Building a Relative Risk Methodology to Inform Decisionmaking

Home / FYSA / Building a Relative Risk Methodology to Inform Decisionmaking

Building a Relative Risk Methodology to Inform Decisionmaking
By: Adam Cox
@csis_isp

Government and private-sector stakeholders have been pressing the Department of Homeland Security (DHS), various federal, state, and local agencies, as well as private-sector infrastructure owners to calculate and rank the risks associated with their homeland security missions since the earliest days of the department. The risk of an event occurring is typically defined as the product of the probability, vulnerability, and consequence of the event. Assessing and then ranking risk with any sort of absolute value is a very difficult task without a statistically significant set of data about similar events, such as the decades of actuarial data collected and used by insurance companies. Many of the homeland security risks have, thankfully, never happened or are extremely rare, but they are known to be viable threats.

This inability to know intent and many other key assumptions well in advance and with any certainty makes it difficult to assess the absolute risk—that is, the chances out of 100 that an event will occur—associated with many events. Although determining absolute risk may be a bridge too far, using some key assumptions, it may be possible to determine relative risk, or the likelihood of one event occurring compared to another. Creating a methodology that uses assumptions, such as expected loss of life, the cost to a terrorist of planning and executing an attack, and expected economic impact, could essentially eliminate the uncertainties around intent and likelihood and may allow those across the homeland security enterprise to assess a relative risk among multiple scenarios. One plausible outcome of relative risk assessments could be a demonstration that certain categories of threats and scenarios cluster into ranges of risk. Those clusters, in turn, may reveal differences in how to apply planning, operations, and capabilities to reduce those risks. For instance, one cluster of dangers may be best met with resources focused on the prevention or detection of the threat; in another, where there is no reasonable or affordable level of preventative measures that will stop an event, such as a natural disaster, resources may be best spent on rapid response and recovery capabilities.

Knowing relative risk will help decisionmakers prioritize planning, operations, and capabilities development and should also give them a more rigorous and defensible set of data on which to base and present such strategic and budgetary decisions. Between being able to directly compare two or more events to understanding the effect of investments across the mission spectrum for individual events, developing a relative risk methodology may well provide those responsible for securing the homeland with the information they have been seeking to support strategy and investment decisions for the last decade.

Adam Cox is a visiting fellow at the Center for Strategic and International Studies (CSIS), working on homeland security and technology-related issues. Other posts by .

Comments(1)

  • steven ault
    June 30, 2015, 1:33 pm  Reply

    The California Comparative Risk Project published its final report in 1994, a 3-year effort to identify & rank important risks to the state’s future (environmental, health), involving expert committees & stakeholder & community meetings. See the report http://digitalcommons.law.ggu.edu/pubs/31/. This can inform how to apply this tool in a different context -homeland security

Leave a Comment