Risk Assessment

Introduce participants to the concepts that underlie risk assessment, and how to apply risk assessment frameworks to their personal and/or organizational security. We **highly recommended** that you choose a Learning Path to travel, as these include activities with different levels of depth that should help participants obtain more insight into the covered subjects.

Learning Objectives & Learning Activities

This page will guide you through the Module's correct use and understanding. Following the Learning Paths, with activities of varying depth, should allow participants to obtain a better grasp of the studied subjects.

image-1605639759774.png

Learning Objectives

By the end of this module, the participants will be able to:

Learning Activities

Starter Activities

image-1605640724450.png

Deepening Activities

image-1605640735000.png

Tactical Activities

image-1605640743110.png

Foundational materials

Go back to the FTX: Safety Reboot's main page

image-1605452256072.png

Introduction to risk assessment [Starter Activity]

 

image-1605640366569.png

This activity is designed to introduce and exercise a framework for doing risk assessment.

Learning objectives

Learning objectives this activity responds to:

Who is this activity for?

This activity is designed for participants who have basic or no experience of risk assessment. It is also designed for a workshop with participants from different organisations.

Time required

Realistically, this activity requires a day (eight hours, minimum) to do properly.

Resources

Mechanics

For this activity, create a scenario of an individual or group that the participants can practice doing a risk assessment on.

Depending on your participants, some options can be:

Break the participants down into groups. They can work on the same kind of organisation/group or work on different kinds of organisation.

Facilitation note: It is important here that the scenario resonates with the participants and that it is close to their experience.

Once everyone is in their groups, present the Basic risk assessment presentation.

Group work 1: Flesh out context and scenario

Before the groups can begin filling out the Risk assessment template, they should flesh out their chosen scenario.

For a group scenario:

For an individual scenario:

Give each group an hour to do this.

Afterwards, have each group present their scenarios quickly.

Then present the Risk assessment template.

Some notes about the table:

Group work 2: Risk assessment

Using the risk assessment template, each group analyses the risks in their scenario. The task here is to identify different risks, and analyse each one.

Facilitation note: Give each group a soft copy of the risk assessment template so they can document their discussions directly on it.

This group work will take at least two hours, with the trainer-facilitator consulting with each group throughout.

At the end of this, debrief with the groups by asking process questions rather than getting them to report back on their templates:

Mitigation tactics input and discussion

Using the text for a presentation on mitigation tactics (see the Presentation section), present the main points and have a discussion with the participants.

Group work 3: Mitigation planning

Ask each group to identify a risk that is high probability and high impact. Then ask them to create a mitigation plan for this risk.

Guide questions

Preventive strategies
Incident response

This group work will take about 45 minutes to an hour.

Afterwards, debrief by asking about the process and questions they have about the activities they have gone through.

To synthesise this learning activity, reiterate some lessons:

Presentation

There are three things to present in this activity:

Text for presentation on mitigation tactics

There are five general ways to mitigate risks:

Accept the risk and make contingency plans. Contingency planning is about imagining the risk and the worst case impact happening, and taking steps to deal with it.

Avoid the risk. Decrease your vulnerabilities. What skills will you need? What behavioural changes will you have to undertake to avoid the risk?

Control the risk. Decrease the severity of the impact. Focus on the impact and not the threat, and work towards minimising the impact. What skills will you need to address the impact?

Transfer the risk. Get an outside resource to assume the risk and its impact.

Monitor the risk for changes in probability and impact. This is generally for low-probability risks.

There are two ways to look at dealing with risks

Preventive strategies

Incident response

Adjustments for an organisational workshop

This activity can be used in a workshop context where the risk assessment is being done by an organisation, and the role of the trainer-facilitator is to guide the organisation through the process.

In order to do this, instead of fleshing out the scenario, have a discussion on the general threats that the organisation is facing. This could be a change in law or government that has implications on the organisation’s ability to continue its work. It could also be a specific incident when the people in the organisation felt that they were at risk (for example, a partner organisation discovering they are being surveilled, or the organisation itself being monitored). Follow that up with a discussion on what capacities the organisation already has – resources, connections, supporters and allies, and skills. Grounding a risk assessment activity by building common knowledge about the threats the organisation is facing and its capacities will be important for the rest of the process.

Break the participants up by team/unit as they go through the risk assessment template.
In this context, the mitigation planning is as important as the risk assessment template, so both areas will have to have equal time.

For an organisational context, this activity may take up to two days, depending on the size of the organisation and its operations.

Further reading (optional)

Go back to this activity's main module (Risk Assessment)

image-1605451879726.png

Assessing Communication Practices [Starter Activity]

image-1605640366569.png

This activity is designed to enable the participants to look at their communication practices (the topics that they communicate about, who they communicate with, their channels of communication) and assess where their risks are.

This activity is meant to be a diagnostic tool that can be used to prioritise training topics, and / or for the participants to use in assessing their communication practices.

Learning objectives this activity responds to

This addresses the understanding the concepts that underlie risk assessment.

Who is this activity for?

This is for participants that are beginners and intermediate.

Time required

Introduction to the activity: 15 mins

Individual time to assess: 15 mins

Group work: 30 mins

Plenum wrap-up: 30

Total: 1.5 hours

Resources

Mechanics

Ask the participants to fill in the table below.

Topic of communication Who do you communicate with about this topic Is it sensitive?(Y/N) Who will target you for this communication? Communication channel
    (Y/N?)    
    (Y/N?)    
    (Y/N?)    
    (Y/N?)    
    (Y/N?)    

After each participant has done their table, ask them to share their results with each other in groups.

At the end of the group work, ask each group to discuss with the bigger group the following questions:

This activity can then be used to prioritise which communication channels to focus on for the rest of the workshop, or to present alternatives to less private communication platforms.

Go back to this activity's main module (Risk Assessment)