The latest version of the National Risk Register (NRR) was published quietly by the UK Government on December 18, writes Robert Hall, pictured, executive director of the business body Resilience First.
The register is the unclassified version of the National Security Risk Assessment (NSRA) and provides information on the most significant risks that could occur in the next two years and which could have a wide range of impacts on the UK. The register was first compiled in 2008 and has been released by the government at least every two years until 2017. In the NRR 2017, under the category of ‘Human Diseases: emerging infectious diseases’ as distinct from ‘pandemic flu’, the document stated that the consequences may include ‘several thousand people experiencing symptoms, potentially leading to up to 100 fatalities’ (page 34). As the country has witnessed over 106,000 fatalities and is approaching four million cases from Covid-19 then the risk appreciation here was clearly wide of the mark.
The 140-page NRR 2020 summarises what the government, devolved administrations and other partners are doing about the risks. It is intended to be useful to local emergency planners, resilience professionals and businesses, helping them to make decisions about which risks to plan for and what the consequences of these risks are likely to be. It also contains information and advice for the public.
The register this year divides risks into six categories: environmental hazards, human and animal health, major accidents, societal risks, malicious attacks and risks occurring overseas. New risk summaries are included for serious and organised crime, disinformation and hostile-state activity. Assessments for the new categories of ‘pandemics’ and ‘high-consequence infectious disease’ outbreaks do not include Covid-19 as, at the time of publication, it remained a live issue. However, a dedicated case study for Covid-19 to date is included independently of the formal assessments.
The NRR 2020 remains based on a 5×5 matrix with likelihood and impact as the two assessing criteria. The Reasonable Worst-Case Scenario (RWCS) for each risk is determined by the government department owning that risk scenario, using extensive data, modelling and analysis.
An independent report on the government’s approach to risk assessment by the Centre for the Study of Existential Risk (CSER) at the University of Cambridge was published ahead of NRR 2020. The authors identified several areas that could be improved and remain relevant. For instance, the likelihood criterion in the register is based on the RWCS ‘occurring in the next year’. This means that emerging risks that have a low probability of occurring in that timeframe may not be given the attention they possibly deserve – a lesson from Covid-19. Identifying high-uncertainty risks should be a feature of good horizon scanning. Furthermore, it is fair to ask what is ‘reasonable’ in the term RWCS and if the risk-owning government department is the rightful arbiter of reasonableness.
A fundamental question of the NRR 2020, and any risk register, is whether listing potential causes of danger in compartmentalised ways is more valuable than looking at potential consequences, especially where cascading effects often cut across risk categories. It may be valid to map out risks by type but it should be equally if not more important to consider the impacts which can often be common for multiple risks. The ‘indicative impact indicators’ given for five levels in the NRR matrix are helpful to a degree but again compartmentalised: the NRR 2020 does point out that they ‘should NOT be read as a set of criteria that needs to be met in order for an assessed risk to be classified at these levels’.
However, if we are to develop national resilience to a wide range of risks then it is perhaps necessary to spend more time looking generically at the preparedness levels, response/recovery measures, adaptation capacity, and resourcing to cater for complex, inter-related failures that may well occur concurrently and hence tick multiple boxes. The risks in the latest NRR are treated in isolation as if one risk may not elevate or initiate the likelihood of another. Clearly, this is untrue and dangerous to assume given the diversification of response mechanisms as well as the variety of networks at risk.
One way of measuring preparedness would, for example, be to measure indicators such as the number of hospitals/doctors/ICU beds, the number of police/military, the provision of snowploughs at airports/arterial roads, the number and training of civilian volunteers, etc. These would provide a better reflection of the ability to respond to a crisis in contrast to a recording of the level of risk through, for instance, the number of ‘fatalities in the UK’, or ‘public perception’ or ‘lack of health and care services affecting a percentage of the population over time’. This is not to say a risk register is invalid, just that it doesn’t reflect the country’s ability to recover from disruption from whatever cause.
All this would require a different type of register – a National Resilience Register – but perhaps that would be a better measure of the real risk that the country faces.
About Resilience First
Resilience First’s next webinar is on Monday afternoon, February 8; after publication of a report, ‘Agile resilience: lessons from Covid-19 for the ‘next normal’ in August, Resilience First and the management consultancy McKinsey & Company worked on a guide to improving agility in organisations of all sizes.
In March, it’s running a series on ‘Decarbonisation and the Role of Technology’.
To sign up to webinars visit https://www.resiliencefirst.org/our-work/events-and-webinars.
More reading about the CSER at: https://www.cser.ac.uk/news/recent-publications-dec-2020/.
