Which of the following statements are true about risk management? Select TWO.

Risk management is fundamentally a continuous and iterative process, not a static, one-time activity. The internal and external environments in which an organisation operates are constantly changing, necessitating ongoing identification, analysis, and treatment of risks. Within the context of procurement, effective risk management is critical for ensuring operational continuity. By proactively addressing potential disruptions in the supply chain—such as supplier failure, logistical issues, or geopolitical instability—companies can safeguard the flow of goods and services, thereby ensuring the smooth and successful running of their purchase and supply operations.

A: The objective is to manage and reduce risk to an acceptable level (risk appetite), not to eliminate it, as zero risk is often unachievable or cost-prohibitive.

C: While formal reviews may be periodic, risk management itself is an ongoing, dynamic process integrated into daily operations, not a single annual event.

E: This is an incomplete list of risk responses. The primary strategies also include tolerating (accepting) the risk and terminating (avoiding) the activity that gives rise to the risk.

1. CIPS L5M2 Managing Supply Chain Risk Study Guide (2019)

Chapter 1

Section 3

'The Risk Management Process'. This section describes risk management as a cyclical and continuous process involving stages that are repeated and refined over time

directly supporting option B.

2. CIPS L5M2 Managing Supply Chain Risk Study Guide (2019)

Chapter 1

Section 1

'The Need for Robust Risk Management'. This section explains that a key driver for risk management is to ensure business continuity and the smooth operation of the supply chain

which supports option D.

3. ISO 31000:2018

Risk management — Guidelines

Section 6.5.2

'Selection of risk treatment options'. This international standard explicitly lists multiple options for treating risk

including avoiding the risk

taking or increasing the risk

removing the risk source

changing the likelihood

changing the consequences

sharing the risk

and retaining the risk. This refutes the limited view in option E.

4. Waters

D. (2011). Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page. Chapter 2

'The Nature of Risk'

clarifies that the goal of risk management is not total risk elimination but managing risks to a level that is acceptable to the organisation

which directly contradicts option A. The text also reinforces the concept of risk management as a continuous cycle

refuting option C.