An enterprise threat analysis covers only physical hazards and skips reputation and regulatory dimensions. What breadth issue should be corrected?
Select an answer to reveal the explanation.
Short Explanation
If your “enterprise” threat list stops at wet floors, you are missing the headlines and the regulators. Reputation and compliance hits can sink objectives just as hard as a physical incident.
Full Explanation
Enterprise threat analysis is intended to examine categories of threat that can affect the whole organization, including reputation and regulatory exposure alongside physical hazards. An analysis that covers only physical hazards and skips reputation and regulatory dimensions is too narrow for ERM-aware civic leadership. Broadening categories corrects that incompleteness.
Claiming reputation and regulatory threats are never enterprise concerns for civic organizations ignores public trust and legal exposure. Treating physical hazards alone as complete once insurance is purchased substitutes financing for analysis breadth. Filing regulatory dimensions only in legal billing folders keeps them out of threat analysis where prioritization happens.
Exam caveat: enterprise analysis is multi-category. Physical + insurance is not a full threat set.
Operational check: expand threat categories to include reputation and regulatory items; assign owners; include them in enterprise threat or risk reviews; link material items to objectives and treatment plans. Expand the enterprise threat taxonomy template used by the risk committee to include reputation and regulatory rows by default. Assign analytical owners for those rows, not only physical security.