Step 1: Brainstorming Risks
Begin the exercise with a five-minute, rapid-fire brainstorming session focused on identifying potential risks. During this time, participants are encouraged to freely jot down each peril they can think of, without any filtering, onto individual post-it notes. Each note should contain only one risk. Once completed, place all the post-it notes on the wall.
The facilitator will then take an active role in organizing these notes. This process involves grouping similar risks together, a method known as binning or sorting. As this happens, the facilitator will engage the group in discussions, prompting them to clarify or expand on their ideas where necessary. This step is crucial for ensuring that all risks are clearly understood and appropriately categorized.
The ultimate goal of this exercise is to compile a comprehensive master list of hazards. These hazards may span various categories, including technological, natural, and economic risks. It is the facilitator’s responsibility to ensure a broad range of risks is considered. If the group seems overly focused on natural hazards, the facilitator should intervene to encourage broader thinking, guiding the participants to consider risks in other categories as well.
Step 2: Defining a ‘Consequential’ Event
The team will collaboratively define the key characteristics of an event that significantly disrupts the organization’s ability to fulfill its mission. This step involves distinguishing between various levels of impact – what differentiates a mere nuisance from a problem, and further, from a crisis or catastrophe. The discussion should aim to identify specific triggers or tipping points that escalate a situation’s severity. It is essential to reach a consensus on these attributes, as they will guide the subsequent risk prioritization process.
Step 3: Prioritizing Risks
Utilizing the master list of hazards compiled earlier, each team member will participate in a voting exercise to determine the most significant risks. This will be conducted on a large wall space where the risks are displayed. Team members will be given sticky dots, allowing them to vote for their top two perils. If a member strongly believes in the critical nature of a particular peril, they may choose to allocate both of their votes to it.
The criteria for ‘top’ risks should be based on their consequential impact on the mission, as defined in the previous step. The process can be adapted for smaller groups or more voting options, if necessary. It is important to note that there is no need to limit the number of risks identified; having a diverse range of perils is beneficial for the next step. However, if the list becomes overly extensive, a culling process can be implemented, though this is optional.
Step 4: Mapping Risks
For this step, a large flip chart or a similar medium will be used to create a ‘quadrant chart.’ This chart will have two axes: ‘Level of Impact’ (ranging from Low to High) and ‘Likelihood’ (ranging from High to Low). The team will engage in a discussion to plot each of the top identified perils on this chart.
This exercise requires careful consideration and consensus-building; if there are disagreements on the placement of a particular risk, consider breaking it down further to address the nuances of the debate. For example, a general risk category like ‘hurricane’ could be divided into more specific categories such as ‘Category 2 hurricane’ versus ‘Category 5 hurricane.’ This distinction will aid in accurately assessing the impact and likelihood of each type of risk.
Step 5: Analyze Results and Act
High Impact, High Likelihood:
There should already be extensive plans, policies, and procedures in place for how to handle the anticipated disruption under these events. Review them to assess their adequacy and ‘freshness’ and if there are perils that are not incorporated into existing documents, then this is a clear gap.
A more advanced analysis will detail the extent, cause, and nature of the gap and look for associations in other gaps. This is a check on the site’s disaster preparedness and forms the foundation of the gap analysis.
Low Impact, Low Likelihood:
A monitoring protocol should be developed to provide preemptive warning when one of these perils becomes either more frequent or more impactful, but in general, resilience planning activity should focus elsewhere.
Low Impact, High Likelihood:
Events or perils in this quadrant may be degrading the function of the site or facility through repeated, almost nuisance level impact. Groundwater intrusion/sub-level flooding or hail damage, for instance, may not ever reach the level of a major mitigative investment but will jeopardize the optimal operation of a facility now and in the future.
A deeper analysis should be performed to understand both the budgetary impact on operations and maintenance now and in the future and the potential effect on dependent systems of continued degradation.
High Impact, Low Likelihood:
These should be rare, high consequence events. Although some of these perils will have existing plans associated with them, by their nature they are anticipated to overwhelm most/all response capabilities through their destructive force.
This is the heart of resilience planning, where the team will begin to identify capabilities and capacities necessary to rapidly return to fulfilling its critical mission, even under harsh conditions. The level of planning undertaken here is largely scenario-based to test the elasticity of a proposed response/capability to various high consequence conditions.
The solutions developed here should augment the response capabilities already outlined in plans and procedures, providing greater agility and adaptability in personnel and infrastructure.
