Menu
Crisis response toolkit โ classification, trigger thresholds, escalation tiers, war-room activation, rapid liquidity stress, supply-chain alternate-source, holding-statement, AAR.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
AI governance โ EU AI Act Article 9, NIST AI RMF, ISO/IEC 42001 โ risk classification, lifecycle gates, model cards, HITL policy, AI incident response.
Adversarial red-team debate protocol โ when to use it, the 4-step structure, role-pair recipes, Referee scoring, termination conditions, MAS failure mitigations.
Enterprise risk management โ COSO ERM 2017 + ISO 31000 โ risk taxonomy, appetite statement, top-risk register, KRIs, Bow-Tie, three-lines-of-defense.
Enterprise executive decision frameworks, memo templates, board protocol, RACI, OKR, escalation rules, dissenting-opinion format.
Deterministic financial tools โ WACC, NPV, IRR, payback, EVA, real-options, Monte Carlo, sensitivity, covenant/liquidity checks. The Financial Hardcoding Directive.
M&A playbook โ deal thesis, screening, financial/commercial/legal diligence, valuation methods, real-options on deal structure, integration playbook, post-deal KPIs.
| name | crisis-response |
| description | Crisis response toolkit โ classification, trigger thresholds, escalation tiers, war-room activation, rapid liquidity stress, supply-chain alternate-source, holding-statement, AAR. |
| allowed-tools | ["Read","Write","Glob","Grep"] |
Used by crisis-warroom, chief-risk-officer, chief-communications-officer, cfo, ciso, coo, csco. Built on the research doc's Masterclass 2 ("Black Swan Capital Preservation").
| Class | Examples | Lead role |
|---|---|---|
| Financial / liquidity | Covenant trip imminent; counterparty default; market dislocation | cfo + chief-risk-officer |
| Operational | Major plant down; supply collapse; logistics shutdown | coo + csco |
| Cyber | Ransomware, breach, IP exfiltration, model attack | ciso |
| Legal / regulatory | Material litigation, sanctions exposure, investigation, license action | clo |
| Reputational | Executive conduct, product harm, social/cultural event | chief-communications-officer + ceo |
| Geopolitical | Tariff, conflict, expropriation, sovereign action | clo + cfo + csco |
| Health / safety | On-site injury / fatality; public-safety product event | coo + clo + chief-communications-officer |
Multi-class events are common (cyber โ reputational โ regulatory). The crisis-warroom coordinates.
| Tier | Trigger | Tempo | Notified |
|---|---|---|---|
| Yellow | Single KRI at amber; composite risk index trending | Daily standup; 4-hr decision tempo | Function exec + Chief Risk |
| Orange | Multiple amber KRIs OR single red KRI | War-room activated; 2-hr decision tempo | + CEO |
| Red | Material loss event realized or imminent | Continuous war-room; 30-60 min HITL | + Board chair + audit/risk committee chair |
Within first hour:
clo)| Scenario | Revenue ฮ | Days to cash exhaustion (base) | Covenant breach? | Recommended action |
|---|---|---|---|---|
| Base | 0% | Monitor | ||
| Mild | โ10% | Operating actions only | ||
| Moderate | โ25% | Capex freeze + cost-out | ||
| Severe | โ50% | Working-capital tightening + hedge | ||
| Catastrophic | โ75% or event-driven | Capital action (revolver draw, equity, deal-pivot) |
Monte Carlo applied to historical analog crises (2008, 2020, sector-specific). Report P5 outcome.
| Step | Action | Owner |
|---|---|---|
| 1 | Identify impacted SKUs / categories (with revenue / EBITDA exposure) | csco |
| 2 | Activate pre-tested alternate suppliers per critical-tier list | csco |
| 3 | Reallocate inventory across regions | csco + coo |
| 4 | Mode-shift logistics (air vs. ocean; alternate ports) | csco |
| 5 | Customer commitments triage (defend SLAs vs. renegotiate) | cxo + cro |
| 6 | Working-capital impact computed | csco + cfo |
| 7 | Force-majeure declarations evaluated | clo |
| 8 | Daily status against pre-defined recovery curve | csco |
[Timestamp]
We are aware of [factual description of event in 1 sentence].
Our priority is [primary affected stakeholder โ e.g., customer safety, employee wellbeing, data security].
We have:
- [Action 1 we are taking right now]
- [Action 2]
- [Action 3]
We will provide our next update by [specific time].
For verified information, please reference [single channel].
[Named accountable executive] is leading our response.
Avoid: speculation on cause, blame attribution, commitments before facts confirm, jargon, defensive tone.
Cadence: every 2โ4 hours during active SEV-1; every 24 hours during sustained event; final after-action public statement on closure.
| Sequence | Audience | Channel | Owner |
|---|---|---|---|
| T+0 | War-room + CEO | Secure channel | Crisis lead |
| T+15min | Board chair (red only) | Secure call | CEO |
| T+30min | Affected internal teams | Secure broadcast | Function leads |
| T+60min | Customers (if affected) | Email + status page | cxo / chief-communications-officer |
| T+60min | Public (if material) | Holding statement | chief-communications-officer |
| T+2hr | Regulators (if required) | Per regulatory channel | clo + chief-compliance-officer |
| T+24hr | Update cycle begins | Per audience | Per owner |
Within 30 days of de-escalation:
# Crisis AAR โ [Event name] โ [Dates]
## Timeline
[Reconstruction from decision log]
## What happened (root cause)
[Causal chain; no blame; systemic + proximate causes]
## What went well
[Decisions / actions that worked; preserve as patterns]
## What went poorly
[Decisions / actions that didn't; lessons]
## Counter-factuals
[What would we have done differently with hindsight? Was that information available in real time?]
## Systemic mitigations
[New KRIs to add; controls to strengthen; playbook updates; training needs]
## Action items
| Action | Owner | Deadline |
## Reporting
[To board audit/risk committee; to regulator if required]
Crisis artifacts saved to output/crisis/. See crisis-warroom.md for the agent that operates this.