Stage 2 – risk assessment
Risk assessment is a process of understanding the significance of potential events on the basis of likelihood of an impact. The outcome of description of each risk is based on the reasonable worst-case scenario. It describes a plausible manifestation of the risk and the likely immediate consequences of the event.
Risk assessment is a key part of the emergency planning process and is a statutory responsibility for Category 1 responders. Category 2 responders and other key resilience partners bring a wealth of expertise and knowledge which can enhance the evidence base of the regional risk assessment.
Each region should start with reviewing the 2 national risk products, the NSRA and the SRA, and consider if the risks contained within are relevant to the area or should be excluded. Regions may also want to consider NSRA and SRA risks outside their area which may have a wider impact.
National Security Risk Assessment
The NSRA is produced on a dynamic, cyclical basis by the Cabinet Office as a tool to identify and assess the most serious risks facing the UK. The NSRA assesses the key risks that could potentially damage the safety or security of the UK, or its interests, both domestically and overseas, over a period of 2 to 5 years. Each risk is evaluated in a consistent manner using a reasonable worst-case scenario approach and is assessed in terms of likelihood and impact. It also draws out the consequences should such a scenario occur.
Scottish Risk Assessment
The purpose of the SRA is to help with resilience community in Scotland understand civil contingencies emergencies which Scotland may face within the next 5 years, and to use this to prepare for and respond to these should they occur.
The SRA provides Scottish context for risks where Scotland would be affected differently to the rest of the UK and is designed to supplement the NSRA, while remaining a standalone document.
The SRA is developed using information from the UK NSRA, together with Scottish-specific information from subject matter experts. The SRA uses an adaptation of the methodology used for the NSRA, with impact scales adjusted for Scotland.
It should be noted that the SRA uses impact scores to describe the overall severity of the impacts of an emergency whereas the RRP Risk Preparedness Assessment uses 12 common consequences (which are discussed later) to highlight potential response scenarios.
As a strategic tool, the SRA does not replace or replicate more detailed risk assessment products and evidence, whether that be dynamic intelligence threat assessments or short-term hazards forecasts.
The Scottish Government is currently in the process of updating our approach to civil contingencies risk assessment to simplify the risk landscape and ensure risk information is tailored to Scotland. This will involve a shift from using both the NSRA and SRA to creating a single Scottish Risk Assessment that contains all the risks relevant to Scotland.
Risk analysis
For each NSRA and SRA risk identified, the RRP should consider the extent to which the likelihood and impact applies to their region. The NSRA and SRA set out the reasonable worst-case scenario (RWCS) at national level. The impact of this RWCS may differ at the regional or local level when local expertise and empirical evidence are reviewed. In such cases it is, therefore, necessary that responders conduct their own assessment of risk for their area, using the national NSRA and SRA RWCS as a basis, with the rationale clearly documented and noting that the revised regional likelihood and impact scores should not be higher than the national levels. The RRP should notify the Scottish Government and provide robust evidence if a likelihood score is ever found to be higher than that in the NSRA or SRA.
When considering regional variations, however, there may be some risks unique to a region which could provide a significant challenge but which are not covered in the NSRA or SRA. A risk unique to the region and not dealt with in either the NSRA or SRA would require a risk assessment for that specific risk to be undertaken, guided by the SRA methodology to ascertain likelihood and impacts scores. The RRP should then notify the Scottish Government and supply robust evidence of the risk.
In completing the risk assessement stage, the RRP should make good use of previous RRP RPA work, and in particular consider whether there has been any change in the risk or the preparedness of the region to deal with the consequences of the risk since the previous RRP RPA.
Risk evaluation
The identified risks can be plotted on a risk matrix based on likelihood and impact with the strategy of prioritising planning towards greatest impact. By planning for high impact risks the consequences of lower impact risks are inherently planned for.
Monitoring and reviewing
Risks should be monitored continuously and updated if there is any change in context within the region or if any disruptive events occur.