Building a Relative Risk Methodology to Inform Decisionmaking
By: Adam Cox
Government and private-sector stakeholders have been pressing the Department of Homeland Security (DHS), various federal, state, and local agencies, as well as private-sector infrastructure owners to calculate and rank the risks associated with their homeland security missions since the earliest days of the department. The risk of an event occurring is typically defined as the product of the probability, vulnerability, and consequence of the event. Assessing and then ranking risk with any sort of absolute value is a very difficult task without a statistically significant set of data about similar events, such as the decades of actuarial data collected and used by insurance companies. Many of the homeland security risks have, thankfully, never happened or are extremely rare, but they are known to be viable threats.
This inability to know intent and many other key assumptions well in advance and with any certainty makes it difficult to assess the absolute risk—that is, the chances out of 100 that an event will occur—associated with many events. Although determining absolute risk may be a bridge too far, using some key assumptions, it may be possible to determine relative risk, or the likelihood of one event occurring compared to another. Creating a methodology that uses assumptions, such as expected loss of life, the cost to a terrorist of planning and executing an attack, and expected economic impact, could essentially eliminate the uncertainties around intent and likelihood and may allow those across the homeland security enterprise to assess a relative risk among multiple scenarios. One plausible outcome of relative risk assessments could be a demonstration that certain categories of threats and scenarios cluster into ranges of risk. Those clusters, in turn, may reveal differences in how to apply planning, operations, and capabilities to reduce those risks. For instance, one cluster of dangers may be best met with resources focused on the prevention or detection of the threat; in another, where there is no reasonable or affordable level of preventative measures that will stop an event, such as a natural disaster, resources may be best spent on rapid response and recovery capabilities.
Knowing relative risk will help decisionmakers prioritize planning, operations, and capabilities development and should also give them a more rigorous and defensible set of data on which to base and present such strategic and budgetary decisions. Between being able to directly compare two or more events to understanding the effect of investments across the mission spectrum for individual events, developing a relative risk methodology may well provide those responsible for securing the homeland with the information they have been seeking to support strategy and investment decisions for the last decade.