Unit V - Risk Assessment / Risk Management - FEMA

1 Unit VRisk Assessment /Risk ManagementBUILDING design FOR HOMELAND SECURITYBUILDING design FOR HOMELAND SECURITYUnit V-2 Unit ObjectivesExplain what constitutes risk using the Threat-Vulnerability Matrix tocapture Assessment a numerical rating for risk and justify the basis forthe top risks for asset threat/hazard pairs thatshould receive measures to mitigate vulnerabilities andreduce design FOR HOMELAND SECURITYUnit V-3 Risk ManagementRisk Management is the deliberate process ofunderstanding risk the likelihood that a threat willharm an asset with some severity of consequences anddeciding on and implementing actions to reduce : Combating Terrorism Threat andRisk Assessments Can Help Prioritize and TargetProgram Investments, April 1998 BUILDING design FOR HOMELAND SECURITYUnit V-4 Assessment Flow ChartAssetValueAssessment(Section )VulnerabilityAssessment(Section )Risk Assessment (Section )IdentifyMitigation Options(Chapters 2 and 3)Threat/HazardAssessment(Section )Cost AnalysisDecision(Risk Management )(Section )Analyze how mitigationoptions affect asset criticalityand ultimately riskAnalyze how mitigationoptions change vulnerabilityand ultimately riskBUILDING design FOR HOMELAND SECURITYUnit V-5 Definition of RiskRisk is a combination of: The probability that an event will occur, and The consequences of its occurrenceRisk =Risk = Asset Value x Threat Rating x Vulnerability RatingTable 1-19.

2 Definition of Risk, page 1-38 BUILDING design FOR HOMELAND SECURITYUnit V-6 Quantifying RiskRisk AssessmentDetermine Asset ValueDetermine Threat Rating ValueDetermine Vulnerability Rating ValueDetermine relative risk for each threat against each assetSelect mitigation measures that have the greatestbenefit/cost for reducing riskBUILDING design FOR HOMELAND SECURITYUnit V-7An Approach to Quantifying RiskRisk =Risk = Asset Value xThreat Rating xVulnerability RatingBUILDING design FOR HOMELAND SECURITYUnit V-89842 Vulnerability Rating2658 Threat Rating8888 Asset Value144384160128 Engineering9977 Vulnerability Rating2348 Threat Rating5555 Asset Value90135140280 AdministrationCBR attackVehiclebombArmed attack(single gunman)Cyber attackFunctionCritical FunctionsExtracted from Table 1-20: Site Functional Pre-AssessmentScreening Matrix, page 1-38 BUILDING design FOR HOMELAND SECURITYUnit V-99842 Vulnerability Rating2343 Threat Rating8888 Asset Value162403224 Structural Systems9953 Vulnerability Rating2344 Threat Rating4444 Asset Value721088048 SiteCBR attackVehiclebombArmed attack(single gunman)Cyber attackFunctionCritical InfrastructureExtracted from Table 1-21: Site Infrastructure SystemsPre- Assessment Screening Matrix, page 1-40 BUILDING design FOR HOMELAND SECURITYUnit V-10 RiskAssessmentResultsBUILDING design FOR HOMELAND SECURITYUnit V-11 Selecting Mitigation MeasuresThree Options.

3 Do nothing and acceptthe a risk assessmentand manage the risk byinstalling reasonablemitigation the building against allthreats to achieve the leastamount of design FOR HOMELAND SECURITYUnit V-12 Mitigation Measurescan be: Procedures Equipment Personnel Capital InvestmentMitigation Measurescan be: Procedures Equipment Personnel Capital InvestmentMitigation MeasuresA mitigation measure is an action, device, or system usedto reduce risk by affecting an asset, threat, design FOR HOMELAND SECURITYUnit V-13 ASSETSR elocateReduceassetsPlan forrecoveryInsureReduce theimpact on theassetsMeasures to Reduce RiskTHREATSD eterDetectDenyDevalueAffect thethreat posed bythe adversaryVULNERABILITIESC oncealReduceEliminateAffect the degreeof vulnerabilityBUILDING design FOR HOMELAND SECURITYUnit V-14 Achieving Building Security.

4 Planning FactorsBuilding security integrates multiple concepts is to achieve a balanced approach thatcombines aesthetics, enhanced security, and use ofnon-structural design FOR HOMELAND SECURITYUnit V-15 Process ReviewCalculate the relative risk for each threat against eachassetIdentify the high risk areasIdentify Mitigation Options to reduce the riskBUILDING design FOR HOMELAND SECURITYUnit V-16 SummaryRisk DefinitionCritical Function and Critical Infrastructure MatrixNumerical and color coded risk scaleIdentify Mitigation OptionsBUILDING design FOR HOMELAND SECURITYUnit V-17 Unit V Case Study ActivityRisk RatingBackgroundFormula for determining a numeric value risk for each asset-threat/hazard pair:Risk = Asset Value x Threat Rating x Vulnerability RatingRequirements: Vulnerability Rating ApproachUse worksheet tables to summarize HIC asset, threat, and vulnerabilityassessments conducted in the previous activitiesUse the risk formula to determine the risk rating for each asset-threat/hazard pair for: Critical Functions Critical Infrastructur