Foundations of Crisis Management and Organizational Resilience

Introduction

Organizations operate in environments characterized by uncertainty, interdependence and rapid change. A cyberattack can interrupt essential services; a flood can damage facilities and supply networks; a product failure can undermine public trust; and a pandemic can simultaneously affect employees, customers, markets and institutions. Such events are not managed effectively through routine procedures alone. They require leadership that can interpret ambiguous information, prioritize competing demands, communicate credibly and coordinate action under pressure.

Crisis management is therefore both a managerial discipline and an organizational capability. It concerns the anticipation, prevention, preparation for, response to and recovery from events that threaten people, assets, operations, legitimacy or strategic objectives. Organizational resilience extends this concern by asking how an organization can absorb disruption, adapt while conditions are changing and continue to develop after adversity.

This chapter establishes the conceptual foundation for crisis management and resilience. It distinguishes related terms, explains crisis typologies and causes, examines consequences, and presents the prevention–preparedness–response–recovery lifecycle. The discussion is directed toward leaders who must make decisions in conditions where information is incomplete, time is limited and the costs of error may be significant.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Define crisis, emergency, disaster, disruption, vulnerability, risk, continuity and resilience.
2. Distinguish crisis management from routine management.
3. Classify crises according to source, speed, scope and organizational responsibility.
4. Explain how hazards, vulnerabilities, exposure and capacity interact to produce impacts.
5. Apply the prevention–preparedness–response–recovery lifecycle.
6. Evaluate leadership, governance, ethical and communication issues in crisis situations.
7. Recommend practical measures for strengthening organizational resilience.

1. The Meaning of Crisis

A crisis is a significant event or developing situation that threatens an organization’s vital interests, creates uncertainty and requires urgent decisions under conditions of limited control. Three features are especially important.

Threat means that important objectives or values are endangered. These may include life and safety, service delivery, financial viability, reputation, legal standing, environmental integrity or public trust.

Uncertainty means that decision-makers do not possess complete or reliable information about what has happened, what may happen next or which intervention will work.

Time pressure means that delay may increase harm or reduce available options. A crisis is not simply a bad event; it is a situation in which ordinary decision processes are insufficient for the stakes and speed involved.

A useful conceptual representation is:

This is not a measurement formula and should not be used to calculate a numerical score. It is a reasoning aid: a situation becomes more crisis-like when the threat is greater, uncertainty is higher and decisions are more time-sensitive. Different organizations may therefore experience the same event differently. A short power outage may be routine for a large data centre with redundant systems but a crisis for a small hospital with no backup supply.

A crisis may be sudden, such as an explosion, or it may develop gradually, such as financial deterioration, cultural misconduct or climate-related stress. It may originate inside or outside the organization, and it may be caused by human action, technical failure, natural processes or combinations of these factors.

2. Related Concepts and Their Boundaries

The following terms are related but should not be treated as interchangeable.

Risk and crisis

Risk exists before an event and may be managed through avoidance, reduction, transfer, acceptance or monitoring. A crisis is an active or imminent condition in which risk has materialized, escalated or become sufficiently threatening to require exceptional coordination. Effective risk management reduces the probability or consequences of crises, but it cannot eliminate uncertainty.

A common risk expression is:

This expression is a simplified prioritization device rather than a universal law. It assumes that likelihood and consequence can be estimated on meaningful scales and that decision-makers are willing to combine them. Some risks are difficult to quantify, consequences may be non-linear, and low-probability events may have catastrophic effects. Qualitative ratings, scenario analysis and expert judgment are therefore often necessary.

Emergency and crisis

An emergency normally emphasizes immediate protection and operational control: rescue, evacuation, first aid, fire suppression or containment. A crisis includes these concerns but also involves strategic choices, stakeholder confidence, legitimacy and the future of the organization. An emergency can become a crisis when it overwhelms capacity, attracts intense public attention or reveals serious governance failure.

Disaster and disruption

A disruption can be relatively limited and temporary. A disaster is distinguished by scale, severity and the inability of the affected system to cope without substantial external support. The classification is contextual. An event that is a disaster for one municipality may be a manageable disruption for a national organization with distributed capacity.

Continuity and resilience

Business or organizational continuity focuses on maintaining critical functions at an acceptable level during and after disruption. Resilience is broader. It includes anticipation, adaptation, learning, relationships, culture and the ability to transform arrangements that no longer work. Continuity asks, “How do we keep essential services operating?” Resilience also asks, “How do we become better able to function in a changed environment?”

3. Crisis Management and Routine Management

Routine management generally operates through established objectives, roles, budgets, procedures and reporting cycles. Information is comparatively stable, authority is familiar and decisions can often be reviewed before implementation. Crisis management differs in several important respects.

Crisis management should not be understood as purely improvised action. Effective crisis leadership depends on preparation, role clarity, training, tested plans and pre-established relationships. However, plans cannot anticipate every detail. Leaders must combine procedural discipline with judgment and adaptation.

A central challenge is the tension between speed and accuracy. Waiting for perfect information may cause unacceptable delay, while acting on unverified information may create secondary harm. A practical approach is to make decisions that are proportionate, reversible where possible, based on the best available evidence and accompanied by explicit review points.

4. Crisis Typologies

Typologies help leaders avoid treating every crisis identically. They are analytical tools, not rigid boxes.

4.1 Source-based typology

Natural and environmental crises include floods, earthquakes, storms, droughts, wildfire and disease outbreaks. Although the initiating hazard may be natural, human decisions about land use, infrastructure, warning systems and resource distribution influence consequences.

Technological and infrastructure crises include power failures, industrial accidents, transport failures, telecommunications outages and software breakdowns. Interdependence can create cascading effects: a failure in energy supply may affect water, healthcare, communications and finance.

Human-caused and intentional crises include terrorism, sabotage, fraud, violence and deliberate cyberattacks. These events often involve security, law enforcement and ethical concerns in addition to operational response.

Organizational and managerial crises include corruption, misconduct, unsafe practices, poor governance, financial collapse and leadership failure. Such crises may be slow-building and can damage trust even when immediate physical harm is limited.

Reputational and relational crises arise when stakeholders believe that an organization has acted irresponsibly, dishonestly or unfairly. The factual event and the meaning assigned to it may both determine the severity of the crisis.

4.2 Speed-based typology

Sudden crises provide little warning and demand immediate action. Emerging crises develop through weak signals and may permit prevention if leaders recognize them early. Slow-burning crises, such as toxic culture or climate exposure, can be especially difficult because normal performance may conceal accumulating vulnerability.

4.3 Scope-based typology

A crisis may be local, enterprise-wide, sectoral, national or transnational. Scope is not determined only by geography. A cyber incident may affect an organization globally even when the physical location of the initiating event is small. Interconnected supply chains, financial systems and digital platforms can transmit impacts rapidly across boundaries.

4.4 Responsibility-based typology

Stakeholders often distinguish among victim crises, accidental crises and preventable crises. This distinction matters because perceived responsibility influences trust, blame and communication expectations. An organization that is viewed as a victim may receive sympathy; one seen as negligent may face sanctions, litigation and lasting legitimacy loss. Leaders must therefore examine not only what happened but also what the organization knew, controlled and failed to do.

5. Causes and the Risk Landscape

Crises rarely result from a single isolated cause. They commonly emerge from interactions among hazards, exposure, vulnerability and insufficient capacity. A useful conceptual model is:

Here, f indicates a relationship rather than a specified equation. Hazard refers to the damaging agent; exposure refers to what lies in harm’s way; vulnerability refers to susceptibility; and capacity refers to resources and capabilities available to anticipate, cope and recover. Greater capacity can reduce impact, while greater exposure or vulnerability can increase it.

The “Swiss cheese” perspective on accidents illustrates how multiple defensive layers may contain weaknesses. A crisis occurs when the weaknesses align: inadequate training, ambiguous responsibility, defective equipment, poor maintenance and weak supervision may combine with a triggering event. This perspective discourages simplistic searches for a single person to blame and encourages examination of systemic conditions.

Common contributing factors include:

• overconfidence and normalization of deviance;
• poor information sharing between departments;
• unrealistic performance targets;
• dependence on a single supplier or digital platform;
• weak maintenance and inadequate investment;
• unclear accountability and fragmented governance;
• groupthink and suppression of dissent;
• ineffective regulatory oversight;
• social, economic or environmental inequality; and
• failure to learn from previous incidents and near misses.

Leaders should distinguish root causes from triggers. A trigger is the immediate event; root causes are deeper conditions that made severe consequences possible. Correcting only the trigger may leave the system vulnerable to recurrence.

6. Impacts of Crisis

Crisis impacts are multidimensional and may unfold over different time horizons.

Human impacts include death, injury, illness, displacement, psychological trauma and loss of livelihood. Protection of life and dignity is the first ethical priority.

Operational impacts include loss of facilities, equipment, data, workforce availability, suppliers, transport routes or information systems. Interdependencies may produce cascading failures.

Financial impacts include direct damage, emergency expenditure, lost revenue, contractual penalties, insurance costs, litigation and increased cost of capital.

Reputational impacts include reduced confidence among customers, employees, regulators, investors and communities. Reputation is not merely an image; it affects access to resources and cooperation.

Legal and regulatory impacts may include investigations, sanctions, license restrictions, civil claims and criminal proceedings. Records of decisions and communications may become evidence.

Social and environmental impacts may include inequality, community conflict, pollution and long-term ecological harm.

Impact assessment should consider both direct and indirect effects. For example, a factory closure may directly reduce production but indirectly disrupt suppliers, employees, local tax revenue and customer service. Leaders should also consider vulnerable groups, including people with disabilities, low-income communities, temporary workers and those without access to digital communication.

7. The Prevention–Preparedness–Response–Recovery Lifecycle

The lifecycle model organizes crisis capability into four connected phases. In practice, the phases overlap and learning should circulate continuously rather than follow a one-way sequence.

Prevention and mitigation

Prevention seeks to stop a harmful event from occurring. Mitigation reduces its probability or consequences when complete prevention is impossible. Measures include hazard elimination, safer design, cybersecurity controls, protective infrastructure, supplier diversification, ethical safeguards and regulatory compliance.

Prevention is often difficult to justify financially because its success is invisible: the crisis that does not occur generates no dramatic evidence of benefit. Leaders must therefore use scenario analysis, audit findings, near misses and vulnerability assessments to support investment.

Preparedness

Preparedness develops the capability to respond effectively. It includes:

• business impact analysis and prioritization of critical services;
• emergency and continuity plans;
• clear roles, authority and escalation thresholds;
• contact lists and mutual-aid agreements;
• emergency supplies and backup facilities;
• staff training, exercises and simulations;
• warning and notification systems;
• accessible communication protocols; and
• arrangements for records, data protection and decision logging.

A plan is not evidence of preparedness unless people understand it and systems have been tested. Exercises should examine assumptions, reveal coordination problems and include realistic uncertainty. They should not become theatrical demonstrations designed only to confirm that existing plans are adequate.

Response

Response begins when an incident is detected and continues until immediate threats are controlled and essential functions stabilized. Initial priorities normally include:

1. protecting life and safety;
2. establishing situational awareness;
3. activating appropriate authority and coordination;
4. containing immediate hazards;
5. preserving critical services and assets;
6. communicating verified, useful information; and
7. identifying emerging risks and resource requirements.

Incident management structures often separate strategic direction, tactical coordination and operational execution. The precise structure varies by jurisdiction and sector, but effective arrangements require a clear incident lead, functional responsibilities, reliable information flows and a method for resolving conflicts.

Crisis communication should be timely, accurate, empathetic and actionable. Organizations should state what is known, what is not known, what is being done and when further information will be provided. Speculation, excessive reassurance and blaming others without evidence can damage credibility.

Recovery

Recovery restores, renews or transforms affected functions. Short-term recovery may involve restoring facilities, paying employees and re-establishing services. Long-term recovery may require redesigning infrastructure, supporting affected communities, addressing trauma, rebuilding trust and changing governance.

The principle of “build back better” means that recovery should reduce future vulnerability rather than reproduce the conditions that created the crisis. Recovery decisions should be participatory, evidence-based and sensitive to distributional effects. A technically efficient solution may be socially unjust if it excludes affected communities.

Learning and adaptation

Although learning is often presented as part of recovery, it should occur throughout the lifecycle. After-action reviews should ask:

• What was expected to happen?
• What actually happened?
• Which decisions helped or hindered?
• What signals were missed?
• Which assumptions proved false?
• What changes in policy, capability or culture are required?

Learning is meaningful only when findings are assigned to responsible owners, funded and revisited. Blame-oriented reviews suppress information; improvement-oriented reviews maintain accountability while examining system conditions.

8. Organizational Resilience

Resilience is not the ability to remain unchanged. It is the capacity to continue fulfilling essential purpose while absorbing disturbance, adapting to new conditions and, when necessary, transforming structures or strategies.

A resilient organization commonly demonstrates four capabilities:

Anticipation: detecting weak signals, monitoring dependencies and imagining plausible futures.

Absorption: limiting immediate harm through redundancy, reserves, protective systems and practiced response.

Adaptation: modifying priorities, processes, roles and resource allocation as conditions change.

Renewal or transformation: learning from disruption and redesigning arrangements that are no longer suitable.

Resilience has both technical and social dimensions. Backup servers, flood barriers and alternative suppliers are technical capabilities. Trust, leadership, psychological safety, collaboration and community relationships are social capabilities. Excessive efficiency can reduce resilience if it removes all slack, redundancy and time for reflection.

Resilience also involves trade-offs. Redundancy may increase cost; decentralization may reduce standardization; rapid adaptation may create compliance risks; and strong central control may slow local action. Leaders should determine which functions must be standardized and which require local discretion.

9. Leadership, Governance and Ethics

Crisis leadership is fundamentally a process of sense-making and mobilization. Leaders must interpret ambiguous signals, frame priorities, authorize action, coordinate expertise and maintain trust. Effective leaders do not pretend to possess certainty. They communicate confidence in the response while acknowledging uncertainty about the situation.

Governance establishes who is accountable, who may decide, how conflicts are resolved and how performance is reviewed. Crisis arrangements should clarify the relationship between executives, boards, incident managers, regulators, emergency services and external partners.

Ethical responsibilities include:

• prioritizing life, dignity and non-discrimination;
• allocating scarce resources fairly;
• protecting personal and sensitive information;
• communicating honestly without creating avoidable panic;
• considering employees, communities and future generations;
• avoiding exploitation of emergency powers; and
• documenting decisions for accountability.

Legal compliance is a minimum standard, not always a complete ethical solution. An action may be lawful yet unfair, inaccessible or harmful to a vulnerable group. Conversely, emergency conditions may require temporary measures that must be clearly authorized, proportionate, time-limited and subject to review.

Technology can improve detection, coordination and analysis. Artificial intelligence may support anomaly detection, forecasting, translation, logistics and information triage. However, AI outputs can reproduce bias, conceal uncertainty or generate convincing misinformation. Human accountability, data governance, cybersecurity, explainability and verification remain essential. AI should support—not replace—responsible judgment.

10. Illustrative Case: Riverside Medical Network Cyber Disruption

Background

Riverside Medical Network is a fictional regional healthcare organization operating three hospitals, outpatient clinics and a shared electronic health-record system. It has invested in cybersecurity but relies on a central digital platform and a small specialist team.

Problem

On a Monday morning, staff discover that patient records are inaccessible and several systems are displaying encrypted files. Appointment scheduling, laboratory interfaces and some medication systems are unavailable. Rumours spread on social media that patient data have been stolen. The immediate disruption is technical, but the situation rapidly becomes a crisis because patient safety, privacy, public confidence and regulatory obligations are threatened.

Analysis

The initiating hazard is a malicious cyberattack. Exposure is high because the network is centralized. Vulnerabilities include dependence on interconnected systems, limited specialist staffing and insufficiently tested manual procedures. Capacity exists in the form of an incident response plan, backup data and relationships with government cyber authorities, but the organization has not recently tested recovery from a full system outage.

The executive team must distinguish operational response from strategic crisis management. Technical specialists isolate affected systems, while clinical leaders prioritize urgent care and medication safety. Communications staff issue verified updates to employees and the public. Legal and privacy specialists assess notification duties. The board monitors risk and accountability without interfering with incident command.

Approach and solution

The network activates its response structure and adopts the following priorities:

1. protect patients by moving critical processes to verified manual procedures;
2. isolate compromised devices and preserve forensic evidence;
3. use predefined downtime protocols for medication, laboratory and emergency care;
4. engage external cybersecurity and law-enforcement partners;
5. communicate what is known without confirming unverified claims;
6. restore systems in a controlled sequence based on clinical criticality; and
7. provide staff welfare support because prolonged manual work increases fatigue and error risk.

After stabilization, Riverside conducts a recovery review. It segments networks, introduces stronger privileged-access controls, increases offline backup testing, establishes reciprocal support with another health network and exercises clinical downtime procedures every six months.

Outcome and learning points

The case illustrates that resilience is not equivalent to preventing every attack. Riverside’s performance depends on its ability to maintain safe care while technology is unavailable, coordinate internal and external actors, communicate credibly and learn after recovery. It also demonstrates that continuity planning must include people and processes, not only backup hardware.

11. Challenges and Limitations of Crisis Frameworks

Lifecycle models and typologies are useful, but they simplify reality. Phases overlap; recovery may begin during response; and prevention may remain possible after an incident has started. Classifications can also create false confidence if managers assume that every event fits a known category.

Risk assessments are limited by incomplete data, uncertain assumptions and changing conditions. Quantitative scores can disguise value judgments, especially when human life, cultural heritage or ecological damage is reduced to a single number. Plans may become obsolete, and excessive procedural detail may hinder improvisation.

Organizations can also produce “resilience theatre”: policies, dashboards and exercises that create an appearance of readiness without changing underlying vulnerabilities. Genuine capability requires resources, leadership attention, skilled people, inclusive design, repeated practice and evidence of improvement.

12. Professional Best Practices

A mature crisis and resilience program should:

• integrate risk management, continuity, emergency management, security and strategic planning;
• identify critical services and their dependencies;
• maintain clear authority and escalation criteria;
• protect vulnerable people and design accessible communications;
• test plans through realistic, cross-functional exercises;
• develop trusted relationships before crises occur;
• preserve redundancy and avoid dangerous single points of failure;
• use near misses as learning opportunities;
• maintain accurate contact, asset and resource information;
• establish communication protocols for uncertainty and correction;
• review legal, ethical and privacy obligations;
• measure whether corrective actions are completed; and
• treat resilience as an ongoing organizational capability rather than a one-time project.

Chapter Summary

A crisis is a threatening, uncertain and time-critical situation that challenges important organizational objectives and exceeds the adequacy of routine management. Emergencies emphasize immediate action, disasters involve severe disruption beyond local coping capacity, and disruptions refer more generally to interruptions of normal operations. Risk concerns uncertainty before or around an event; vulnerability concerns susceptibility to harm; continuity concerns maintaining essential functions; and resilience concerns anticipating, absorbing, adapting to and learning from disturbance.

Crises may be natural, technological, intentional, organizational, reputational or hybrid. Their impacts may be human, operational, financial, legal, social and environmental. Consequences arise through interactions among hazard, exposure, vulnerability and capacity rather than from triggers alone.

The prevention–preparedness–response–recovery lifecycle provides a practical organizing framework. Prevention and mitigation reduce likelihood or consequence; preparedness develops capability; response protects life and stabilizes essential functions; and recovery restores, improves and transforms. Leadership, governance, ethical judgment, communication and learning connect all phases. Organizational resilience depends on both technical safeguards and social capabilities, including trust, competence, collaboration and adaptive capacity.

Key Terms

Crisis: A threatening, uncertain and time-critical situation requiring decisions beyond routine management.

Emergency: A serious event requiring immediate action within an established response framework.

Disaster: A severe disruption that exceeds the affected system’s capacity to cope with its own resources.

Disruption: An interruption or degradation of normal operations.

Hazard: A potentially damaging source, condition or event.

Risk: The effect of uncertainty on objectives.

Vulnerability: Susceptibility to harm arising from weaknesses or inadequate safeguards.

Exposure: People, assets or activities located where a hazard may affect them.

Capacity: Resources and capabilities available to anticipate, respond to and recover from disturbance.

Continuity: The capability to maintain or recover acceptable delivery of critical functions.

Resilience: The ability to anticipate, absorb, adapt to and recover from disturbance while preserving essential purpose.

Prevention: Actions intended to stop a harmful event from occurring.

Mitigation: Actions intended to reduce the likelihood or consequences of harm.

Preparedness: Development of plans, resources, skills and relationships for effective response.

Response: Actions taken to protect life, control immediate threats and stabilize operations.

Recovery: Restoration, renewal or transformation following disruption.

Cascading failure: A sequence in which one failure produces failures in connected systems.

Crisis communication: The planned and responsive exchange of accurate, timely and useful information during a crisis.

Business impact analysis: A structured assessment of how disruption affects critical functions and dependencies.

After-action review: A systematic examination of performance and lessons following an incident or exercise.

Review Questions

Short Answer Questions

1. What three characteristics distinguish a crisis from an ordinary operational problem?
2. Differentiate vulnerability from exposure.
3. Why is continuity narrower than resilience?
4. What is the purpose of preparedness exercises?
5. Identify two ethical responsibilities of crisis leaders.

Long Answer Questions

1. Explain the differences among risk, emergency, crisis, disruption and disaster, using organizational examples.
2. Discuss how the prevention–preparedness–response–recovery lifecycle supports organizational capability.
3. Analyze the role of leadership and communication when information is incomplete.
4. Explain how organizational vulnerabilities can transform a hazard into a major crisis.
5. Evaluate the relationship between continuity planning and organizational resilience.

Analytical / Application Questions

1. A university’s learning platform fails during final examinations because of a vendor outage. Classify the situation, identify exposures and vulnerabilities, and recommend actions across the four lifecycle phases.
2. A manufacturing organization has a single overseas supplier for a safety-critical component. Use the concepts of risk, capacity and resilience to propose a prioritized improvement plan.
3. Following a chemical spill, public reports allege that managers ignored earlier maintenance warnings. Design a crisis communication and governance response that addresses immediate safety, accountability and long-term trust.

Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes a crisis from a routine operational problem?

A. It involves a scheduled management review.

B. It threatens important objectives under uncertainty and time pressure.

C. It always results from a natural hazard.

D. It can be handled exclusively by one department.

Correct Answer: B. It threatens important objectives under uncertainty and time pressure.

Question 2

Which term refers to susceptibility to harm caused by weaknesses in systems, people or processes?

A. Exposure

B. Capacity

C. Vulnerability

D. Continuity

Correct Answer: C. Vulnerability

Question 3

A hospital continues emergency care using manual procedures while its digital records system is unavailable. This most directly demonstrates:

A. Continuity

B. Reputational recovery

C. Hazard elimination

D. Routine budgeting

Correct Answer: A. Continuity

Question 4

Which lifecycle phase includes exercises, contact lists, training and continuity plans?

A. Prevention

B. Preparedness

C. Response

D. Recovery

Correct Answer: B. Preparedness

Question 5

What is the primary purpose of mitigation?

A. To eliminate all uncertainty

B. To assign blame after an incident

C. To reduce the likelihood or consequences of harm

D. To replace strategic leadership with automation

Correct Answer: C. To reduce the likelihood or consequences of harm

Question 6

Which statement best describes organizational resilience?

A. The ability to avoid every possible disruption

B. The ability to preserve exactly the same processes after disruption

C. The ability to anticipate, absorb, adapt and learn from disturbance

D. The ability to respond only through prewritten procedures

Correct Answer: C. The ability to anticipate, absorb, adapt and learn from disturbance

Question 7

A flood affects a small organization more severely than a large organization because the smaller organization has no backup facility or alternative supplier. This illustrates the importance of:

A. Capacity and vulnerability

B. Reputation and branding

C. Routine reporting cycles

D. Legal terminology alone

Correct Answer: A. Capacity and vulnerability

Question 8

Which communication practice is most appropriate during an evolving crisis?

A. Provide verified facts, acknowledge uncertainty and state when updates will follow.

B. Wait until every detail is confirmed before communicating.

C. Use confident claims even when evidence is unavailable.

D. Avoid communicating to prevent public concern.

Correct Answer: A. Provide verified facts, acknowledge uncertainty and state when updates will follow.

Question 9

Why can a low-probability event still deserve significant risk attention?

A. Because likelihood is irrelevant in every decision.

B. Because severe consequences may justify preparation despite low likelihood.

C. Because all low-probability events are certain to occur.

D. Because risk is determined only by reputation.

Correct Answer: B. Because severe consequences may justify preparation despite low likelihood.

Question 10

Which activity best supports learning after a crisis?

A. Deleting incomplete incident records

B. Conducting an after-action review and assigning corrective actions

C. Assuming that the trigger was the only cause

D. Replacing all procedures without analysis

Correct Answer: B. Conducting an after-action review and assigning corrective actions