القائمة
Crisis response toolkit — classification, trigger thresholds, escalation tiers, war-room activation, rapid liquidity stress, supply-chain alternate-source, holding-statement, AAR.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
AI governance — EU AI Act Article 9, NIST AI RMF, ISO/IEC 42001 — risk classification, lifecycle gates, model cards, HITL policy, AI incident response.
Adversarial red-team debate protocol — when to use it, the 4-step structure, role-pair recipes, Referee scoring, termination conditions, MAS failure mitigations.
Enterprise risk management — COSO ERM 2017 + ISO 31000 — risk taxonomy, appetite statement, top-risk register, KRIs, Bow-Tie, three-lines-of-defense.
Enterprise executive decision frameworks, memo templates, board protocol, RACI, OKR, escalation rules, dissenting-opinion format.
Deterministic financial tools — WACC, NPV, IRR, payback, EVA, real-options, Monte Carlo, sensitivity, covenant/liquidity checks. The Financial Hardcoding Directive.
M&A playbook — deal thesis, screening, financial/commercial/legal diligence, valuation methods, real-options on deal structure, integration playbook, post-deal KPIs.
| name | crisis-response |
| description | Crisis response toolkit — classification, trigger thresholds, escalation tiers, war-room activation, rapid liquidity stress, supply-chain alternate-source, holding-statement, AAR. |
| allowed-tools | ["Read","Write","Glob","Grep"] |
Used by crisis-warroom, chief-risk-officer, chief-communications-officer, cfo, ciso, coo, csco. Built on the research doc's Masterclass 2 ("Black Swan Capital Preservation").
| Class | Examples | Lead role |
|---|---|---|
| Financial / liquidity | Covenant trip imminent; counterparty default; market dislocation | cfo + chief-risk-officer |
| Operational | Major plant down; supply collapse; logistics shutdown | coo + csco |
| Cyber | Ransomware, breach, IP exfiltration, model attack | ciso |
| Legal / regulatory | Material litigation, sanctions exposure, investigation, license action | clo |
| Reputational | Executive conduct, product harm, social/cultural event | chief-communications-officer + ceo |
| Geopolitical | Tariff, conflict, expropriation, sovereign action | clo + cfo + csco |
| Health / safety | On-site injury / fatality; public-safety product event | coo + clo + chief-communications-officer |
Multi-class events are common (cyber → reputational → regulatory). The crisis-warroom coordinates.
| Tier | Trigger | Tempo | Notified |
|---|---|---|---|
| Yellow | Single KRI at amber; composite risk index trending | Daily standup; 4-hr decision tempo | Function exec + Chief Risk |
| Orange | Multiple amber KRIs OR single red KRI | War-room activated; 2-hr decision tempo | + CEO |
| Red | Material loss event realized or imminent | Continuous war-room; 30-60 min HITL | + Board chair + audit/risk committee chair |
Within first hour:
clo)| Scenario | Revenue Δ | Days to cash exhaustion (base) | Covenant breach? | Recommended action |
|---|---|---|---|---|
| Base | 0% | Monitor | ||
| Mild | −10% | Operating actions only | ||
| Moderate | −25% | Capex freeze + cost-out | ||
| Severe | −50% | Working-capital tightening + hedge | ||
| Catastrophic | −75% or event-driven | Capital action (revolver draw, equity, deal-pivot) |
Monte Carlo applied to historical analog crises (2008, 2020, sector-specific). Report P5 outcome.
| Step | Action | Owner |
|---|---|---|
| 1 | Identify impacted SKUs / categories (with revenue / EBITDA exposure) | csco |
| 2 | Activate pre-tested alternate suppliers per critical-tier list | csco |
| 3 | Reallocate inventory across regions | csco + coo |
| 4 | Mode-shift logistics (air vs. ocean; alternate ports) | csco |
| 5 | Customer commitments triage (defend SLAs vs. renegotiate) | cxo + cro |
| 6 | Working-capital impact computed | csco + cfo |
| 7 | Force-majeure declarations evaluated | clo |
| 8 | Daily status against pre-defined recovery curve | csco |
[Timestamp]
We are aware of [factual description of event in 1 sentence].
Our priority is [primary affected stakeholder — e.g., customer safety, employee wellbeing, data security].
We have:
- [Action 1 we are taking right now]
- [Action 2]
- [Action 3]
We will provide our next update by [specific time].
For verified information, please reference [single channel].
[Named accountable executive] is leading our response.
Avoid: speculation on cause, blame attribution, commitments before facts confirm, jargon, defensive tone.
Cadence: every 2–4 hours during active SEV-1; every 24 hours during sustained event; final after-action public statement on closure.
| Sequence | Audience | Channel | Owner |
|---|---|---|---|
| T+0 | War-room + CEO | Secure channel | Crisis lead |
| T+15min | Board chair (red only) | Secure call | CEO |
| T+30min | Affected internal teams | Secure broadcast | Function leads |
| T+60min | Customers (if affected) | Email + status page | cxo / chief-communications-officer |
| T+60min | Public (if material) | Holding statement | chief-communications-officer |
| T+2hr | Regulators (if required) | Per regulatory channel | clo + chief-compliance-officer |
| T+24hr | Update cycle begins | Per audience | Per owner |
Within 30 days of de-escalation:
# Crisis AAR — [Event name] — [Dates]
## Timeline
[Reconstruction from decision log]
## What happened (root cause)
[Causal chain; no blame; systemic + proximate causes]
## What went well
[Decisions / actions that worked; preserve as patterns]
## What went poorly
[Decisions / actions that didn't; lessons]
## Counter-factuals
[What would we have done differently with hindsight? Was that information available in real time?]
## Systemic mitigations
[New KRIs to add; controls to strengthen; playbook updates; training needs]
## Action items
| Action | Owner | Deadline |
## Reporting
[To board audit/risk committee; to regulator if required]
Crisis artifacts saved to output/crisis/. See crisis-warroom.md for the agent that operates this.