RiskUKSeptember2017

The Security Institute’s View
and, in turn, risk and resilience management –
are related.
It’s not enough for C-level directors of risk to
consider risks in isolation. They should be
focused just as much on resilience measures.
Furthermore, resilience to organisational
interruption and resilience for organisational
response and recovery must be proportional.
Resilience measures are not cheap. Rather,
they’re investments which need justification as
well as suitable resourcing. By linking risk and
resilience management, it’s then possible to
create a single mindset in the organisation that
focuses on both as one.
Port security risk
In my joint study with Professor David
Menachof 1 , and drawing on my experience of
working as a leading Lloyd’s underwriter of
marine war, terrorism and political violence
risks, we presented a model of port security
risk. Here, threat is defined as the probability
that an attack occurs, vulnerability is defined as
the probability that an attack results in damage
given that an attack occurs and consequence is
defined as the expected damage given that an
attack occurs and results in damage. Thus Risk
= P (attack occurs) * P (attack results in
damage | attack occurs) * E (damage | attack
occurs and results in damage).
We go on to show how port security risk can
be quantified and, when combined with
performance data for security systems obtained
from a series of interviews with port security
experts, the resultant residual risk of each port
facility can be calculated. This data was used as
the basis for assessments of the performance
of each of the security systems as a whole.
Developing the model, which is now the
focus of my research with Dr Alison Wakefield
at the University of Portsmouth, if we were to
substitute ‘event’ for ‘attack’ and ‘consequence’
for ‘damage’ in the above equation and further
model the impacts of both resilience to
organisational interruption and resilience for
organisational response, we arrive at the
following model for residual risk: Residual Risk
= P (event occurs) * P (event results in
consequences | event occurs) * f (resilience to
organisational interruption) * E (consequences |
event occurs and results in consequences) * f
(resilience for organisational response).
Here, f (resilience to organisational
interruption) and f (resilience for organisational
response) are functions of resilience to
organisational interruption and resilience for
organisational response respectively which
reduce organisational vulnerability and
consequence. The way in which these are
calculated isn’t elementary and reflects the
complex landscape of the relationship between
risk and resilience.
To further inform the model, I’ve identified in
excess of 400 individual elements that can
contribute to an organisation’s resilience. They
stem from Health and Safety, security,
environment, quality management, training,
business continuity planning, redundancy
capability, crisis management capability, cyber
security and media management.
Within each of these elements there’s the
potential for a non-conformance or near miss to
be manifested without warning. Risk managers
and directors will recognise the importance of
identifying an appropriate methodology for the
collection and analysis of non-conformances
and near misses, given their clear potential for
impacting a firm’s vulnerability.
An organisation’s vulnerability can be
modelled in a two-dimensional matrix assigning
an individual score for the significance of each
performance indicator of resilience to
organisational interruption in tackling a
potential hazard, both man-made and natural.
The modelling of non-conformances is thus
significant because they will affect the
individual vulnerability scores in the matrix.
As this matrix is then used to calculate the
organisation’s overall residual risk and the
resilience to organisational interruption has a
direct bearing on vulnerability, it’s possible to
link the performance of resilience to
organisational interruption and the presence of
non-conformances to residual risk.
Similarly, the resilience for organisational
response consists of performance indicators
that have a direct bearing on the consequences
of an extraordinary event affecting an
organisation. In turn, these may be modelled in
their capability to reduce consequences and
thus reduce residual risk overall. This is the
methodology that links resilience to
organisational interruption and resilience for
organisational response and, therefore, overall
resilience to organisational risk.
In only a few years from now, the lines
dividing risk management and resilience
management will be sufficiently blurred, not
only through a better understanding of their
impact on residual risk, but also through the
necessity of allocating efficient resources to
tackle organisational risk and resilience.
Reference
1 Talas R and Menachof D
(2014): ‘Using Portfolio
Optimisation to Calculate the
Efficient Relationship
Between Maritime Port
Security Residual Risk and
Security Investment’,
International Journal of
Shipping and Transport
Logistics, Volume 6:3,
pp46-59
Dr Risto Talas BA (Hons) MBA
PhD: Lecturer in Security Risk
Management at the University
of Portsmouth’s Institute of
Criminal Justice Studies
“It’s not good enough for C-level directors of risk to
consider risk in isolation. They should be focused just as
much on resilience measures”
49
www.risk-uk.com