CIPS L4M2 Practice Exams
Last updated on Oct 24,2026- Exam Code: L4M2
- Exam Name: Defining Business Needs
- Certification Provider: CIPS
- Latest update: Oct 24,2026
Question #231
Procurement provides the following information to a business case …
- A . Estimated costs of bought-in goods
- B . Engineering specifications
- C . Service level requirements
- D . Internal recruitment requirements
Correct Answer: A
Question #232
Which of the following areas is specified by ISO/IEC 27001 family?
- A . The dimensions and associated tolerances for a series of housings for piston seals
- B . The requirements for an information security management system
- C . Evaluation and assessment of mutual agreed customer food safety requirements
- D . The requirements for an environmental management system
Correct Answer: B
B
Explanation:
ISO/IEC 27001 is widely known, providing requirements for an information security management system (ISMS), though there are more than a dozen standards in the ISO/IEC 27000 family. Using them enables organizations of any kind to manage the security of assets such as financial infor-mation, intellectual property, employee details or information entrusted by third parties. LO 3, AC 3.1
B
Explanation:
ISO/IEC 27001 is widely known, providing requirements for an information security management system (ISMS), though there are more than a dozen standards in the ISO/IEC 27000 family. Using them enables organizations of any kind to manage the security of assets such as financial infor-mation, intellectual property, employee details or information entrusted by third parties. LO 3, AC 3.1
Question #232
Which of the following areas is specified by ISO/IEC 27001 family?
- A . The dimensions and associated tolerances for a series of housings for piston seals
- B . The requirements for an information security management system
- C . Evaluation and assessment of mutual agreed customer food safety requirements
- D . The requirements for an environmental management system
Correct Answer: B
B
Explanation:
ISO/IEC 27001 is widely known, providing requirements for an information security management system (ISMS), though there are more than a dozen standards in the ISO/IEC 27000 family. Using them enables organizations of any kind to manage the security of assets such as financial infor-mation, intellectual property, employee details or information entrusted by third parties. LO 3, AC 3.1
B
Explanation:
ISO/IEC 27001 is widely known, providing requirements for an information security management system (ISMS), though there are more than a dozen standards in the ISO/IEC 27000 family. Using them enables organizations of any kind to manage the security of assets such as financial infor-mation, intellectual property, employee details or information entrusted by third parties. LO 3, AC 3.1
Question #234
A purchaser is looking for alternative supplies if there is a major disruption to their supply chain, including logistics, manufacturing and all support services.
Which of the following method is that purchaser applying?
- A . Treat the risk
- B . Terminate the risk
- C . Tolerate the risk
- D . Transfer the risk
Correct Answer: A
A
Explanation:
Risk control is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects that risk should it occur. CIPS preferred way to determine your risk control strategy is to use the four T’s Process:
Transferring Risk can be achieved through the use of various forms of insurance, or the payment to third parties who are prepared to take the risk on behalf of the organization
Tolerating Risk is where no action is taken to mitigate or reduce a risk. This may be because the cost of instituting risk reduction or mitigation activity is not cost-effective or the risks of impact are at so low that they are deemed acceptable to the business. Even when these risks are tolerated they should be monitored because future changes may make it no longer tolerable.
Treating Risk is a method of controlling risk through actions that reduce the likelihood of the risk occurring or minimize its impact prior to its occurrence. Also, there are contingent measures that can be developed to reduce the impact of an event once it has occurred. Finding an alternative sup-plier is an example of treating the risk.
Terminating Risk is the simplest and most often ignored method of dealing with risk. It is the ap-proach that should be most favored where possible and simply involves risk elimination. This can be done by altering an inherently risky process or practice to remove the risk. The same can be used when reviewing practices and processes in all areas of the business.
If an item presents a risk and can be changed or removed without it materially affecting the busi-ness, then removing the risk should be the first option considered; rather than attempting the treat, tolerate or transfer it.
Reference: CIPS study guide page 144
LO 3, AC 3.3
A
Explanation:
Risk control is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects that risk should it occur. CIPS preferred way to determine your risk control strategy is to use the four T’s Process:
Transferring Risk can be achieved through the use of various forms of insurance, or the payment to third parties who are prepared to take the risk on behalf of the organization
Tolerating Risk is where no action is taken to mitigate or reduce a risk. This may be because the cost of instituting risk reduction or mitigation activity is not cost-effective or the risks of impact are at so low that they are deemed acceptable to the business. Even when these risks are tolerated they should be monitored because future changes may make it no longer tolerable.
Treating Risk is a method of controlling risk through actions that reduce the likelihood of the risk occurring or minimize its impact prior to its occurrence. Also, there are contingent measures that can be developed to reduce the impact of an event once it has occurred. Finding an alternative sup-plier is an example of treating the risk.
Terminating Risk is the simplest and most often ignored method of dealing with risk. It is the ap-proach that should be most favored where possible and simply involves risk elimination. This can be done by altering an inherently risky process or practice to remove the risk. The same can be used when reviewing practices and processes in all areas of the business.
If an item presents a risk and can be changed or removed without it materially affecting the busi-ness, then removing the risk should be the first option considered; rather than attempting the treat, tolerate or transfer it.
Reference: CIPS study guide page 144
LO 3, AC 3.3
Question #234
A purchaser is looking for alternative supplies if there is a major disruption to their supply chain, including logistics, manufacturing and all support services.
Which of the following method is that purchaser applying?
- A . Treat the risk
- B . Terminate the risk
- C . Tolerate the risk
- D . Transfer the risk
Correct Answer: A
A
Explanation:
Risk control is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects that risk should it occur. CIPS preferred way to determine your risk control strategy is to use the four T’s Process:
Transferring Risk can be achieved through the use of various forms of insurance, or the payment to third parties who are prepared to take the risk on behalf of the organization
Tolerating Risk is where no action is taken to mitigate or reduce a risk. This may be because the cost of instituting risk reduction or mitigation activity is not cost-effective or the risks of impact are at so low that they are deemed acceptable to the business. Even when these risks are tolerated they should be monitored because future changes may make it no longer tolerable.
Treating Risk is a method of controlling risk through actions that reduce the likelihood of the risk occurring or minimize its impact prior to its occurrence. Also, there are contingent measures that can be developed to reduce the impact of an event once it has occurred. Finding an alternative sup-plier is an example of treating the risk.
Terminating Risk is the simplest and most often ignored method of dealing with risk. It is the ap-proach that should be most favored where possible and simply involves risk elimination. This can be done by altering an inherently risky process or practice to remove the risk. The same can be used when reviewing practices and processes in all areas of the business.
If an item presents a risk and can be changed or removed without it materially affecting the busi-ness, then removing the risk should be the first option considered; rather than attempting the treat, tolerate or transfer it.
Reference: CIPS study guide page 144
LO 3, AC 3.3
A
Explanation:
Risk control is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects that risk should it occur. CIPS preferred way to determine your risk control strategy is to use the four T’s Process:
Transferring Risk can be achieved through the use of various forms of insurance, or the payment to third parties who are prepared to take the risk on behalf of the organization
Tolerating Risk is where no action is taken to mitigate or reduce a risk. This may be because the cost of instituting risk reduction or mitigation activity is not cost-effective or the risks of impact are at so low that they are deemed acceptable to the business. Even when these risks are tolerated they should be monitored because future changes may make it no longer tolerable.
Treating Risk is a method of controlling risk through actions that reduce the likelihood of the risk occurring or minimize its impact prior to its occurrence. Also, there are contingent measures that can be developed to reduce the impact of an event once it has occurred. Finding an alternative sup-plier is an example of treating the risk.
Terminating Risk is the simplest and most often ignored method of dealing with risk. It is the ap-proach that should be most favored where possible and simply involves risk elimination. This can be done by altering an inherently risky process or practice to remove the risk. The same can be used when reviewing practices and processes in all areas of the business.
If an item presents a risk and can be changed or removed without it materially affecting the busi-ness, then removing the risk should be the first option considered; rather than attempting the treat, tolerate or transfer it.
Reference: CIPS study guide page 144
LO 3, AC 3.3
Question #234
A purchaser is looking for alternative supplies if there is a major disruption to their supply chain, including logistics, manufacturing and all support services.
Which of the following method is that purchaser applying?
- A . Treat the risk
- B . Terminate the risk
- C . Tolerate the risk
- D . Transfer the risk
Correct Answer: A
A
Explanation:
Risk control is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects that risk should it occur. CIPS preferred way to determine your risk control strategy is to use the four T’s Process:
Transferring Risk can be achieved through the use of various forms of insurance, or the payment to third parties who are prepared to take the risk on behalf of the organization
Tolerating Risk is where no action is taken to mitigate or reduce a risk. This may be because the cost of instituting risk reduction or mitigation activity is not cost-effective or the risks of impact are at so low that they are deemed acceptable to the business. Even when these risks are tolerated they should be monitored because future changes may make it no longer tolerable.
Treating Risk is a method of controlling risk through actions that reduce the likelihood of the risk occurring or minimize its impact prior to its occurrence. Also, there are contingent measures that can be developed to reduce the impact of an event once it has occurred. Finding an alternative sup-plier is an example of treating the risk.
Terminating Risk is the simplest and most often ignored method of dealing with risk. It is the ap-proach that should be most favored where possible and simply involves risk elimination. This can be done by altering an inherently risky process or practice to remove the risk. The same can be used when reviewing practices and processes in all areas of the business.
If an item presents a risk and can be changed or removed without it materially affecting the busi-ness, then removing the risk should be the first option considered; rather than attempting the treat, tolerate or transfer it.
Reference: CIPS study guide page 144
LO 3, AC 3.3
A
Explanation:
Risk control is the process by which an organization reduces the likelihood of a risk event occurring or mitigates the effects that risk should it occur. CIPS preferred way to determine your risk control strategy is to use the four T’s Process:
Transferring Risk can be achieved through the use of various forms of insurance, or the payment to third parties who are prepared to take the risk on behalf of the organization
Tolerating Risk is where no action is taken to mitigate or reduce a risk. This may be because the cost of instituting risk reduction or mitigation activity is not cost-effective or the risks of impact are at so low that they are deemed acceptable to the business. Even when these risks are tolerated they should be monitored because future changes may make it no longer tolerable.
Treating Risk is a method of controlling risk through actions that reduce the likelihood of the risk occurring or minimize its impact prior to its occurrence. Also, there are contingent measures that can be developed to reduce the impact of an event once it has occurred. Finding an alternative sup-plier is an example of treating the risk.
Terminating Risk is the simplest and most often ignored method of dealing with risk. It is the ap-proach that should be most favored where possible and simply involves risk elimination. This can be done by altering an inherently risky process or practice to remove the risk. The same can be used when reviewing practices and processes in all areas of the business.
If an item presents a risk and can be changed or removed without it materially affecting the busi-ness, then removing the risk should be the first option considered; rather than attempting the treat, tolerate or transfer it.
Reference: CIPS study guide page 144
LO 3, AC 3.3
Question #237
The bargaining strength of suppliers is likely to be high in which of the following situations? Select TWO that apply:
- A . The buyer is educated on supply markets
- B . There is a limited number of suppliers in relation to buyers
- C . The buyer is large in size relative to the supplier
- D . The buyer spend is a high proportion of a supplier’s revenue
- E . The buyer requirement is urgent
Correct Answer: B, E
B, E
Explanation:
B (Limited number of suppliers): Fewer suppliers lead to higher bargaining power due to reduced competition.
E (Urgent buyer requirement): Suppliers gain leverage when buyers have limited time to source alternatives.
Education on markets and buyer size are factors that strengthen buyer, not supplier, bargaining power.
Reference: CIPS Level 4, Supplier Negotiation and Market Power.
B, E
Explanation:
B (Limited number of suppliers): Fewer suppliers lead to higher bargaining power due to reduced competition.
E (Urgent buyer requirement): Suppliers gain leverage when buyers have limited time to source alternatives.
Education on markets and buyer size are factors that strengthen buyer, not supplier, bargaining power.
Reference: CIPS Level 4, Supplier Negotiation and Market Power.
Question #238
Which of the following bodies provides standards for the products and services in the US?
- A . ISO
- B . ANSI
- C . AFNOR
- D . BSI
Correct Answer: B
B
Explanation:
ANSI is the American National Standards Institute. It is responsible for providing technical standards in the US
LO 3, AC 3.1
B
Explanation:
ANSI is the American National Standards Institute. It is responsible for providing technical standards in the US
LO 3, AC 3.1
Question #238
Which of the following bodies provides standards for the products and services in the US?
- A . ISO
- B . ANSI
- C . AFNOR
- D . BSI
Correct Answer: B
B
Explanation:
ANSI is the American National Standards Institute. It is responsible for providing technical standards in the US
LO 3, AC 3.1
B
Explanation:
ANSI is the American National Standards Institute. It is responsible for providing technical standards in the US
LO 3, AC 3.1
Question #238
Which of the following bodies provides standards for the products and services in the US?
- A . ISO
- B . ANSI
- C . AFNOR
- D . BSI
Correct Answer: B
B
Explanation:
ANSI is the American National Standards Institute. It is responsible for providing technical standards in the US
LO 3, AC 3.1
B
Explanation:
ANSI is the American National Standards Institute. It is responsible for providing technical standards in the US
LO 3, AC 3.1