Assessing risks: threats, vulnerabilities, likelihood and impact

1Threat, vulnerability, risk

Three notions not to be confused:

• Threat: what can cause harm (carjacking, kidnapping, shelling, explosive device, riot, disease, road accident).
• Vulnerability: the degree to which the organisation or a person is exposed to that threat, depending on location, movements, profile, assets, procedures and acceptance.
• Risk: the combination of the likelihood that a threat materialises against us and the impact if it does.

The same threat does not create the same risk for everyone. Example: the threat of kidnapping for ransom weighs more heavily on profiles perceived as "profitable" (international staff of certain nationalities, senior national managers, people whose family is perceived as wealthy). Vulnerability also depends on procedures: predictable movements, always at the same times, increase everyone's vulnerability.

2The likelihood × impact matrix

The most widespread method scores each risk on two scales from 1 to 5:

• Likelihood: 1 very unlikely, 2 unlikely, 3 possible, 4 likely, 5 very likely (over a defined period, for example 12 months).
• Impact: 1 negligible, 2 minor (limited material damage), 3 moderate (minor injuries, short interruption), 4 severe (serious injuries, loss of major assets, suspension), 5 critical (death, kidnapping, withdrawal from the country).

Score = likelihood × impact, from 1 to 25. Usual levels: 1 to 4 low, 5 to 9 medium, 10 to 16 high, 20 to 25 very high (thresholds vary between organisations and must be written down).

Note: road accidents often score as high as threats linked to violence, and they are easier to reduce.

3Residual risk and the acceptable threshold

Inherent risk is the risk before measures; residual risk is what remains after the planned measures. The decision is taken on the residual risk, compared with the acceptable threshold set by senior management for the activity concerned.

Example. Carjacking on the northern route: inherent 4 × 4 = 16. Measures: two-vehicle movements, variable timings, no cash or valuables visible, communications with hourly check-in calls, daily update on road conditions from the NGO forum, a non-resistance rule. Estimated likelihood reduced to 2 (vulnerability falls), impact reduced to 3 (non-resistance, rapid assistance). Residual: 2 × 3 = 6, medium level.

If the acceptable threshold for distribution activities is "medium", the activity can continue with these measures. If the measures do not bring the risk below the threshold, the activity must be changed (modality, location, partner) or suspended.

A measure that is written down but not applied reduces no risk. The assessment must state who applies what, and how it is checked.

4The limits of scoring

The matrix is useful but misleading if taken as an exact measurement:

• Scores are judgements, not measurements. Two people may score differently; a reasoned consensus is sought, with national staff.
• Rare, catastrophic events (an attack on a hotel, a bombing of a base) have a low likelihood but an extreme impact: a score of 1 × 5 = 5 classifies them as "medium" even though they require specific plans.
• Cumulative risks: several medium risks combined can amount to an unacceptable situation.
• Risks change: an undated assessment, or one that is eight months old in an unstable context, is worthless.

Good practice: keep a particular eye on any threat with an impact of 5, whatever its likelihood, and prepare a contingency plan for each (kidnapping, armed attack, medical evacuation).

5Profiles and inclusive security

People are not exposed in the same way depending on their profile: nationality, ethnic origin or clan, religion, gender, sexual orientation and gender identity, disability, age, appearance, language. The same place can be safe for one person and dangerous for another.

An inclusive approach to security (developed notably by GISF) consists of:

• taking profiles into account in the risk assessment, without forcing anyone to disclose personal information;
• allowing everyone to report concerns linked to their profile confidentially;
• adapting measures (accommodation, movements, postings), without automatically excluding people from certain positions;
• training managers on these issues.

Example. A national staff member from a minority ethnic group cannot cross certain checkpoints without risk. Rather than excluding him from the project, the team adapts the routes, assigns him to areas where his profile is not exposed, and arranges safe accommodation in case of tension.

6Writing the assessment

A useful security risk assessment contains:

• the area and period covered, the date and the authors;
• a summary of the context (with reference to the analysis);
• the table of threats with likelihood, impact and inherent score;
• for each high or very high risk: measures, persons responsible, residual risk;
• the comparison with the acceptable threshold by type of activity;
• decisions and recommendations (continue, adapt, suspend);
• the date of the next review and the triggers for an early review.

It is approved by the country director (and by headquarters above a certain level of risk) and explained to the staff concerned. It also serves as the basis for the security budget and for staff informed consent.