What has been consuming my time - THIRA part 1

I've been meaning to blog about this for a while but have been so consumed by the project that I haven't had time. For the last month or so we've been prepping to present a proposal on a Threat Hazard Identification Risk Analysis (THIRA) model to senior leadership for a green-light, and as of yesterday afternoon (after I think four reschedulings) we got it. I'm going to outline the project here and in future posts will update with progress.

One of the major components of my current assignment is a comprehensive risk assessment of our area of responsibility. The only complication, and I'm not even sure I consider it a complication really, is that there isn't any specific or required method to follow in carrying out the assessment. So my boss and I have been working on our own formula, based on other standards we've tracked down.

Most preparedness/emergency management oriented folks are probably familiar with the HIRA concept in one form or another, if not under that name at least the risk analysis concept and the:

Risk = Probability x Vulnerability x Consequence

formula. We started there but expanded slightly and added a "threat" category which we're using to cover the man-made issues, whether terrorist, "technical hazards" (a good example of that is the Fukushima power plant situation currently unfolding in Japan), or other events of that sort. That got us to the basic components that we wanted to cover but the more we looked into it the more we found that nobody really agrees on exactly how to get to the "Probability", "Vulnerability", and "Consequence" pieces.

There were a few other things we wanted to be able to take into account, modifiers if you will:

• Warning time - Some hazards modify their own Risk, reducing it, by their very nature. What I mean is that any hazard that you can see coming hours or even days away gives even the most un-prepared person time to take some action. Given that, we wanted to find a way to recognize that "notice" events should have a slightly lessened Risk than "no-notice" events.
• Preparedness - We wanted to acknowledge that many jurisdictions that were actively preparing for specific hazards, either by reviewing/updating plans, conducting exercises, or even by having recently responding to a similar event. By virtue of those activities, if taken recently enough, they would reduce the potential impact of the hazard. They wouldn't necessarily reduce the Risk, which is based on the PxVxC formula, but the would mitigate some of the impact of the incident overall.
• Leadership priorities - The last modifier that we wanted to include was a way for leadership to look over the list of threats and hazards that we had selected, the categories that we were analyzing, and identify the ones they felt were the most important for us to focus on. This was really an acknowledgement of the political reality - we may have data that tells us that certain hazards are the most likely to happen but there are others that are more politically sensitive, making them higher priorities for us to act on.

All of this boils into the THIRA model that we put together, which ends up looking something like this:

Risk = Probability x Vulnerability x Consequence = R

Risk can be modified (reduced) by warning time = R1

R1 is modified by Preparedness (P) and Priorities (Pr) = R1 x P x Pr = THIRA

The last component is that we have a weighting factor added in to the THIRA formula. Each of the three component (R1, P, Pr) are weighted by a factor determined by leadership, from ten total points. This is to allow one last opportunity for leadership to provide their input to the model, to indicate which component they feel is the most important. It also allows us an opportunity to demonstrate how far we have to skew the model if a particular low-risk event is identified as a high priority item.

In future posts I will explain the formulas we're looking at for each of the components (P/V/C) as well as some of the data sets we've identified. And that second point brings me to a question for readers - if you have recommendations for data sets please let me know, either in comments or email. We are looking for as much data as possible to populate to initial model and the more the better.