CRO Strategic Planning & Crisis Management 3 — Questions and Answers
Question 1: A CRO identifies that the organization's risk culture is misaligned with its stated risk appetite. Which intervention is most effective for closing this gap?
- Revise the risk appetite statement to match current behavior
- Implement incentive structures and tone-from-the-top messaging that reinforce desired risk behaviors (Correct answer)
- Hire an external consultant to rewrite risk policies
- Increase the frequency of risk committee meetings
Correct answer: Implement incentive structures and tone-from-the-top messaging that reinforce desired risk behaviors
Aligning risk culture requires behavioral change driven by leadership modeling and incentive systems that reward risk-aware decision-making.
Question 2: During crisis triage, a CRO must prioritize which operations to restore first. What tool is specifically designed to inform this prioritization?
- Balanced Scorecard
- Business Impact Analysis (BIA) (Correct answer)
- SWOT Analysis
- Bow-Tie Risk Model
Correct answer: Business Impact Analysis (BIA)
A Business Impact Analysis quantifies the consequences of disruption to each process over time, directly informing recovery prioritization decisions.
Question 3: Which type of risk most directly threatens the validity of an organization's long-term strategic plan?
- Operational risk
- Strategic risk (Correct answer)
- Compliance risk
- Credit risk
Correct answer: Strategic risk
Strategic risk refers to threats that undermine the organization's ability to achieve its long-term objectives, directly invalidating the strategic plan.
Question 4: A global manufacturer activates its crisis management plan after a major facility fire. The incident commander's first priority should be:
- Notifying insurance carriers
- Ensuring life safety and stabilizing the immediate situation (Correct answer)
- Issuing a press release to media outlets
- Convening the board of directors
Correct answer: Ensuring life safety and stabilizing the immediate situation
Life safety is the universal first priority in any crisis response, preceding all other operational, financial, or communication actions.
Question 5: What is the key distinction between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?
- BCP covers only natural disasters while DRP covers cybersecurity events
- BCP focuses on maintaining critical business operations during disruption; DRP focuses on restoring IT systems and infrastructure (Correct answer)
- DRP is a subset of the crisis communication plan
- BCP is used only by financial institutions under regulatory mandate
Correct answer: BCP focuses on maintaining critical business operations during disruption; DRP focuses on restoring IT systems and infrastructure
BCP addresses how the business continues operating during disruption, while DRP specifically addresses the technical recovery of IT systems and infrastructure.
Question 6: A CRO is asked to evaluate the organization's strategic resilience. Which metric best reflects this capability?
- Debt-to-equity ratio
- Speed of strategic pivot following a major external shock (Correct answer)
- Number of active risk registers maintained
- Annual risk management training completion rate
Correct answer: Speed of strategic pivot following a major external shock
Strategic resilience is best measured by how quickly and effectively an organization can adapt its strategy in response to significant disruptions or environmental changes.
Question 7: In enterprise risk management, 'emerging risks' are best described as:
- Risks that have already materialized and are under active management
- Newly identified or evolving risks whose full impact and likelihood are still uncertain (Correct answer)
- Risks transferred to third parties through insurance contracts
- Risks below the organization's risk tolerance threshold
Correct answer: Newly identified or evolving risks whose full impact and likelihood are still uncertain
Emerging risks are characterized by uncertainty about their development, making early identification and monitoring critical for strategic planning.
CRO Strategic Planning & Crisis Management 3
A CRO identifies that the organization's risk culture is misaligned with its stated risk appetite.
Which intervention is most effective for closing this gap?