Foundations of Corporate Risk Management

CRMC · 100 questions

• A township board calls every rainy-day delay a "hazard" and every unpaid invoice a "risk" interchangeably. Which clarification should the risk manager give?
• A parks director wants one sentence for council on why the city needs a risk manager at all. Which statement best captures the purpose?
• A new hire asks whether risk management only covers insurance buying. Which response is most accurate?
• A library board wonders if "risk" includes losing patron trust after a data mishap, not just money. What should the risk manager confirm?
• A utilities manager claims hazards and risks are the same because both can hurt people. Which distinction should the risk manager reinforce?
• A city manager asks what "corporate" risk management means for a public agency that is not a stock company. Which answer is correct?
• Staff say risk management is only for after accidents happen. How should the risk manager correct that view?
• A finance chair thinks market stock swings are irrelevant because the city is not publicly traded — yet vendor price shocks still hit the budget. What point should the risk manager make?
• A safety poster defines hazard as "anything that might go wrong someday." What correction belongs on the poster?
• An ops lead asks whether customer and vendor relationship damage counts as a corporate risk. Which answer is correct?
• A department head wants risk management only for OSHA inspections and nothing else. How should the risk manager respond?
• Council asks if quality-management and safety guidelines are part of a risk manager's role. What is the accurate reply?
• A supervisor says every industry has the same top five risks so templates never need localizing. Which correction is needed?
• Internal audit is proposed as unrelated to risk management. Which statement corrects that view?
• A clerk equates "risk" with "we might get sued" only. What broader view should replace that definition?
• A board member asks for the difference between eliminating a wet floor and "managing risk." Which explanation is correct?
• Training slides claim risk management guarantees zero incidents forever. What should replace that claim?
• A mayor asks how risk management supports long-term organizational resilience. Which answer best fits?
• Someone argues only private corporations need CRMC-style skills. Which rebuttal is correct?
• A volunteer coordinator confuses a frayed extension cord (hazard) with the chance of fire during an event (risk). How should the labels be corrected?
• A parks seasonal worker sees a cracked bleacher and emails the mayor directly, skipping the facilities supervisor. What practice should the risk manager reinforce?
• Two departments both think the other owns reporting a recurring HVAC odor near servers. What should the risk manager establish?
• A new org chart removes the safety coordinator box; staff no longer know whom to call about near-misses. What must leadership restore?
• A director insists only C-suite may hear about risks, so supervisors stay silent. Which correction is needed?
• Union stewards and facilities disagree who briefs contractors on site hazards. What should the risk manager ensure?
• A city uses Slack for urgent gas-smell reports and paper forms for routine trip hazards, but nobody has written which channel is for which situation. What should the risk manager do first?
• An intern spots a recurring phishing pattern in city email but only mentions it to a friend who works at another agency. What is the correct next step for information-risk reporting?
• Operations hears that a key supplier will miss deliveries but refuses to tell purchasing because 'that is their problem.' What corporate risk-communication principle is violated?
• A board packet buries a critical structural crack finding in an unread appendix while the cover memo highlights only routine metrics. How should high-severity risks be escalated?
• Night-shift staff discover a serious safety issue but find no on-call risk contact listed for off hours. What gap does this reveal?
• A manager rewrites the escalation SOP verbally every week and never leaves a written path. What should replace that practice?
• Facilities finds mold in a public building and reports it to HR because 'people issues go to HR.' What is the better routing approach?
• A risk committee updates the register with new control requirements, but the department that must implement those controls never hears the decision. What communication step is missing?
• Council members insist every minor spill report appear in the public meeting packet alongside strategic risks. What reporting principle should guide the risk manager?
• A hybrid team works remotely but still shares a civic building; after hours, nobody has a shared channel to report building-access risks. What should leadership design?
• After a water leak, one deputy director orders the gallery kept open while another orders an immediate shutdown, and frontline staff freeze. What should the organization clarify?
• A contractor finds a serious site hazard and reports it only to procurement, which files the note with the contract and never alerts site safety. What routing fix is needed?
• Staff notice elevator near-misses but fear retaliation if they escalate upward. What cultural condition does healthy risk communication require?
• The org chart shows a risk committee box, but the committee has not met in two years. What does this imply for risk communication?
• A bilingual front desk handles many non-English-speaking visitors but has no translated instructions for reporting visitor injuries. What pathway gap should be fixed?
• A supervisor rates a once-in-fifty-year pipe-burst flood the same likelihood as weekly slip incidents because both 'could happen.' What scoring error is this?
• Staff score consequence only by dollar repair cost and ignore whether people could be seriously injured. What does a proper consequence scale include?
• A risk matrix cell is labeled 'medium' but the team has no shared definitions of low, medium, and high impact. What should they establish first?
• An analyst multiplies 'pretty likely' by 'bad' to rank a risk without opening the organization's defined likelihood and consequence scales. What should replace that habit?
• A rare chemical spill scenario with catastrophic community impact is filed as low priority solely because it is rare. What evaluation mistake is this?
• Daily minor paper cuts are escalated as high organizational risk solely because they occur frequently. What correction does the likelihood-consequence view require?
• Two raters score the same elevator failure differently because one focuses only on service downtime and the other only on trapped riders. What should the organization align?
• A team treats the word 'possible' as the middle likelihood band without checking the scale legend. What should they do instead?
• Impact is rated high solely because a council member is angry about a routine maintenance delay. What should drive impact classification instead?
• A flood risk near a seasonal river is scored once in dry season and never revisited when rainy season approaches. What likelihood practice is missing?
• A city parks crew builds a consequence scale that jumps from 'scratch' straight to 'death,' with no bands for serious injury or lost-time harm. What is missing from this scale?
• At a county board workshop, three people mention phishing in the same hour, so the facilitator labels phishing 'high likelihood.' What mistake does this reflect?
• After one near-miss at a municipal garage, staff set likelihood to 'certain' for every future year and refuse to revisit the rating. What should they do instead?
• A cold-site outage and a front-lobby trip hazard are forced onto the same unlabeled 1–5 scale with no written anchors. What does the organization need?
• A library risk workshop applies low/medium/high stickers to sticky notes before anyone discusses likelihood or consequence. What process order should replace that habit?
• A city warehouse rates chemical burns and bruised elbows the same consequence because both are 'injuries.' What should the consequence scale require?
• IT rates a ransomware event as low consequence because 'we have backups,' without verifying restore time or integrity. What rating practice is wrong?
• Public works uses a 3-level impact model while finance invents a 10-level model for the same campus. What enterprise practice should leadership establish?
• A 'medium' rating appears in a transit agency register with no narrative explaining how it maps to the scale. What documentation is required?
• Safety staff raise a boiler-room risk's likelihood because leaks are easy to smell, confusing detection ease with occurrence chance. What should likelihood measure?
• A garage roof leak is debated as 'facilities whining' rather than recognized as exposure to people and property. How should this be classified?
• Unpatched kiosk PCs in a city hall lobby are treated as an IT preference issue. What risk type should leadership recognize?
• A misplaced flash drive holding resident case data is filed only as 'clutter' by a clerk. What risk classification fits?
• Chronic understaffing on night shifts at a 24-hour utility desk is brushed off as 'HR's problem.' What risk type should operations own jointly?
• A chemical store beside a creek is discussed only as a zoning paperwork matter. What risk type is being overlooked?
• A sole-source chemical supplier files for bankruptcy, and the water plant team says 'that's procurement's issue' and leaves it off the register. What should they recognize?
• Bad press causes a sudden tourism drop that cuts a city marina's slip-fee revenue. Which risk framing is most accurate?
• One rater calls server-room humidity an environmental risk; another calls it technology risk. What classification principle should guide the choice?
• Internal cash theft by a cashier is logged as an 'external cyberattack' to avoid HR scrutiny. What distinction should the register enforce?
• A visitor slips in the lobby and staff dismiss it because visitors 'aren't employees.' What risk posture is correct?
• Parking-lot lighting outages at night coincide with rising assault and vehicle-break reports near a civic center. How should risk teams treat the condition?
• Stadium-night traffic pattern changes block ambulance access to a clinic annex. What risk type does this illustrate?
• Smoke from a neighboring wildfire enters HVAC intakes at a county office campus. How should this be classified?
• A phishing kit targeting payroll is filed purely as 'IT' with no personnel-awareness angle. What interplay should the assessment capture?
• Mold in a records basement is labeled only as personnel discomfort, ignoring damage to paper and digital media archives. What consequence should also be recognized?
• Utility staff wave off hobby drones hovering over a drinking-water reservoir as 'not our risk type' because no pipe has burst yet. How should the corporate risk manager classify this exposure?
• A water utility depends on one SCADA technician who alone can restart the control network. Leadership labels the issue 'technology risk only.' What is the more accurate primary classification?
• After a ransomware note hits a city permitting system, several managers insist the event is 'PR risk only' and should skip technical risk registers. What primary risk type should drive the response?
• Contractors at a civic garage routinely share one badge to speed entry. Some leaders call the habit 'security theater' and leave it off the risk list. How should the risk manager treat badge sharing?
• Rising market interest rates push the renewal cost of a city warehouse lease sharply higher and threaten the logistics budget. Which risk framing best fits this pressure?
• Leadership wants risks identified only from last year's incident log and forbids floor walk-arounds. What should the risk manager argue?
• A plant runs only an annual risk review while a construction wing changes weekly. What assessment rhythm should the risk manager recommend?
• During a lobby renovation, nobody asks which patrons, staff, or contractors could be harmed by dust, open floors, and redirected exits. What identification step is missing?
• Wet-floor cones placed years ago are assumed sufficient even though foot-traffic patterns have shifted toward a new café entrance. What should identification include?
• A data-center 'worst case' plan is a sticky note that only says 'call IT.' What does effective worst-case scenario planning require instead?
• A parks department never lists supplier bankruptcy because leaders say 'our vendors are fine forever.' What should source identification include?
• A customer protest blocks the main entrance of a municipal service center. Staff treat it as pure PR and omit it from operational risk sources. How should it be framed for identification?
• Emergency plans for a civic museum never assess whether visitors can find exits during an alarm. What identification gap does this create?
• A county office catalogs only indoor risks and ignores parking-lot assaults and ice sheets. What should the risk manager emphasize?
• Traffic queueing for a vaccine clinic creates pedestrian conflicts that nobody walks down or documents. What does this illustrate about risk sources?
• An indoor facilities checklist never mentions runoff from a vehicle wash bay that drains toward a storm ditch. What source category is missing?
• A week-long festival sharply raises crowd loads in a civic hall, but leaders leave the long-term building assessment unchanged for the event week. What should happen?
• Risk identification workshops exclude frontline custodians who see hazards daily. What practice should the risk manager promote?
• Machine guards and aisle markings installed five years ago are never rechecked after a new equipment layout. What identification question should be asked?
• A hurricane tabletop names only 'bad weather' without specifying facility failure modes or responses. What should worst-case planning add?
• A facilities team writes down only risks with cheap fixes and leaves expensive structural cracks off the list. What identification principle does this violate?
• A facilities manager proposes a drone survey of a warehouse roof, but leadership rejects it because 'walk-arounds must be on foot only.' What is the better view of identification techniques?
• After a near-miss forklift incident, the team blames only the operator and skips reviewing sources and controls. What should identification emphasize instead?
• Planners site a new records trailer without checking seasonal flooding maps for the lot. What identification practice is missing?
• A multi-building campus assesses only headquarters and assumes satellite yards have identical risk profiles. What should the risk manager require?