For an organization to be successful, an effective strategy is required, and if implemented appropriately the strategy will result in a sustainable competitive advantage. The importance of decision making in the oil industry is reflected in the magnitude and nature of the industry. Specific features of the oil industry supply chain, such as its longer chain, the complexity of its transportation system, its complex production and storage processes, etc., pose challenges to its effective management. Hence, understanding the risks, the risk sources, and their potential impacts on the oil industry's operations will be helpful in proposing a risk management model for the upstream oil supply chain. The risk-based model in this research uses a three-level analytic hierarchy process (AHP), a multiple-attribute decision-making technique, to underline the importance of risk analysis and risk management in the upstream crude oil supply chain. Level 1 represents the overall goal of risk management; Level 2 is comprised of the various risk factors; and Level 3 represents the alternative criteria of the decision maker as indicated on the hierarchical structure of the crude oil supply chain. Several risk management experts from different oil companies around the world were surveyed, and six major types of supply chain risks were identified: 1) exploration and production, 2) environmental and regulatory compliance, 3) transportation, 4) availability of oil, 5) geopolitical, and 6) reputational. Also identified are the preferred methods of managing risks which include; 1) accept and control the risks, 2) avoid the risk by stopping the activity, or 3) transfer or share the risks to other companies or insurers. The results from the survey indicate that the most important risk to manage is transportation risk with a priority of .263, followed by exploration/production with priority of .198, with an overall inconsistency of .03. With respect to major objectives the most preferred risk management policy option based on the result of the composite score is accept and control risk with a priority of .446, followed by transfer or share risk with a priority of .303. The least likely option is to terminate or forgo activity with a priority of .251.