How do you conduct a risk analysis for a potential emergency scenario?

The process described is mostly similar to traditional risk management strategies. The critical problem in this model is personal bias in the spectrum of possibilities. In other words, what are you not thinking of , what to you is not even plausible (Black swans for example). Two possible solutions; involve others, adhere to their opinions and ask them to challenge you. A different way of minimizing biases is to describe in detail (!) the worst case scenario and best case, perfect scenario. That becomes your range of possibilities.

Identifying the hazards can often start with a thorough S.W.O.T. analysis. Look for the strengths, weaknesses, opportunities, and threats to a the building, area, or system you and your team protect. Be mindful to think beyond active shooter when identifying a potential threat (e.g., does the lobby floor become overly slippery when it rains, thereby posing an increase threat of slips trips and falls?). Couching your S.W.O.T. analysis against historic data also helps your team focus on the most likely risks rather than the unlikely ones (e.g., if your office is right off a major highway, the chances of protesters arriving on foot are extremely slim, but a traffic accident disrupting travel to and from the office may be a regular risk).

Assessment of likelihood may be derived from historical or anecdotal information. For example, being in Oklahoma, I’ve had to respond to over 50 severe weather events in my 20 years of volunteer emergency management. We have an after-event meeting to determine how good our response was and develop action plans resulting from this.

Numbers shut down arguments. Or more accurately, numbers should shut down arguments (there are always people that will still argue that 2+2 may equal 4, but they expect a result of 5). Your qualitative observations and the historical trends for the building, area, or system you protect can always be calculated as quantitative data. Stating that the likelihood of X is 20% and the likelihood of Y is 80% means you can focus your time and resources on risk Y. When pushed for further detail to prove your reasoning your qualitative observations will back up your numbers.

Here's where we implement small changes that have a large impact. Assessing the likelihood of occurrence using the current risk assessment tools (for healthcare emergency management) does not calculate statistical probability using historical events. Probability is a value from 0 to 1. To remedy this, we've created a tool that correlates P(r) with 1-5 values for more accurate prediction of risk to support emergency and continuity planning. Our combined HVA BIA Tool will be available on 17 July 2023.

Tolerability and priority are Life, property, reputation, and revenue. The highest priority and lowest risk tolerability are the life of the people in your care. Protecting and maintaining the safety of the property and physical infrastructure people inhabit (work or live in, or commute on) is always second on the list of priorities. Reputation (social implications) needs to be acknowledged, however, if we treat all people in our care with respect and are looking out for their safety, often this bolsters our good reputation. Lastly, we do need to be aware of how an incident will impact the revenue stream. Loss of revenue will always be a lower priority than loss of life and will always have the highest tolerability.

In addition to creating controls that are feasible, effective, and appropriate for each risk we need to teach our teams how to implement said controls and inform the people we protect that these controls are in place. Too often with emergency management bystanders see a lot of “milling about”, and because they watch too many action movies, they don’t know that the “milling about” is actually a coordinated response. Just by letting them know that is what we are doing goes a long way to reducing the Monday morning quarterbacking. Your controls will also never succeed if you don’t train and drill your team in how to implement them. Train, trust, and audit, so you don’t have to be there at all hours, because your team knows how to respond.

I really like to avoid thinking about vulnerabilities as “gaps”. This leads to dangerous binary thinking—we got this matter covered or we do not. Preparedness or Security are a continuum. Also, the idea that we won’t bother improving things when we think we have achieved our rough guess about the level of risk is unhelpful. If a weakness can be simply mitigated at minimum cost and hassle why not do it? Our estimate of threats, vulnerabilities, consequences, and probabilities will often be wrong. Finally, I believe that gap analysis, root cause analysis, and SWOT are spectacularly unhelpful in many cases.

Remember that we need to quantify our qualitative data. If your goal is to reduce the white noise of card reader door alarms, so the notifications of “door forced open” are less often a result of high foot traffic and too short a delay then run the calculation across all the days the facility is open, and that door is in use. If the facility is open 7 days a week, 24 hours a day, do not run calculations for 9-5 M-F only. If your analysis is planned with too limited a scope, then the data collected won’t support the actual use case.