To effectively mitigate and manage risks during a crisis, organizations must implement a combination of preventive and reactive measures:
* Preventive measures: These are proactive steps taken before a crisis to reduce the likelihood of occurrence (e.g., risk assessments, internal controls, security protocols).
* Reactive measures: These are actions taken after a crisis occurs to minimize damage, restore operations, and recover from the event (e.g., business continuity plans, incident response strategies).
* (A) Incorrect - Only preventive measures.
* While prevention is essential, not all crises can be avoided. Organizations also need response mechanisms.
* (B) Incorrect - Alternative and reactive measures.
* Alternative measures (e.g., backup systems) are part of risk management, but without prevention, risks may escalate.
* (C) Incorrect - Preventive and alternative measures.
* Alternative measures (e.g., backup resources) help maintain operations but do not directly address crisis response.
* (D) Correct - Preventive and reactive measures.
* Best practice in risk management includes both preventing crises and responding effectively when they occur.
* IIA's Global Internal Audit Standards - Crisis Management and Business Resilience
* Emphasizes the need for both prevention and response strategies.
* COSO's ERM Framework - Risk Management in Crisis Situations
* Recommends a combination of risk avoidance, mitigation, and crisis response.
* ISO 22301 - Business Continuity Management
* Highlights the importance of preventive controls and reactive response planning.
Analysis of Answer Choices:IIA References and Internal Auditing Standards: