C_ARSUM Ariba Supplier Management Practice Question
A supply chain risk analyst is configuring a supplier risk engagement in SAP Ariba Supplier Risk. The analyst needs to identify which data elements feed the inherent risk calculation for a supplier before any mitigation controls are applied. Which two data elements are used as inputs to inherent risk? (Choose two.)
⚠ Common exam trap
Candidates often confuse descriptive supplier profile attributes, such as revenue or preferred status, with the exposure-based inputs that actually drive inherent risk in the risk model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The supplier's geographic locations, including countries where they operate or source from.
Inherent risk represents the exposure a supplier carries before any controls are applied. The model derives this from the supplier's commodity or category assignments and its geographic locations, because these determine which regional and category-specific threats apply. Internal attributes such as revenue, open purchase orders, or preferred status do not feed the calculation, so they cannot raise or lower inherent risk on their own.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The number of open purchase orders currently issued to the supplier in the SAP Ariba sourcing pipeline.
Why it's wrong here
Open purchase orders reflect transactional activity, not inherent risk. The inherent risk calculation is independent of current order volume; a supplier with many open orders is not automatically riskier. Transactional data may inform reporting or spend analysis, but it does not feed the inherent risk score in the risk engagement.
- ✗
The supplier's declared annual revenue and employee headcount recorded on the supplier profile.
Why it's wrong here
Revenue and headcount are descriptive profile attributes used for segmentation and reporting, but they are not direct inputs to the inherent risk score. A very large supplier is not inherently riskier than a small one in the model; risk derives from exposure factors such as geography and category, not from company size metrics.
- ✗
The supplier's preferred status in the supplier master and the date that status was granted.
Why it's wrong here
Preferred status is an internal designation reflecting the buying organization's relationship preference, not an external risk factor. It does not change the supplier's exposure to geopolitical, financial, or operational threats. The inherent risk model deliberately excludes internal relationship labels so that risk reflects objective exposure rather than procurement preferences.
- ✓
The supplier's geographic locations, including countries where they operate or source from.
Why this is correct
Geography is a core inherent risk input because different countries carry different levels of regulatory, political, and operational risk. SAP Ariba Supplier Risk evaluates the supplier's locations against regional risk indices, so a supplier operating in a high-risk region receives elevated inherent risk even if its category is otherwise low risk.
- ✓
The supplier's commodity or category assignments, which carry region-specific and category-specific risk exposure.
Why this is correct
Inherent risk is driven by where and in what categories the supplier operates. Commodity and category assignments map the supplier to risk-relevant spend areas, and the supplier's geographic locations determine exposure to regional threats. Together these contextual factors form the baseline risk before any internal controls or mitigations are considered.
About these practice questions
This C_ARSUM question is part of Courseiva's 250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official SAP exam blueprint
This C_ARSUM practice question is part of Courseiva's free SAP certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the C_ARSUM exam.