A city manager asks what "corporate" risk management means for a public agency that is not a stock company. Which answer is correct?
Select an answer to reveal the explanation.
Short Explanation
"Corporate" here is less about stock tickers and more about running an organized shop. Cities, nonprofits, and companies all face threats to their goals, so the same identify-evaluate-treat playbook still fits. Being a public agency does not put you on the sidelines.
Full Explanation
"Corporate" risk management, in CRMC-style usage, refers to organization-wide methods for identifying and treating threats to objectives. Those methods apply to public agencies, nonprofits, and private firms alike—not only to stock companies. A city that is not publicly traded still faces operational, strategic, information, and financial exposures that benefit from structured assessment and controls. Limiting corporate methods to privately held manufacturers with shareholder boards invents an ownership test the discipline does not require. Waiting for a stock listing before using frameworks delays basic civic risk practice without benefit. Restricting likelihood-consequence scales to for-profit utilities while forcing cities onto insurance checklists alone denies public agencies analytic tools they already need for council reporting. Exam caveat: "corporate" here means enterprise-style practice for any organization, including municipalities—not a securities-law status. Operational check: place the city risk policy header language so it explicitly covers agencies and departments regardless of corporate form, then score one non-insurable strategic threat (for example grant dependency or staffing fragility) on the same likelihood-consequence scale used for insured property. Brief the city manager that the method is organizational, not market-listing dependent.