A library board wonders if "risk" includes losing patron trust after a data mishap, not just money. What should the risk manager confirm?
Select an answer to reveal the explanation.
Short Explanation
Money is the easy meter to watch, but trust works like a library card — once it is canceled in someone's mind, borrowing stops. Corporate risk also covers people, information, and relationships. A data mishap that burns patron confidence is firmly in scope, even before the dollar line moves.
Full Explanation
Corporate risk for a library or other civic entity spans financial loss, employee and patron harm, information compromise, and relationship or trust damage—not cash alone. A data mishap that erodes patron trust can reduce program use, invite regulatory scrutiny, and impair partnerships even when direct write-offs look small. Declaring that only direct cash losses count excludes reputation and trust effects that boards still must govern. Making patron-trust relevance depend on an insurance policy naming it as covered property confuses risk identification with coverage wording. Treating relationship damage as relevant only when OSHA cites the agency invents a regulatory gate that does not define corporate risk categories. Exam caveat: multi-category corporate risk (financial, people, information, relationships) is the expected framing; money-only definitions are classic traps. Operational check: add an explicit "patron trust / relationship" column or narrative field to the library incident review template, score one recent data or privacy near-miss for both financial and trust impact, and brief the board on both dimensions. Confirm that the register entry names an owner for communication and remediation, not only for invoice coding.