Key takeaway — for each risk plan, risk managers should also have a crisis plan.