Risk analysis and mitigation from a travel security perspective
The most common and unfortunate state of mind people adopt is that protection is the responsibility of someone else. You can personally exert an extraordinary amount of influence over your own safety and security by controlling your actions. Adopting the mindset that your personal safety and security is up to you is the first step in improving your chances. The next step is learning how to evaluate risk, and implement actions and controls to maintain and advantage in any environment. The first step is analyzing risk.
Finding the “right” risk metrics
In risk analysis, the first and most critical step is to choose a quality data set. The greatest gift the Internet has given us is a vast supply of information on demand. Unfortunately, much of it consists of un-researched opinion, or worse pure fabrication. When completing personal security risk analysis, you have to select vetted, relevant and appropriate sources of information or you will undoubtedly end up protecting yourself against the wrong threats. The Department of State, CIA World Fact Book, UN Office on Drugs on Crime, World Health Organization and the Economic Intelligence unit are great places to start. Alternatively, there a number of professional reports you can purchase about any city or area where you may want to travel. Basing risk decisions on what you are fed by the media, Hollywood or that scholarly journal Wikipedia is unlikely to result in productive and useful plans to mitigate that risk!
This should not simply be a physical risk analysis and it should include risks that could impact the success of your reason for traveling. You are choosing to expose yourself to risk for a purpose, and if you don’t accomplish that purpose, you should choose not to take the risk in the first place. If you are traveling to Sierra Leone to import natural resources, anything that will prevent you from obtaining or importing resources is a risk. If you do not account for those risks, you may have a physically safe trip that results in you undertaking a very adeptly risky evolution for no productive reason. Culture, infrastructure, opportunity and preparation all play into it.
Once you have selected appropriate sources of information, you are ready to start dealing with the process of determining what to do with it. Risk analysis is simply a process of systematic evaluation of information. Ultimately, the real goal is to develop a consistent approach to evaluating the information you collect. The first step is to make a determination of what is likely to happen. This is a fairly exhaustive list of what may happen. It consists of the things that are likely to impact a traveler to that country and have almost nothing to do with your personal ability, plans or circumstances.
Then next step is to look at the catastrophic impacts that could occur (death, permanent injury, loss of the deal, etc…). Remember, base these on your data set, not on your personal circumstances at this point. Then combine these two lists into a set of potential occurrences. Here is the most important step in the process. Cross anything off the list that is completely beyond your control, leaving only the things that you can influence. If someone else with more money, physical ability or language skills, which you do not posses, could influence those factors that is irrelevant information to your risk analysis. If you don’t have the skills, money or time to influence the potential occurrences, don’t spend time trying. You want a comprehensive list of things that are likely to occur in the area to which you are traveling.
We can now start to assign a probability and severity rankings to the list. A cold is pretty likely, but pretty low on the severity list. Being murdered is probably on the low probability side, but at the top of the severity list. I rank severity in the same manner as we rank the scale of injury. Zero is no impact or no injury. One is minor injury with little to long-term impact. Two is serious but recoverable injuries, or serious but recoverable impacts. Three is permanent injures, or permanent unrecoverable impacts. Four is death or catastrophic impacts. This is a somewhat arbitrary scale in that you simply have to lump it into one of four categories.
Next we look at the probability of occurrence. Once again we place them into one of five buckets labeled A – E. E is improbable, or a freak occurrence. D is unlikely, or something that may happen once in a blue moon. C is moderate, meaning it might happen. B is likely, or something more likely to happen than not. A is something you would be pleasantly surprised if it did not occur.
In evaluating our list, we can now cross off everything we have labeled as a zero or E. If the impact is zero, we are not going to waste time trying to mitigate the risk. If the probability is so low that it falls into the freak occurrence category, we will not spend time trying to reduce it even further. These are the lists of things that are likely to happen, and against which we are going to apply time, effort and resources to minimizing the impact or the probability that they will occur.
Minimize Probability Risk
The first thing I want to focus on is minimizing the probability. Not having an event occur is always preferable to minimizing the damage it may cause. We can minimize probability by our actions. There is an extensive list of these skills and good habits written out in Preventative Defense. Examples are locking your car doors, inspecting the tires on your rental vehicles, avoiding bad neighborhoods and making a conscious effort to blend in. Anything you can do to minimize the probability is an action.
Minimizing Severity Risk
The next step is focused on minimizing the impact of negative events if our attempts to avoid them fail. Examples are things like wearing a seat belt, carrying some simple trauma management equipment, and learning to ask for help in the local language. Anything you can do to reduce the severity or impact of an event is called a control.
As I look at my list of things that are likely to happen, I write out actions and controls that will influence the probability or severity of the event. Every action and control (or risk mitigation tactic) has a cost and an effort level associated with it. The key to actions and controls is that they have to be affordable. If you develop a phenomenal plan to mitigate risk to nearly zero, but it costs a trillion dollars to implement, you may as well rely on a wish from a magic genie. They have to be practical. If your plan is so detailed that it requires 16 hours of your day to execute, you have no time left to accomplish your goal so you may as well not go. Lastly, you have to come up with actions and controls that you will actually do!
After I have listed my actions and controls, I evaluate my list of potential occurrences again and assign a new probability and severity based on the implementation of my actions and controls. Ideally, we are able to reduce both, but the reality is that we are far more adept at developing controls than we are at reducing probability. So do not fall into the trap of reducing a probability rating based on a good control. In other words, wearing a bulletproof vest is a great control if you are dealing with a risk of being shot. Putting on the vest does not reduce the probability of being shot by one bit.
I now look at my risk analysis matrix again. I am looking for things that fall in the likely or catastrophic category. Ideally there is nothing on the list that falls into the 1A category after our actions and controls have been implemented. If there is, then you need to apply more resources to mitigation (usually money and time), or you need to reevaluate the purpose of your trip.
If we have developed effective actions and controls, things with a severity rating of A should have low probabilities and things with high probabilities should have low severity rating. If we have anything left on our list that does not fit that profile, we need to reconsider our actions and controls to determine if something more can be done.
Putting risk analysis and mitigation plans in action
Some risks are inherent in our work and our lives, and we have to accept them in order to be effective. The concept that we can or should mitigate risk to zero is costly, inefficient and ultimately impractical. Since there are some risks that I must accept, those with moderate or likely occurrence ratings and moderate or severe consequences will result in the development of an emergency action plan. The emergency action plan will be discussed in the next article, but it consist of identifying threat indicators and appropriate responses to break the cycle of violence or injury before it impacts us.
This can at first be an exhaustive process, however, a little practice goes a long way. The more you practice, the more it becomes second nature. The key piece is to find actions and controls that are practical, executable and that you make the time and effort to actually do. Writing a plan that keeps you away from the local opium den is great, actually staying away from the opium den is what makes you safer.
Plan, Travel Safer and have more fun!
~ Patrick Henry
#riskanalysis, #riskmitigation, #travelsecurity