Which statement best describes crisis management within the risk management lifecycle?

• A. It is unrelated to risk management
• B. It provides the framework and actions to respond to major incidents and protect stakeholders
• C. It focuses only on post-incident recovery costs
• D. It ends the risk management process after a crisis

Answer: (B)

Crisis management in the risk management lifecycle is the set of processes used to respond to major incidents and protect people, assets, and the organization as a whole. It involves preparing crisis plans, forming a crisis management team, establishing clear command and control, and enabling rapid decision-making. A key part is robust communications—both internal, to coordinate actions, and external, to inform stakeholders such as employees, customers, regulators, and the public—to manage impact and reputational risk.

This area also covers the practical steps during a crisis: activating escalation procedures, ensuring safety, maintaining critical operations, coordinating with external responders, and implementing immediate recovery actions. The aim is to minimize harm and preserve continuity while decisions are made under pressure. After the crisis, the process feeds lessons learned back into risk assessment and planning, strengthening defenses and response capabilities for future events.

Why this fits best is that crisis management is about guiding the organization through high-severity events with a structured framework, not about ignoring risk, focusing only on costs after the fact, or ending the risk management process. It sits at the intersection of preparation, response, and recovery, integrating with broader risk management to protect stakeholders and sustain operations during and after a crisis.