I85PREP
⌘ K
CRIS study materials
CRIS study resources

CRIS practice questions

One question at a time. Build your CRIS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Crisis and Critical Incident Fundamentals

Which statement best defines an organizational crisis?

  1. A recurring performance issue that is handled through the normal quality assurance process
  2. A scheduled event for which the organization has already prepared a detailed response script
  3. A routine deviation that front-line staff resolve by following standard operating procedures
  4. An event threatening core objectives that demands urgent decisions under uncertainty Correct answer.

Explanation

A crisis threatens an organization's highest-priority goals or viability, arrives with surprise, compresses decision time, and exceeds routine capability. Events that staff can resolve with standard procedures are incidents rather than crises, and planned events are exercises.

Question 2Crisis and Critical Incident Fundamentals

A critical incident is best described as:

  1. A sudden, unexpected event that overwhelms normal coping capacity and may harm people Correct answer.
  2. Any event that generates a customer complaint or attracts negative coverage in the news media
  3. An event that is fully contained within a single department's budget and reporting line
  4. A planned disruption that is deliberately introduced in order to test continuity arrangements

Explanation

A critical incident is sudden, unexpected, and of sufficient magnitude that ordinary coping mechanisms and resources are overwhelmed, with potential for serious harm or loss. Scope, novelty, and demand on capacity are the defining features, not publicity or budget ownership.

Question 3Crisis and Critical Incident Fundamentals

Which set of phases describes the emergency management cycle?

  1. Detect, contain, eradicate, and recover
  2. Design, build, test, and deploy
  3. Assess, plan, execute, and close
  4. Mitigation, preparedness, response, and recovery Correct answer.

Explanation

The emergency management cycle is conventionally described as mitigation, preparedness, response, and recovery, and it is continuous rather than strictly sequential. The other lists describe project, engineering, or incident-handling lifecycles rather than the emergency management discipline.

Question 4Crisis and Critical Incident Fundamentals

What is the primary function of an Emergency Operations Center?

  1. Replacing the incident commander whenever the event becomes large
  2. Coordinating information and prioritizing resources organization-wide Correct answer.
  3. Directing tactical firefighting and rescue operations at the incident scene
  4. Handling all media enquiries on behalf of the whole organization

Explanation

An Emergency Operations Center is a coordination facility that gathers information, maintains situational awareness, sets priorities, and allocates resources in support of the incident. Tactical direction remains with the on-scene incident commander, so the center supports rather than replaces command.

Question 5Crisis and Critical Incident Fundamentals

Under the Incident Command System, what is the recommended span of control for a supervisor?

  1. Three to seven subordinates, with five considered optimal Correct answer.
  2. No limit, provided all subordinates are co-located with the supervisor
  3. One to two subordinates
  4. Exactly ten subordinates

Explanation

ICS doctrine places an effective span of control at three to seven subordinates, with five as the working optimum. Groups that are too small waste supervisory capacity and groups that are too large degrade oversight, regardless of co-location.

Question 6Crisis and Critical Incident Fundamentals

When a critical incident occurs, what should be the first priority of the response?

  1. Protecting the organization's reputation and share price
  2. Restoring IT systems to normal service levels as quickly as possible
  3. Preserving evidence for the investigation and any legal proceedings
  4. Protecting life safety of people affected and responders Correct answer.

Explanation

Life safety takes precedence over property, reputation, and continuity objectives in any recognized response doctrine. Reputation, evidence, and system restoration are important but are pursued once people are protected and accounted for.

Question 7Crisis and Critical Incident Fundamentals

What is the purpose of a hot wash held immediately after an incident or exercise?

  1. To assign formal disciplinary action for errors that were made
  2. To produce the final written after-action report for approval
  3. To determine the budget that will be needed for the next exercise
  4. To capture observations while recollections are still fresh Correct answer.

Explanation

A hot wash is a brief, immediate discussion that captures participant observations before memory fades and before participants disperse. It feeds the later formal after-action process rather than replacing it, and it is not a disciplinary or budgetary mechanism.

Question 8Crisis and Critical Incident Fundamentals

What does a business impact analysis primarily identify?

  1. Time-sensitive functions and how long they can be out of service Correct answer.
  2. The root cause of the most recent major outage
  3. The insurance value of each physical asset and building
  4. The media coverage risk associated with each business unit

Explanation

A business impact analysis identifies time-critical functions and quantifies the consequences of their loss over time, producing recovery time objectives and maximum tolerable outage figures. Root cause analysis, asset valuation, and reputational exposure are separate activities.

Question 9Crisis and Critical Incident Fundamentals

An incident team is managing a data breach. Which condition most clearly indicates the event should be escalated to crisis level?

  1. The incident was logged in the ticketing system within the agreed service window
  2. Regulated data is exposed at scale and normal response capacity is exceeded Correct answer.
  3. A single customer record was exposed and has now been corrected
  4. The breach was first detected by an automated monitoring tool

Explanation

Escalation to crisis level is triggered by severity, scale, and the exhaustion of routine response capacity, not by how the event was detected or logged. Large-scale exposure of regulated data brings legal, regulatory, and reputational consequences that exceed normal incident handling.

Question 10Crisis and Critical Incident Fundamentals

Two agencies with legal authority respond to the same incident. What does Unified Command require?

  1. Command is rotated between the agencies at fixed intervals during the event
  2. The senior officer present takes sole command and the other agency becomes advisory
  3. Each agency pursues its own objectives under a separate incident action plan
  4. Agencies jointly set a single set of objectives and a single incident action plan Correct answer.

Explanation

Unified Command lets agencies with jurisdictional or functional authority jointly set one set of objectives and one incident action plan while each retains authority over its own personnel. It avoids competing plans and removes the need to determine which agency is senior.

Question 11Crisis and Critical Incident Fundamentals

What most reliably distinguishes an incident from a crisis?

  1. The event involves more than one department or business unit
  2. The event lasts for longer than one full operational period
  3. The event attracts sustained coverage from national and international news media
  4. Impact exceeds routine response capability and threatens strategic goals Correct answer.

Explanation

The distinction rests on whether the event exceeds normal response capability and puts strategic objectives at risk. Duration, media attention, and the number of departments involved may accompany a crisis but do not define one.

Question 12Crisis and Critical Incident Fundamentals

Which content belongs in a situation report?

  1. Current status, actions taken, resources committed, and outstanding needs Correct answer.
  2. The projected annual budget for the whole response team
  3. The personal opinions of responders about who was at fault
  4. The complete forensic timeline of every log entry that has been collected so far

Explanation

A situation report is a concise snapshot covering what has happened, what has been done, what resources are engaged, and what support is required. It is not a forensic record, a budget document, or a place for attribution of blame.

Question 13Crisis and Critical Incident Fundamentals

Within the first hour of a fatal workplace accident, what is the most appropriate communication action?

  1. Issue a holding statement with concern and a commitment to update Correct answer.
  2. Release a detailed root-cause analysis to the press immediately
  3. Decline all comment until the formal investigation has fully concluded
  4. Publish the names and medical details of everyone affected

Explanation

A holding statement acknowledges the event, expresses concern for those affected, and commits to providing further information at a stated time, which buys time for verification. Detailed causes are unknown at that stage, silence invites speculation, and personal health information must not be released.

Question 14Crisis and Critical Incident Fundamentals

In critical incident stress management, how does a defusing differ from a debriefing?

  1. A defusing is short and held within hours; a debriefing is longer and held days later Correct answer.
  2. A defusing is held weeks later, while a debriefing takes place on scene
  3. A defusing is mandatory for all staff, while only leaders may attend a debriefing
  4. A defusing is a formal psychotherapy session, while a debriefing is purely administrative

Explanation

A defusing is a brief, informal conversation held in the immediate hours after an incident, mainly to check wellbeing and close the operational period. A structured debriefing is longer and is typically convened one to three days later for those who would benefit.

Question 15Crisis and Critical Incident Fundamentals

Which action is consistent with psychological first aid after a critical incident?

  1. Requiring every affected person to recount the event in detail in a group setting
  2. Prescribing alcohol to help people sleep after the event
  3. Offering practical safety information, calming support, and referral Correct answer.
  4. Advising affected staff to avoid all contact with their colleagues for several weeks

Explanation

Psychological first aid emphasises safety, calming, connectedness, self-efficacy, and hope, delivered through practical support and referral to appropriate services. It does not involve forced detailed retelling, social isolation, or any substance recommendation.

Question 16Crisis and Critical Incident Fundamentals

What distinguishes an improvement plan from an after-action report?

  1. The after-action report is confidential while the improvement plan is public
  2. The improvement plan is written only after real incidents, never after exercises
  3. The improvement plan assigns each corrective action an owner, a due date, and a status Correct answer.
  4. The after-action report lists only weaknesses while the improvement plan lists only strengths

Explanation

The after-action report captures what happened, what was expected, and what should change; the improvement plan converts those findings into tracked actions with accountable owners, deadlines, and status. Tracking is what turns lessons identified into lessons learned.

Question 17Crisis and Critical Incident Fundamentals

In a crisis management team, what is the role of the liaison function?

  1. To draft the final after-action report for the team
  2. To approve all financial expenditure that is incurred during the response
  3. To take direct control of field operations at the scene
  4. To coordinate with external agencies, partners, and stakeholders Correct answer.

Explanation

The liaison role manages interfaces with external organizations such as responding agencies, regulators, suppliers, and partner bodies so that the team speaks with one coordinated voice. Financial approval, field command, and post-event reporting sit with other functions.

Question 18Crisis and Critical Incident Fundamentals

A common operating picture supports crisis decisions by:

  1. replacing the need for written incident objectives and action plans
  2. giving all decision makers a shared, current view of the situation Correct answer.
  3. guaranteeing that all data is accurate and complete
  4. removing the need for regular situation reports

Explanation

A common operating picture aligns decision makers on a single, current understanding of the situation so that priorities and resources can be coordinated. It complements rather than replaces objectives, plans, and reporting, and it cannot guarantee data quality.

Question 19Crisis and Critical Incident Fundamentals

An exercise reveals that a call-tree notification failed. Which action best reflects a continuous improvement approach?

  1. Reassign the notification duty to the most senior manager who is available
  2. Note the issue in the exercise sign-in sheet and move on
  3. Fix the contact data and retest the call tree, recording the result Correct answer.
  4. Wait for the next scheduled full-scale exercise before acting

Explanation

Continuous improvement requires that the identified gap be corrected and then verified, with the verification recorded so that the action can be closed. Merely noting the issue, deferring action, or changing personnel does not confirm that the capability now works.

Question 20Crisis and Critical Incident Fundamentals

What does current evidence say about mandatory single-session psychological debriefing for all incident responders?

  1. It should replace all other forms of support for affected responders
  2. It reliably prevents post-traumatic stress in every responder who attends
  3. It is effective only when it is delivered by the responder's line manager
  4. It is not supported as universal and may be unhelpful for some people Correct answer.

Explanation

Reviews of single-session debriefing have not shown that it prevents post-traumatic stress and suggest it may be counterproductive for some individuals. Good practice is therefore to offer a range of supports, screen for those who need further help, and avoid compulsory one-size-fits-all sessions.

Question 21Crisis and Critical Incident Fundamentals

An experienced crisis manager makes a rapid decision without consciously comparing options. This best illustrates:

  1. escalation of commitment to an earlier failing course of action
  2. recognition-primed decision making from pattern matching Correct answer.
  3. groupthink arising from pressure to reach agreement
  4. anchoring bias from an early piece of information

Explanation

Recognition-primed decision making describes experts matching a situation to stored patterns and mentally simulating a workable option rather than comparing alternatives. It is a legitimate expert strategy under time pressure, distinct from the biases listed.

Question 22Crisis and Critical Incident Fundamentals

During a fast-moving crisis, which communication approach best preserves trust?

  1. Denying all responsibility until the facts have been fully established
  2. Stating what is known, what is not, and when the next update comes Correct answer.
  3. Remaining silent until a complete and verified account is available
  4. Releasing speculative casualty figures in order to appear transparent

Explanation

Trust is sustained by honest acknowledgement of uncertainty combined with a reliable rhythm of updates, which keeps stakeholders engaged and corrects misinformation early. Blanket denial, speculation, and silence all erode credibility once the facts emerge.

Question 23Crisis and Critical Incident Fundamentals

What is the main purpose of a mutual aid agreement?

  1. To allow one organization to take over another's command permanently
  2. To set the price of insurance premiums after a declared disaster
  3. To pre-arrange resource sharing and support between organizations Correct answer.
  4. To transfer legal liability for an incident to another organization

Explanation

Mutual aid agreements establish in advance how organizations will share personnel, equipment, and capability when one is overwhelmed, removing negotiation delays during an emergency. They do not transfer liability, confer permanent command, or set insurance pricing.

Question 24Crisis and Critical Incident Fundamentals

Which statement about the recovery phase is most accurate?

  1. Recovery begins only after the response phase has been formally closed
  2. Recovery consists only of restoring IT systems to their previous state
  3. Recovery ends at the moment the incident log is formally closed
  4. Recovery planning should begin while the response is still underway Correct answer.

Explanation

Recovery planning starts during response, when damage assessments and restoration priorities can be established, which shortens overall disruption. Recovery also covers people, facilities, and business processes, and it continues well beyond administrative closure of the incident.

Question 25Crisis and Critical Incident Fundamentals

A slow-onset or creeping crisis is best characterized by:

  1. An event that is always caused by deliberate hostile action against the site
  2. Conditions that build gradually and are easily missed by routine monitoring Correct answer.
  3. An event confined to a single facility that is resolved within one shift
  4. A sudden event that arrives with no warning indicators whatsoever

Explanation

Creeping crises develop over an extended period through accumulating signals that fall outside routine monitoring thresholds or are individually dismissed. Their danger lies in late recognition, so detection depends on trend analysis and weak-signal monitoring rather than on a single alarm.

Question 26Crisis and Critical Incident Fundamentals

Which characteristic most reliably distinguishes a crisis from a routine emergency?

  1. It is handled entirely by first responders.
  2. It is always caused by a natural hazard.
  3. It ends when the immediate response phase concludes.
  4. It threatens high-priority goals under time pressure. Correct answer.

Explanation

A crisis is defined by a serious threat to high-priority goals, limited time for decision-making, and significant uncertainty. Routine emergencies usually fit established procedures and do not threaten strategic objectives. The presence of a natural hazard is not required, and recovery may continue long after the acute response.

Question 27Crisis and Critical Incident Fundamentals

In the Incident Command System, what is the primary function of the Operations Section?

  1. Developing the incident action plan and tracking costs.
  2. Handling logistics, facilities, and supplies.
  3. Managing public information and media.
  4. Directing tactical activities to meet objectives. Correct answer.

Explanation

The Operations Section directs the tactical actions that achieve the incident objectives. Planning develops the action plan, Logistics manages resources and support, and public information is handled separately. Keeping these functions distinct preserves clear lines of authority.

Question 28Crisis and Critical Incident Fundamentals

What is the main purpose of an Emergency Operations Center?

  1. To serve as the forward command post at the incident scene.
  2. To provide direct tactical supervision of field crews.
  3. To coordinate support and resources across the response. Correct answer.
  4. To replace the incident commander at the scene.

Explanation

An Emergency Operations Center is an off-scene coordination facility that supports strategic decision-making, resource allocation, and interagency liaison. It does not normally direct tactical operations at the incident scene. Tactical command remains with the on-scene incident commander.

Question 29Crisis and Critical Incident Fundamentals

Which phase of the crisis management cycle focuses on reducing the likelihood or impact of future incidents?

  1. Mitigation. Correct answer.
  2. Recovery.
  3. Notification.
  4. Response.

Explanation

Mitigation covers actions taken to reduce the probability or consequences of an incident before it occurs. Response addresses the immediate event, and recovery restores services and addresses longer-term impacts. Notification is a process within response, not a separate lifecycle phase.

Question 30Crisis and Critical Incident Fundamentals

In a crisis management team, which role is responsible for coordinating information flow and ensuring decisions are recorded?

  1. The operations chief.
  2. The legal advisor.
  3. The public information officer.
  4. The recorder or secretariat. Correct answer.

Explanation

The recorder or secretariat function maintains the decision log, tracks actions, and helps ensure information reaches the right team members. This role supports continuity and accountability during fast-moving discussions. It does not replace operational, legal, or public information expertise.

Question 31Crisis and Critical Incident Fundamentals

Which principle is most important when communicating with the public during the acute phase of a crisis?

  1. Delegating all public communication to field responders.
  2. Timely, consistent updates that acknowledge uncertainty. Correct answer.
  3. Withholding all information until the investigation is complete.
  4. Releasing speculative details to satisfy media demand.

Explanation

Public communication during the acute phase should be timely, accurate, consistent, and honest about what is not yet known. Acknowledging uncertainty preserves credibility better than speculation or silence. Field responders may provide information, but public messaging should be coordinated through the designated function.

Question 32Crisis and Critical Incident Fundamentals

In incident management, what does span of control refer to?

  1. The resources one supervisor can effectively manage. Correct answer.
  2. The total budget authorized for response.
  3. The number of media outlets covering an incident.
  4. The geographic area affected by an incident.

Explanation

Span of control describes how many subordinates or resources one supervisor can effectively oversee. Incident management commonly uses a limited span, often around three to seven subordinates, to maintain clear supervision. It is not a measure of media attention, geography, or budget.

Question 33Crisis and Critical Incident Fundamentals

What does a business continuity plan primarily aim to do?

  1. Guarantee that no revenue will be lost during a disruption.
  2. Replace the crisis management team during an incident.
  3. Maintain critical functions during and after disruption. Correct answer.
  4. Eliminate all risks to the organization.

Explanation

Business continuity planning identifies critical functions and sets arrangements to keep them available or restore them during disruption. It does not eliminate risk or guarantee financial outcomes. Crisis management teams coordinate the broader response, while continuity plans focus on keeping essential operations running.

Question 34Crisis and Critical Incident Fundamentals

A risk assessment rates an event as high likelihood and moderate consequence. What does this rating primarily inform?

  1. The legal liability of the organization.
  2. The priority for mitigation and contingency planning. Correct answer.
  3. The exact date the event will occur.
  4. The identities of individuals responsible for the event.

Explanation

Risk ratings combine likelihood and consequence to help prioritize which risks need mitigation, monitoring, or contingency planning. A high-likelihood, moderate-consequence event still warrants attention because it may occur often. Risk assessment does not predict exact dates, assign personal blame, or determine legal liability.

Question 35Crisis and Critical Incident Fundamentals

Which condition most clearly justifies activating a crisis management team rather than handling an incident within normal operations?

  1. The incident affects a single customer and is resolved within an hour.
  2. The incident generates minor local media interest.
  3. It threatens strategic goals and needs cross-functional decisions. Correct answer.
  4. The incident is reported by a junior employee.

Explanation

Crisis team activation is generally warranted when an incident threatens strategic objectives, affects multiple functions or stakeholders, and requires coordinated decisions beyond routine procedures. Severity and cross-functional impact matter more than who reported the issue. Minor local media interest alone does not constitute a crisis.

Question 36Crisis and Critical Incident Fundamentals

A crisis team must choose a response before all facts are known. Which approach is most appropriate?

  1. Ignore uncertainty and commit to the first option proposed.
  2. Delegate the decision to an external consultant.
  3. Make a provisional decision and set triggers to review it. Correct answer.
  4. Wait until complete information is available regardless of time.

Explanation

Crisis decisions often must be made under uncertainty, so teams make a provisional choice, define what would change it, and review as information improves. This balances speed with adaptability. Waiting for complete certainty can forfeit the opportunity to act, while ignoring uncertainty or outsourcing accountability is not sound crisis practice.

Question 37Crisis and Critical Incident Fundamentals

Which stakeholder group is typically most important to engage early when a crisis may affect public safety?

  1. Internal IT helpdesk.
  2. Affected communities and responders. Correct answer.
  3. Competitors.
  4. The organization's external marketing vendors.

Explanation

When public safety is at risk, affected communities and the responding authorities need timely information and coordination. Early engagement supports warnings, protective actions, and trust. Competitors and marketing vendors are not primary public safety stakeholders, and internal IT support is a supporting function rather than the external audience most at risk.

Question 38Crisis and Critical Incident Fundamentals

What is the main purpose of a tabletop exercise?

  1. To replace a full-scale exercise permanently.
  2. To practice decisions and coordination in discussion. Correct answer.
  3. To certify responders in physical fitness.
  4. To test equipment under full operational load.

Explanation

A tabletop exercise brings participants together to discuss roles, decisions, and coordination against a scenario without deploying field resources. It is low-cost and useful for testing plans and assumptions. It does not replace full-scale exercises or test physical equipment under load.

Question 39Crisis and Critical Incident Fundamentals

An after-action review should include which element to support organizational learning?

  1. A confidential memo that is not shared.
  2. Only praise for actions that went well.
  3. A list of individuals to discipline.
  4. A structured review of planned versus actual performance. Correct answer.

Explanation

An after-action review compares what was planned with what actually happened, identifies strengths and gaps, and assigns corrective actions. The goal is learning and improvement, not simply praise or blame. Findings need to be shared with relevant staff so that lessons can be applied.

Question 40Crisis and Critical Incident Fundamentals

During a prolonged crisis, which communication practice best maintains credibility with stakeholders?

  1. Changing the core message frequently to match media headlines.
  2. Denying any organizational responsibility.
  3. Avoiding updates until the crisis is resolved.
  4. Providing regular updates even when new information is limited. Correct answer.

Explanation

Regular updates, even when little new information is available, show that the organization is engaged and accountable. Consistency in the core message builds trust, while frequent changes and silence create uncertainty. Denying responsibility without evidence damages credibility.

Question 41Crisis and Critical Incident Fundamentals

What does the Planning Section do in an Incident Command System organization?

  1. Manages media inquiries.
  2. Collects information and prepares the action plan. Correct answer.
  3. Provides medical care to responders.
  4. Directs tactical resources at the scene.

Explanation

The Planning Section gathers and evaluates incident information and prepares the incident action plan. It also tracks resources and situation status to support command decisions. Tactical direction belongs to Operations, and media inquiries belong to Public Information.

Question 42Crisis and Critical Incident Fundamentals

What is the primary benefit of a mutual aid agreement between organizations?

  1. It gives pre-arranged access to extra resources in a large incident. Correct answer.
  2. It guarantees that all costs will be reimbursed.
  3. It eliminates the need for internal emergency plans.
  4. It transfers legal liability for the incident to another organization.

Explanation

Mutual aid agreements establish terms for requesting and providing resources across organizations before an incident occurs. This reduces delay and uncertainty during a large or prolonged response. They do not transfer liability, guarantee reimbursement, or remove the need for internal planning.

Question 43Crisis and Critical Incident Fundamentals

Which behavior best demonstrates effective crisis leadership in the first hours of an incident?

  1. Setting clear priorities and visible leadership presence. Correct answer.
  2. Delegating all decisions to the legal department.
  3. Avoiding public statements until all facts are confirmed.
  4. Minimizing the seriousness of the event to prevent panic.

Explanation

Effective crisis leadership establishes clear priorities, provides visible direction, and helps the team focus on what matters most. Leaders can communicate honestly about uncertainty without waiting for every fact. Delegating all authority or minimizing the event undermines confidence and coordination.

Question 44Crisis and Critical Incident Fundamentals

Which statement best describes the recovery phase of a crisis?

  1. It is limited to repairing physical infrastructure.
  2. It restores services and addresses human impacts. Correct answer.
  3. It begins only after all investigations are complete.
  4. It is managed exclusively by external agencies.

Explanation

Recovery involves restoring critical services and addressing the human, financial, and organizational impacts of a crisis. It often begins while response activities are still underway and may overlap with investigations. It is not limited to physical repairs or external agencies.

Question 45Crisis and Critical Incident Fundamentals

Which signal most reliably indicates that an emerging issue is escalating toward a crisis?

  1. It is mentioned once in a social media post.
  2. Multiple indicators cross thresholds as controls fail. Correct answer.
  3. A single employee raises a concern.
  4. It is added to a routine risk register.

Explanation

Escalation is most reliably signaled when several indicators cross defined thresholds and normal controls or procedures are no longer sufficient. Single mentions or individual concerns may warrant monitoring but do not by themselves indicate a crisis. Adding an item to a risk register is a normal risk management action.

Question 46Crisis and Critical Incident Fundamentals

Which standard provides a widely recognized framework for business continuity management systems?

  1. ISO 27001.
  2. ISO 22301. Correct answer.
  3. ISO 14001.
  4. ISO 9001.

Explanation

ISO 22301 is the international standard for business continuity management systems. It provides requirements for planning, establishing, implementing, operating, monitoring, and improving a continuity capability. The other standards address quality management, information security, and environmental management respectively.

Question 47Crisis and Critical Incident Fundamentals

A crisis team overestimates the reliability of its existing plan and ignores warning signs. This is best described as which cognitive bias?

  1. Hindsight bias.
  2. Anchoring.
  3. Normalcy bias. Correct answer.
  4. Confirmation bias.

Explanation

Normalcy bias is the tendency to underestimate the likelihood or severity of a disruption and to assume that normal conditions will continue. It can lead teams to discount warning signs and rely too heavily on existing plans. Anchoring, confirmation bias, and hindsight bias involve different judgment patterns.

Question 48Crisis and Critical Incident Fundamentals

In a no-notice crisis, why is a pre-approved crisis communication protocol valuable?

  1. It reduces decision delays and inconsistency under pressure. Correct answer.
  2. It guarantees all facts will be accurate.
  3. It transfers responsibility to the media.
  4. It eliminates the need for legal review.

Explanation

A pre-approved protocol establishes roles, channels, approval steps, and holding statements before an incident occurs. This reduces decision latency and helps ensure messages are consistent under time pressure. It does not guarantee factual accuracy, remove the need for appropriate legal input, or transfer responsibility to the media.

Question 49Crisis and Critical Incident Fundamentals

Which metric best indicates whether a crisis response is achieving its strategic objectives?

  1. The speed of social media likes.
  2. The number of press releases issued and media mentions.
  3. The number of crisis team meetings held each day.
  4. Restoration of critical functions within RTO. Correct answer.

Explanation

Strategic crisis objectives typically focus on protecting people, critical functions, and organizational viability. Restoring critical functions within the recovery time objective provides a meaningful outcome measure. Activity counts such as press releases, social media likes, or meeting frequency do not by themselves demonstrate that objectives are being met.

Question 50Crisis and Critical Incident Fundamentals

A crisis manager has a conflict of interest in an incident affecting a business unit they own. What governance action is most appropriate?

  1. Disclose the conflict and recuse from affected decisions. Correct answer.
  2. Continue but keep the conflict private.
  3. Delegate decisions only to subordinates in the same unit.
  4. Delay disclosure until after the crisis.

Explanation

Conflicts of interest should be disclosed promptly and managed through recusal or independent oversight for decisions where impartiality could be questioned. This protects the integrity of the crisis response and maintains stakeholder trust. Concealment, delegating within the same conflicted unit, or delaying disclosure does not manage the conflict.