In November 2020 the UK government published its latest edition of the National Risk Register. The previous edition was published in 2017. There is an obvious before-and-after-Covid comparison to be made here, and so I sat down with both documents in front of me to compile some notes. This is some of what I came up with:

Before Covid (2017):

There is nothing featured on the front cover.

After Covid (2020):

The front cover carries a photo of flooding in York. No sign of any coronaviruses though.

Before Covid (2017):

A forward written by Caroline Nokes, Minister for Government Resilience and Efficiency, carries a photograph of her smiling with the confidence expected of a resilient and efficient government.

After Covid (2020):

A forward written by Penny Mordaunt, Paymaster General, carries a photograph of her looking as though she is about to break down in tears.

Before Covid (2017):

The risk matrix indicates that a pandemic of a flu-like disease presents the highest risk faced by the nation. It is one of the most likely risks to materialise and it would have the greatest impact (20,000 to 750,000 expected mortalities).

After Covid (2020):

The risk matrix still considers that a potential pandemic would have the highest impact of all the risks that the nation faces, but pandemic has been moved down a level as far as likelihood is concerned – extreme weather events of national importance are now considered more likely. Conveniently, as the footnote explains, Covid-19 is not included in the matrix.

Perhaps all of this explains why a picture of city-centre flooding appears on the front of the latest edition, despite it following a year in which the world has suffered death by lockdown and virus.

Belatedly, a lot more detail is provided regarding infectious diseases, multiple waves, concurrent pandemics, etc.

Before Covid (2017):

Despite identifying pandemic as the greatest risk, the document covers environmental matters first.

After Covid (2020):

Despite pandemic having proved to be the greatest risk, the document still covers environmental matters first.

Before Covid (2017):

The claim is made that the government has planned well for a pandemic: “You can find a considerable amount of information and guidance online about the public health response to pandemic flu, including guidance aimed at specific organisations such as schools and higher education institutions, businesses, cleaning staff, and fire and rescue services.”

Note here that care homes are missing from the list. Indeed, when following the embedded link, it turns out that all of the available planning documents pre-date the 2017 register, except that written for care homes, which was not published until November 2020. A bit late, some might say.

After Covid (2020):

The new statement on planning reads: “The UK government is taking an evidence-based approach to prepare for the next influenza pandemic. Contingency plans exist for many emerging infectious diseases, and the UK government is continually learning the lessons from previous infectious disease outbreaks, including COVID-19, to inform preparation for future infectious disease outbreaks and pandemics.”

I presumes this includes lessons like: Don’t turf covid-19 patients out of hospital back into care homes for which the government has provided absolutely no planning, guidance or suitable facilities.

Before Covid (2017):

No claims are made to the effect that the plans are reviewed or stress tested.

After Covid (2020):

It is now claimed that regular reviews of plans are undertaken by experts and stress testing exercises are regularly performed. The implication is that this is a recent innovation (post 2017, at least, but I’m betting post 2019), in which case a lot is explained, including the look on Mordaunt’s face.

Before Covid (2017):

No claim is made for having quickly re-scalable testing capabilities and capacity.

After Covid (2020):

Lots of boasting about the rapid expansion of testing capacity during the Covid-19 outbreak.

Before Covid (2017):

Claims that enough anti-viral medication is in store.

After Covid (2020):

Same sentence but the word ‘enough’ seems to have gone missing.

Before Covid (2017):

Claims that PPE exists for emergency responders. No mention of sufficiency.

After Covid (2020):

Still claims that PPE exists for emergency responders and still no mention of sufficiency.

Before Covid (2017):

Regarding what the people can do to protect themselves: “For pandemic flu, good hygiene remains the most effective defence until a vaccine can be developed.”

It’s a bit disconcerting to see the trust that the government was placing in the benefits of good hygiene prior to Covid-19.

After Covid (2020):

Now states: “Information to explain how the public can protect themselves and access services, social distancing measures and interventions are targeted at specific sectors and industries.”

So now it’s not just about good hygiene but also about doing what we are told. It’s interesting that the government had not anticipated the need for social distancing measures and other ‘interventions’. So much for their brilliant planning.

Before Covid (2017):

No mention is made of the importance of a resilient NHS and how this is to be ensured.

After Covid (2020):

States: “Tried and tested surge plans exist to increase secondary care capacity and mechanisms to reduce pressure on primary care services (e.g. establishing the Nightingale hospitals to ensure capacity is available during the COVID-19 pandemic).”

Tried and tested? Mmm. I wonder what the test results were.

Before Covid (2017):

No case study for a pandemic is offered.

After Covid (2020):

An extra section is added offering Covid-19 as a case study. It seems to have been written to convince the reader that everything ran smoothly and this was down to good governance. I’ll spare you the details; you can read it for yourself.

Summary

Twenty-twenty vision hindsight is indeed a wonderful thing and, in a way, it is gratifying to see a much better informed and detailed document emerging in 2020. Furthermore, it would be unreasonable for me to expect the government to have foreseen all of the calamity that has befallen during the last year. However, there are still some risk management basics that one might expect to have been in place long before Covid-19 turned up. For example, one of my duties before I retired was to write my employer’s business continuity plan. Unsurprisingly, it included a section regarding the potential impact of a viral pandemic. It also included a schedule for the plan’s regular review and how the plan was to be tested (a combination of desk-top checking and practical exercises). It never occurred to me that the plan should sit on a shelf, untested until the day it was needed. And yet that appears to have been the government’s approach leading into 2020. Not anymore, I’m pleased to say – after all, they claim to be learning all the time. All the same, there are some things that one would hope didn’t need to be learned, and when I look at the differences between the 2017 and 2020 documents it strikes me that too many of the improvements fall into that category.

Ah well. Better luck with the next pandemic.

34 Comments

  1. Hindsight is so much more accurate, detailed and comprehensive than foresight. Mordaunt has every reason to look pensive. It is she that is being stress tested.

    Liked by 1 person

  2. So, narrative of imminent extreme weather powered by catastrophic climate change, survives mauling by pandemic, with ease. Still vies for overall first place, will likely make it in another year or two.

    Liked by 1 person

  3. “There is a trend towards wetter winters and drier summers:

    Not really. No clear trend in summer rainfall across the UK. No trend to wetter winters in England, but in Wales and Scotland winters have become wetter, particularly since the 1960s. That’s dangerous climate change for you.

    Liked by 1 person

  4. An influenza pandemic has been the top risk, I believe, ever since this risk register crap started. Back in my days of employment, once the requirement to maintain a corporate risk register was imposed, it became yet another form of bureaucratic torture. Twice a year, the management would sit round a table and go through an exercise of pure tedium, discussing what we would do if suppliers went out of business, or our product became illegal. I wonder how many shareholders even looked at the relevant 5 pages in the Annual Report. I always give them a miss when evaluating a company.

    I see that in 2017, cold and snow was the second item. Given the chaos that ensues whenever snow falls, I find it hard to work out the benefits of having this risk register. Emerging infectious diseases was there, along with a cluster of other risks, at number 3. Space weather, poor air quality and a heatwave were the other things at that level of risk.

    A volcanic eruption was on the next level down, presumably thinking back to the chaos caused by the Icelandic eruption 15 or so years ago. I would have expected something like the Buncefield explosion to feature but that is deemed less likely than a volcanic eruption.

    Not only is it nonsensical but also it does not seem to influence policy action in any way. As in the corporate world it seems to be a task that is done for its own sake. I hope John doesn’t take this as a personal attack. If I were working on an oil rig off the shore of an unstable political regime, risk management is a meaningful exercise, taken very seriously. It is not a box-ticking exercise to keep auditors off your back

    Liked by 1 person

  5. I must add that business continuity was something we took very seriously, probably because in those years at the start of the century, there were so many risks – train crashes, ricin attacks, terrorist action 9/11 and 7/7, volcanic eruptions, discoveries of bulk fertiliser in urban lockups, network or power outages at key facilities, etc that threatened to make it difficult for people to get to work or to be productive.

    Like

  6. MiaB,

    “I hope John doesn’t take this as a personal attack.”

    There’s no risk of that, I assure you. As somebody who had the unenviable task of trying to get executives truly engaged in risk management, I became only too painfully aware how such exercises were treated as mere box ticking. It didn’t have to be that way, but it inevitably was. As you say, tedious and pointless. It was only ever window dressing, and whenever I dared to believe otherwise, there was always a gun-toting, fire-fighting executive on hand to bring me down to earth.

    The National Risk Register is an output of such an exercise. It talks glibly of 20,000 to 750,000 deaths, without a glimmer of recognition of the difficulties such a death rate would pose to society and its continued functioning. And so there is no talk of lockdowns, furloughing, vaccination strategies, public communication strategies, or anything else that might have been of some use to be thinking about in advance. Instead, just a throwaway line about hand washing. However, none of this means that there is nothing to be gained by looking at these documents to see how they evolve. One has to say that the wash-your-hands-until-a-vaccine-arrives solution, advocated in the 2017 document, seemed awfully close to the initial stance taken at the start of the pandemic. The rest followed on in a fashion that gave the distinct impression that everything was being made up as we went along. But I guess that is the main point. Plans have a tendency to fail as soon as the enemy is encountered, so the temptation is to not bother with them.

    Liked by 2 people

  7. Andy,

    “…survives mauling by pandemic, with ease…”

    And whatever doesn’t kill you makes you stronger. Courtesy of Covid-19, we all now have a heightened sense of our fragility, and that’s bound to feed the climate porn monster. Ask not what you can do for the risk, but what the risk can do for you.

    Liked by 2 people

  8. The report also outlines the growing threat of antibiotic resistant bacteria. In that respect, disturbing new research suggests that antibiotic resistance may be spread to pathogenic bacteria from bacteria in the natural environment:

    “Pathogenic bacteria in humans are developing resistance to antibiotics much faster than expected. Now, computational research at Chalmers University of Technology, Sweden, shows that one reason could be significant genetic transfer between bacteria in our ecosystems and to humans. This work has also led to new tools for resistance researchers.

    Completely different species of bacteria can spread resistance genes to each other through plasmids—small DNA molecules where bacteria store some of their genes outside the chromosome. When two bacterial cells come into contact, they can copy plasmids to each other. This is called conjugation, and it is the most important mechanism for spreading antibiotic resistance.

    “In recent years, we’ve seen that resistance genes spread to human pathogens to a much greater degree than anyone expected,” says Jan Zrimec, researcher in systems and synthetic biology at Chalmers University of Technology. “Many of the genes appear to have originated in a wide array of bacterial species and environments, such as soil, water and plant bacteria.”

    Stay at home. Protect the NHS.

    https://phys.org/news/2021-01-antibiotic-resistance-easily.html

    Like

  9. Oh Jaime, you’re such a pessimist. Here is a wonderful story about bio-diversity and all you can do is complain about the demise of the human race 🙂

    Liked by 1 person

  10. It is now claimed that regular reviews of plans are undertaken by experts and stress testing exercises are regularly performed. The implication is that this is a recent innovation (post 2017, at least, but I’m betting post 2019), in which case a lot is explained, including the look on Mordaunt’s face.

    Great post John. I’m not a betting man but I’ll make this an exception.

    Like

  11. Richard,

    Thank for the feedback. It is most appreciated.

    Of course, the government may have simply thought that their planning reviews were not worth a mention, until after 2017. But I don’t think that is the most obvious explanation.

    Like

  12. My mole in the NHS says that they did a trial of the influenza plan around 2016/17. A colleague of hers was involved. As you might expect, a lot of problems became apparent and suggestions for improvement were made. These were not acted upon.

    Out of insatiable curiosity, this Elephant Child opened the Annual Report of Wetherspoons Plc for the year ended 28/7/2019. It came out in October 2019.

    The Risk Register records the following risks:

    Economic outlook
    Regulation of sale of alcohol
    Succession planning
    Cost increases
    Recruitment and retention
    Health and safety
    Supply chain risks
    Food safety
    Head office and national distribution centre
    IT
    Reputational risk
    Capital risk management
    Interest-rate risk
    Credit risk
    Liquidity risk
    Foreign currency

    For whom is that list relevant? It could probably fit any retail group. There is nothing specific to a pub-chain nor to Wetherspoons, apart maybe from Reputational Risk. It could be that Tim has a Ratner moment – other company chairmen are not quite so forthcoming. These are just the tricky bits of people’s normal jobs. The whole Risk Register is backwards-looking, discussing how we cope with problems we could expect to face. It is of little use or value to investors. Why does the government insist on companies producing such rubbish?

    The following year’s report, however, had an additional risk listed. In between Succession planning and Cost increases are a couple of crisp paragraphs on Widespread pub closures. It sort of underlines the futility of the way we think about risks. Every so often, a black swan event comes along and you don’t know when it will come nor what it will do. Imagine what the report for the year ended July 1914 would have included.

    Liked by 2 people

  13. MiaB,

    Yes, unfortunately most risk registers didn’t get beyond a list of headings, and most managers couldn’t tell you the difference between a risk and a problem. Hey ho.

    Like

  14. MiaB: I’ve seen something like that graph before too. Lot of noise in there, but.. I think it likely that the ‘most prepared’ nations are also the most developed ones, of whom many are also those who not only measure all the deaths, but likely inflate them with the insistence that anyone who died with covid, died of covid. Whereas maybe most of the rather less prepared nations, being less developed and nearer to reality, so not so hypnotised by fear and orthodoxy, are measuring the deaths much more realistically. While a lot of the undeveloped nations who were least prepared, are probably not putting much effort into measuring the deaths at all, and only mark blindingly obvious instances that conveniently occurred in hospital or whatever, or maybe none at all judging by the huge dark blob around zero. I’ve no evidence for this whatever, it’s just a thought that there’s pretty likely to be measurement artefacts of this nature when I first saw a similar graph.

    Like

  15. MiaB, Andy,

    Yes, ‘preparedness index’ will certainly be correlating with something else, suggesting there is a confounder that is driving both mortality and planning. As you suggest, Andy, it will be to do with the level of sophistication of society, but rather than just reflect upon how this may influence attitudes to mortality assessment, it is worth also reflecting upon the extent to which such sophistication will increase vulnerability. It isn’t just a matter of how much effort is put into preparation, it is a matter of how effective did the preparation need to be. That said, I agree that the figures seem, at first glance, paradoxical.

    Liked by 1 person

  16. The way the data points are clustered, I wonder how the regression line would look if they did calculation the other way around – ie regressing the preparedness index on the number of deaths. It would probably be equally as weak a correlation but heading in a different direction

    Like

  17. ‘Floods, heatwaves and more’ can now be attributed to climate change according to Richard Betts and this supposedly puts a ‘dent in climate denial’ and our ‘false sense of security’. Be afraid, be very afraid. Richard sagely tells us that armed with the science of extreme weather attribution, we can now put numbers on the risk of nasty weather happening and plan accordingly.

    “The most crucial use of this information is to make planning more pragmatic. Putting numbers on the increased likelihood of weather extremes increasingly informs my work on climate-change risk assessments, which in turn helps policymakers and planners to apply these methods to saving lives and livelihoods.”

    https://climatecontrarian.wordpress.com/2021/01/26/richard-betts-finally-gives-up-on-science-embraces-politics-ideology-and-pseudoscience/?preview=true

    Like

  18. Jaime,

    As I see it there are four problems with Richard Betts’ statement:

    1. Putting numbers on something does not necessarily point towards an objective reality, since subjective uncertainty is readily quantifiable.

    2. He is only quantifying the probability of necessity. To complete the causal analysis he has to compute the probability of sufficiency.

    3. A high probability of necessity may suggest the need for preventive action but, to convict, a court will also be looking for a high probability of sufficiency, and he doesn’t have one.

    4. The calculation of the probability of necessity is based upon models that have enough structural uncertainty in them for any good defence barrister to exploit.

    Like

  19. “Covid Inquiry: Mistake not to consider range of pandemics – David Cameron”

    https://www.bbc.co.uk/news/uk-politics-65950286

    “Former Prime Minister David Cameron has said it was a “mistake” not to consider different types of diseases when preparing for future pandemics. Giving evidence to the Covid Inquiry, Mr Cameron said “group think” meant his government did not focus enough on pandemics other than flu.”

    You don’t say? Why are they spending all this money calling witnesses to testify before a multi-year inquiry when all they need to do is sit down and read the 2017 issue of the National Risk Register? Better still, they could just take a look at Penny Mordaunt’s face.

    Like

  20. Sorry, John, I seem to have missed this article first time round. Thanks for bringing it to prominence again. Particularly relevant now that the Covid Inquiry has commenced.

    Like

  21. John – you see/post things with clarity which few others do on other blogs.
    “Why are they spending all this money calling witnesses to testify before a multi-year inquiry when all they need to do is sit down and read the 2017…”
    thanks for you sane take on this

    Liked by 1 person

  22. Perhaps the 2024 edition of the National Risk Register should feature a mugshot of Keir Starmer, along with pictures of severe cold weather, snow covered solar panels, frozen wind turbines and moth-balled power stations? Just a thought.

    Liked by 2 people

  23. Jaime,

    You do realise that was just a denier’s fantasy don’t you? On the other hand, what image could they use to depict an economic wasteland?

    Liked by 1 person

  24. The BBC has announced the publication of the UK government’s latest National Risk Register today, using the headline:

    “Future pandemic and extreme weather among key threats to UK”

    https://www.bbc.co.uk/news/uk-politics-66387589

    Appropriately enough, the article is heralded by the BBC with a suitably dramatic picture of stormy weather.

    I hope to have the time in the near future to write a Cliscep article evaluating the register in some detail. In the meantime, here are my first impressions:

    a) Once again, the front page of the report carries a picture depicting weather-related risk. This is despite the fact that the risk assessment itself does not place such risks at the top of the list of risks ordered by severity (i.e. likelihood x impact).

    b) There is very little said regarding risks related to nuclear conflict. It seems that the 2020 register’s precedent of excluding them is being maintained.

    c) There is nothing said regarding the risks associated with Net Zero. Instead, it is described only as a means of managing climate risks. Appropriate to this promotion of net zero as being a risk-free transition aimed at tackling climate risk, Oliver Dowden will be launching the publication of the register when visiting energy supplier SSE’s Able Seaton Port facility in Hartlepool. The renewables firm is overseeing the installation of the first 260 metre-high wind turbines at Dogger Bank Wind Farm. The BBC quotes Dowden as saying: “This is the most comprehensive risk assessment we’ve ever published, so that government and our partners can put robust plans in place and be ready for anything. One of those rising risks is energy security. We’ve installed the first turbine at the future world’s largest offshore wind farm, which will provide secure, low-cost and clean energy for the British people – enabling us to stand up to [Russian President Vladimir] Putin’s energy ransom.”

    d) There is a lot of boasting regarding how good the government’s risk assessment process is. They also talk a lot about lessons learnt from Covid-19. But I would have thought that the biggest lesson to be learnt from Covid-19 is just how useless the government’s risk assessment process is.

    Dowden’s boasts of ‘robust plans’ and being ‘ready for anything’ are quite risible, but I won’t say any more for the time being. I have already made clear my views regarding risk registers and black swans.

    Is Climate Change a Black Swan?

    Liked by 2 people

  25. John: Did you know to expect a new National Risk Register in the middle of 2023, out of interest?

    No mention of nuclear conflict risk: “we don’t want to cause alarm”.

    Front page of report: “we love to cause alarm, as long as it’s phony alarm”.

    Thanks for the overview.

    Like

  26. No, Richard, I wasn’t waiting for the latest edition to appear this year. I’m not actually sure what determines the timing of the reports. But now it has arrived, it strikes me as being well worth taking a closer look. I’m just not sure when I will be able to get around to it. It is quite a big document (190 pages) within which there is quite a lot of detail.

    However, another overall observation I could share at this stage is that a great deal of effort seems to have gone into giving a false sense of confidence regarding the robustness of the exercise. Part of this impression comes from their pseudo-quantification of the scale of risk. Although a standard risk matrix is used, with a 5×5 grid, they present it logarithmically, insofar as the grids are not of equal size. By doing so they are inviting the reader to view the matrix as a graph with axes. Also, the various risks are placed onto the grid in precise positions with attendant error bars. Normally, a risk matrix is used to present the results of a largely qualitative assessment in which the scores 1-5, for both likelihood and impact, are taken as ordinal numbers, i.e. they indicate nothing more than order of size, such that a class 4 risk is simply greater than a class 2 risk. However, they seem to be treating them as cardinal numbers, in which two class 2 risks would be the equivalent of a single class 4 risk (once the logarithmic scale has been accounted for). This just seems so wrong. Risk matrices should never be treated that way. I’m quite sure there is nothing in their ‘expert’ assessments that could possibly justify treating a risk’s position on the matrix as if it were a scientifically measured variable. I smell bovine excrement.

    Liked by 2 people

  27. I see the Daily Mirror has a very different take to the BBC regarding the publishing of the latest National Risk Register:

    “Nuclear attack and internet blackout warning as 89 biggest threats facing UK revealed”

    https://www.mirror.co.uk/news/politics/nuclear-attack-internet-blackout-warning-30611538

    In fact, they have got that very wrong. The register does not include a nuclear attack on the UK as one of its risks. The nearest the register comes to addressing a nuclear attack on the UK comes under the heading “Nuclear miscalculation not involving the UK”, in which the possibility of an accidental escalation to nuclear conflict is discussed. The register says:

    “The reasonable worst-case scenario for this risk involves a limited nuclear conflict between two states that does not involve the UK.”

    The Mirror article says:

    “The potential impact of a nuclear attack on Britain is also war-gamed. ‘In the case of a nuclear event, the impacts would be catastrophic for the UK,’ says the Register.”

    Yes, but this is actually in regard of a terrorist attack in which radioactive material is released into an unenclosed environment. It is true that the triggering of the NATO mutual security agreement is also discussed elsewhere in the register, but even then, nuclear apocalypse does not seem to be on the radar:

    “The reasonable worst-case scenario for this risk involves an adversary state with a large, advanced military conducting a major air and land assault on a non-North Atlantic Treaty Organization (NATO) security partner of the UK. The partner state suffers mass military and civilian casualties and a refugee crisis develops. Although the scenario is not UK based, there are likely to be British Nationals involved and humanitarian assistance will be required.”

    Liked by 1 person

  28. My apologies, but in my previous comment I accidentally cut and pasted the wrong paragraph from the register. What I should have said is this:

    It is true that the triggering of the NATO mutual security agreement is also discussed elsewhere in the register, but even then, nuclear apocalypse does not seem to be on the radar:

    “There is disruption to UK and European economies as economic ties with the hostile state are severed. There would be large numbers of casualties and fatalities. Although the scenario is not UK based, there are likely to be some British Nationals involved. Depending on the region where the crisis occurs, there could be severe disruption to gas supplies.”

    The point being that even when nuclear escalation is the obvious worst case plausible scenario, our government is still ignoring that in order to put in another plug for the benefits of UK-based windfarms!

    Like

  29. John,

    Good luck with analysing such a lengthy document. I hope I’m not stealing your thunder, but I notice that at p144 the NRR says:

    Climate change has already altered the risk of certain types of extreme weather in the UK, with evidence suggesting that the frequency and intensity of storms is likely to increase in the future. The UK has experienced several severe storms over the last few years, including Storm Eunice in 2022, which brought gusts in excess of 100mph. The impacts of the storm across the UK included 3 fatalities, school closures, power cuts and nationwide cancellations of transport services.

    Meanwhile, the recently published “State of the UK Climate 2022” report, referenced Storm Eunice and the trends of wind speeds as follows:

    Storm Eunice on 18 February 2022 was the most severe storm to affect England and Wales since 12 February 2014….

    …The UK annual mean wind speed from 1969 to 2022 shows a downward trend, consistent with that observed globally.

    And:

    Figure 65 shows there are several more severe storms in the observational records; for example, wind gusts recorded during the Burns’ Day storm of 25 January 1990 were approximately 10–15 Kt higher than storm Eunice, and this storm resulted in widespread severe damage and almost 50 lives lost. The storm of 26 February 1990 was also much more severe.

    Clearly, danger to life and property from storms is a risk that needs to be assessed and managed. However, the claim in the NRR about increasing storminess doesn’t seem to sit easily with the facts, given that the trend is downwards, and however serious Storm Eunice was, the storms of January 1990, for instance, were much more severe.

    Not a good start if they want to be taken seriously.

    Liked by 1 person

  30. At the risk of overstaying my welcome, I would like to add to what I have said regarding pseudo-quantification.

    Risk matrices are useful tools for prioritising risks – but that is where it should end. They often use cells that are labelled with numbers, but that is all they are – numeric labels. Often these numbers correspond to highly subjective labels such as ‘high’, ‘medium’ and ‘low’. One should never lose sight of this fact. In the case of the matrix used by the National Risk Register, I can just about see the logic behind the use of a logarithmic scale for the likelihood of the risk because, at least, likelihood can be expressed mathematically. But to do that for the impact when the impact is expressed qualitatively is simply unjustified. In what sense can qualitative terms such as ‘high’, ‘medium’ and ‘low’ be placed on a logarithmic scale? And to represent risks as points with attendant error bars only adds to this false impression of a fully quantified scale. But don’t worry, this is all just bullshit at the end of the day. If you look closely enough, the register’s risk matrix is still just a tool used to put risks into boxes. It is still just a two-dimensional list, tarted up to look like a graph.

    But whilst I’m on here, there is one other methodological concern worth pointing out. The document explains that government agencies calculate likelihoods of non-malicious risks (such as natural events) as the probability of occurrence over a five year period, yet malicious risks (such as terrorist attacks) are assessed over a two year period. This means, of course, that the risks cannot be plotted on the same matrix until these two sets of likelihoods have been normalised. However, this is not done. The two sets of likelihoods are simply mapped onto each other on the basis that they cover matching range values. Wrong!

    Liked by 1 person

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.