Not knowing which incident is "the incident" your risk manager is referring to. TFM.