Risk Assessment for Homeland Security Programs

Homeland Security Risk Management

Risk Management in Homeland Security

This paper provides a brief examination of the role of risk management within the homeland security operations. The discussion first addresses issues related to risk assessment, which is a necessary, prudent step for publicly funded activities, and particularly so given the national scope and the potential consumption of resources. The Strategic National Risk Assessment (SNRA) serves as a vehicle to link policy -- the Presidential Policy Directive 8 (PPD 8) and the National Preparedness System. The core capabilities of the National Preparedness Goal are mapped to the hazards and threats identified in the SNRA (SNRA 2011). This tactic enables additional core capabilities to be identified, and provides a resource to inform the establishment of priorities needed for making decisions about future investing in capabilities (SNRA 2011).

As with any major projects of risk management, the initial stage is focused on assessment. The Strategic National Risk Assessment was designed to support the Presidential Policy Directive 8 that requires the creation of a three-pronged approach to preparedness: 1) A National Preparedness Goal; 2) a National Preparedness System, and 3) a National Preparedness Report (SNRA 2011). These activities are conducted under the umbrella definition of risk according to the Department of Homeland Security's (DHS) official lexicon: Risk is defined as "the potential for an unwanted outcome resulting from an incident, event, or occurrence, as determined by the likelihood and the associated consequences" (DHS Risk Lexicon 2011). The initial purpose of the strategic national risk assessment is to identify the sources that pose the greatest incident threat to the country's homeland security (SNRA 2011). The assessment conducted in 2011 was based on assumptions and data limitations that will need to be reevaluated and updated in subsequent iterations of the Strategic National Risk Assessment (SNRA 2011).

The hazards and threats are grouped according to national level categorical events -- only those events exhibiting a distinct beginning and ending, plus a rational connection to the missions of homeland security, are included in this comprehensive list (SNRA 2011). Moreover, to be included in the list, events must be associated with an economic consequence or fatalities / injuries / illnesses (SNRA 2011). Importantly, in no instance were the thresholds to achieve being included on the list considered equivalent (SNRA 2011). That is to say that dollar values were not assigned to loss of live, for instance, in order to make the comparisons easier (SNRA 2011). Some events were included on the list without being subject to the threshold measure: for instance, events that can result in substantive psychological impact were included even though the actual economic loss or number of casualties would be low (SNRA 2011). The three national level categories are: 1) national hazards; 2) technological / accidental hazards; and 3) adversarial, human-caused threats / hazards (SNRA 2011).

The results of the Strategic National Risk Assessment indicate that a wide variety of hazards and threats have the potential to create a significant national risk (SNRA 2011). These findings support the establishment of an approach to national preparedness planning that takes an all-threats / all hazards tack (SNRA 2011). Several substantive overarching conclusions resulted from the assessment, as follows. The recurrence of national level events assumes a frequency sufficient to test the nation's preparedness within the next 10 years (SNRA 2011). The rapid pace of change in the risk landscape and global society will require that the nation to be prepared for hazards and threats of greater scale and consequence than have been experienced in the past (SNRA 2011). The potential risk magnitude of some threats "require additional specialized response activities"(SNRA 2011). Different types of impacts are created by different types of threats, particularly with respect to the area of exposure, which may be localized or spread broadly (SNRA 2011). Indeed, one of the functions of the Strategic National Risk Assessment was to assess risk of the events identified in terms of both frequency and consequence (SNRA 2011). When assessing the potential consequences of events, six categories of harm were considered: direct economic cost, environmental impact, injuries and illnesses, loss of life, psychological distress, and social displacement (SNRA 2011). The multifaceted perspective enabled by this six-factor approach underscores the interdependent effects that can result from incidents, thereby requiring a cooperative and holistic response that can encompass the entire homeland security enterprise (SNRA 2011).

The limitations of the Strategic National Risk Assessment are important to acknowledge and understand (SNRA 2011). Uncertainty is inherent in risk assessment: as such, a critical objective was to avoid "false precision" (SNRA 2011, 6). To this end, the risk assessment included "only those differences in risk that are still significant despite the associated uncertainties" (SNRA 2011, 6). The Strategic National Risk Assessment is strategic, which means that the full spectrum of risks and some particular regional or incidental risks will not be identified. Because of the focus on the contingency type risks emphasized in the PPD-8, steady-state risks were not explicitly assessed; examples of steady-state risks include border violations, drug trafficking, illegal immigration, and intellectual property violations (SNRA 2011, 6). The varying maturity rates of the data sources related to some events impeded comparison, such that qualitative discussion and representation was employed (SNRA 2011, 6). The dynamic nature of some hazard is not modeled by the methodology used for the Strategic National Risk Assessment (SNRA 2011, 7). Measures used by the SNRA to address the phenomena related to psychological distress suggest additional research is essential to understanding the development and impact of "psychosocial factors that enable resilience in individuals, organizations, and communities, and at the societal level" (SNRA 2011, 7).

The Strategic Management Framework is -- at its most essential level -- a process to be implemented in order to align Customs and Border Patrol (CBP) programmatic and operational priorities with the mission, critical goals, strategic objectives, resource priorities, and performance measures (CBP 2009). Although the Government Performance and Results Act (GPRA) calls for an update of the Strategic Management Framework every three years, CBP will conduct an annual review in order to provide a document that is always relevant to the ever-changing environment (CBP 2009).

The CBP holds that the desire of non-state entities to "inflict harm" on the United States is a persistent threat that can feasibly involve attempts to "acquire and use chemical, biological, radiological and nuclear material" (CBP 2009, 5). Accordingly, the CBP will continue to employ an "in-depth and risk-based enforcement" approach with the goal of detecting and interdicting terrorist threats to the safety of the United States (CBP 2009, 6). Recognition by the CBP that securing the nation's borders requires a focus on processes and forces that are far outside the actual physical borders of the United States (CBP 2009, 6). The capacity of Customs and Border Patrol to control the border is dependent upon the coordination and deployment of a mix of cross-agency resources that includes intelligence, "personnel, tactical infrastructure, and technology" (CBP 2009, 6).