& Jones

G. R. (2012). Strategic Management: An Integrated Approach (10th ed.). Cengage Learning. Chapter 3

"Internal Analysis: Distinctive Competencies

Competitive Advantage

and Profitability

" pp. 99-101. This chapter describes SWOT as a methodology to align a company's internal resources and capabilities (Strengths and Weaknesses) with the external opportunities and threats in its environment.

The Deming Cycle, also known as the Plan-Do-Check-Act (PDCA) cycle, is a four-stage iterative model for continuous improvement. The final stage is 'Act'. In this stage, actions are taken based on the results of the 'Check' stage to address differences between actual and planned outcomes. If the change was successful, it is standardized and implemented. If not, the cycle begins again with new planning. The ISO 9001:2015 standard for quality management systems is explicitly based on the PDCA cycle, with Clause 10, 'Improvement', directly corresponding to the 'Act' stage, which focuses on implementing actions to achieve improvement.

A. Improve: This is the goal or outcome of the 'Act' stage, not the name of the stage itself. 'Act' is the more precise term for the process step.

B. Review: This activity is a core component of the 'Check' stage, where performance and results are monitored and compared against the objectives set in the 'Plan' stage.

D. Assess: This is synonymous with 'Check' or 'Review'. It involves evaluating performance and is part of the 'Check' stage, not the final stage of the cycle.

1. International Organization for Standardization (ISO). (2015). ISO 9001:2015 Quality management systems — Requirements. Section 0.3.2

"Plan-Do-Check-Act cycle". This section explicitly describes the four stages: "Plan... Do... Check... Act...". It maps the standard's clauses to the cycle

with Clause 10 (Improvement) corresponding to the 'Act' stage.

2. Sokovic

M.

Pavletic

D.

& Pipan

K. K. (2010). Quality Improvement Methodologies–PDCA Cycle

RADAR Matrix

DMAIC and DFSS. Journal of Achievements in Materials and Manufacturing Engineering

43(1)

476-483. On page 478

the paper defines the final stage: "Act: Adopt the change

or abandon it

or run through the cycle again."

3. Deming

W. E. (2000). The New Economics: For Industry

Government

Education (2nd ed.). MIT Press. In Chapter 4

Deming describes the "Shewhart Cycle for Learning and Improvement—the PDSA Cycle" (Plan-Do-Study-Act)

which is the basis for PDCA. The final stage is consistently defined as 'Act'. (Note: Deming later preferred 'Study' over 'Check'

but 'Act' remains the final stage).

Financial-exposure risk arising from inconsistent or extended supplier payment conditions is controlled by harmonising and enforcing common payment terms across the supply base. CIPS identifies “standardising payment terms” as a primary risk-mitigation action for cash-flow and liquidity threats because it increases cost predictability, simplifies administration and improves working-capital planning (CIPS L5M2 Study Guide, ch. 4, pp. 64-65). Therefore box 5, which asks for the risk-control measure, should contain “Standardise Payment Terms”.

A. CSR Policy – addresses reputational/ethical risk, not the financial-payment risk reflected in box 5.

B. Quote in Buyer’s Currency – mitigates exchange-rate risk, not payment-term risk.

C. Force Majeure – deals with catastrophic interruption risk, not liquidity or cash-flow issues.

1. CIPS

“L5M2 Managing Supply Chain Risk”

1st ed.

2019

Chapter 4 “Financial Risks”

pp. 64-65 – lists standardising payment terms as key mitigation.

2. ISO 31000:2018

§6.5 – highlights implementing internal controls (e.g.

standard payment policies) to treat financial risk.

3. Kouvelis

P.

et al. “Finance in Supply Chains.” Foundations and Trends in Technology

Operations & Strategy

2013

Vol. 7(2-3)

pp. 71-72 – discusses payment-term standardisation for liquidity-risk reduction.