Skip to main content

Guidance for Scotland’s Regional Resilience Partnerships on Risk and Preparedness Assessments

December 2017

Risk Preparedness Assessment

Risk Preparedness Assessment

The RPA process allows RRPs to assess risks within their region and their level of preparedness to deal with the consequences of the identified risks. The RPA process focuses on developing resilience and dealing with consequences rather than causes of emergencies.

There are four stages to the RPA process, illustrated in the diagram in Annex B:

  1. Understanding the context in the region and identifying the relevant risks based on knowledge and historical or empirical data.
  2. Assessing these risks using the best available evidence based on the reasonable worst case scenario.
  3. Assessing level of preparedness to deal with the consequences of these risks.
  4. Communicating with the public.

Stage 1: Context

Context is based around the concept of anticipation. Responders are required to systematically identify new or changing risks within their region. This process is also known as horizon scanning and should consider:

  • Environment – What is the region’s geography? What are the vulnerabilities? Are there any protected sites (e.g. sites of special scientific interest)?
  • Hazardous sites – What potentially hazardous sites are there in your region? Where are they in relation to communities or sensitive environmental sites?
  • Social – What is the demographic, ethnic and socio-economic makeup? Are there any particularly vulnerable groups? Where are the communities situated? How prepared are different communities?
  • Infrastructure – Where is key infrastructure in your region (e.g. transport, utilities, business etc)? What are the critical supply networks? Are there sites that are critical for local, regional and national essential services?
  • Regional economy – What are the most significant economies in the region? How prepared are these businesses to deal with emergencies?

Stage 2: Risk Assessment

Risk assessment is a process of understanding the significance of potential events on the basis of plausibility and likelihood of impact. The outcome description of each risk is based on the reasonable worst case scenario. It describes a plausible manifestation of the risk and the likely immediate consequences of the event.

Risk assessment is a key part of the emergency planning process and is a statutory responsibility for Category 1 responders. Category 2 responders bring a wealth of expertise and knowledge which can enhance the evidence base of the regional risk assessment.

It is important to assess risk at a regional level as the impact of risk is likely to vary across the three regions. Each region should consider if the risk is relevant to the area or should be excluded. Regions may also want to consider risks out with their area which will have a wider impact. By assessing risk regionally the risk assessments should reflect local circumstances. The overall assessment of the risk and prioritisation on the risk matrix will allow regions to consider if current planning and capabilities are sufficient and if further work is required to respond to the consequence.

The risk assessment stage is split into assessing hazards (naturally occurring events or accidents) and assessing threats (malicious attacks). These are separated because different techniques are used to assess the probability of these different types of emergencies occurring (likelihood is used for hazards and plausibility for threats) – see Annex C for definitions.


Hazards are divided into categories indicating their type i.e. industrial, hazmat disease as well as subdivided into “H” and “HL” risks. “H” risks are hazards which will require a national response as well as a local response and are identical to those in the National Risk Assessment (NRA). “HL” risks give a local picture of “H” risk and are risks that would provide a significant challenge to the region but are unlikely to prompt a national response. The 2016 NRA no longer includes “HL” risks. It is therefore at the discretion of each RRP if they would like to include “HL” risks in future cycles of the RPA process, as consequences will have already been planned for in the “H” risk.


The terrorist threat to Scotland is no different to the rest of the UK. Work to mitigate and prevent these threats continues to be taken forward separately from the RPA a significant part of that relies upon the core consequence work that is undertaken to mitigate hazards. It is therefore essential that this core consequence work continues to improve and be as effective as possible. While threats are not part of the Scottish Risk Assessment (SRA), limited threat information has been included as part of the “OFFICIAL – SENSITIVE” version of the NRA available on ResilienceDirect.


Likelihood assessment for hazards are presented on a scale of 1-5 with 1 being the lowest. The likelihood scale is influenced by two main factors:

  • Many events covered in the risk assessments will tend to be unlikely to occur over the next 5 years, and;
  • The degree of precision which the likelihood assessment can be made. In some cases the statistical data is available that provides a high degree of confidence to the analysis. However, in many other cases it is only possible to differentiate likelihood by order of magnitude.

The likelihood of an event occurring differs from region to region, therefore each RRP should consider its own likelihood assessment as part of the RRP process, using local expertise and empirical evidence. If the reasonable worst case scenario does not apply to the region this can be reflected in a lower likelihood score, though the rationale should be fully audited. However, the likelihood score should never be higher than the NRA.

In estimating the likelihood of an event by considering historical events care needs to be taken depending on how far back the event occurred. The more historical the incident the less relevant the evidence may become. A sliding scale of 3 to 5 years is suggested. However, this is only a recommendation and is at the discretion of the RRP to include events further in the past to ensure that all relevant evidence is considered.

Likelihood scoring scale



Percentage chance over 5 years

Chance over 5 years



Between a 0.005% and 0.05% chance

Between a 1 in 20,000 and 1 in 2,000 chance



Between a 0.05% and 0.5% chance

Between a 1 in 2,000 and 1 in 200 chance



Between a 0.5% and 5% chance

Between a 1 in 200 and 1 in 20 chance


Medium- high

Between a 5% and 50% chance

Between a 1 in 20 and a 1 in 2 chance



More than a 50% chance

More than a 1 in 2 chance

Table 1: Likelihood scale

The design of the likelihood scale is influenced by two factors. Firstly, the events covered by the risk assessment and NRA will tend to be very unlikely. Experience has shown that a typical likelihood scale that ranges linearly from ‘highly likely’ to ‘highly unlikely’ would cause the great majority of risks to cluster at the lower end of the scale. Since the primary purpose of the likelihood assessment (and the risk assessments as a whole) is to differentiate the seriousness of possible events, this would be unhelpful. Consequently, the likelihood scale increases exponentially by an order of magnitude per step on the scale (i.e. it is logarithmic). The result is a better spread of likelihoods for the events being assessed.

The second factor that influenced the design of the scale is the precision with which the likelihood assessments can be made. In some cases there will be statistical data that lends a high degree of confidence to the assessment (e.g. based on historical assessment, modelling, robust analytics, etc.). In many cases though, it is only possible to differentiate likelihoods by orders of magnitude. The points on the likelihood scale above represent this.


The regional assessment of impacts for all types of risks can vary from the SRA or NRA to reflect regional circumstances and the degree to which risks would be expected to overwhelm local resources. In some cases the local impact score may therefore be higher than those in the SRA or NRA. However, the expected consequences within the region should be less or equal to the expected consequences at national level.

Risk Evaluation

Once the likelihood and impact scores have been assessed and agreed their position can be plotted on a risk matrix. The risk matrix is asymmetric, allocating a higher priority to the impact of risk than the likelihood. The strategy of prioritising towards impact is because by planning for high impact risks the consequences of lower impact risks are inherently planned for regardless of likelihood.

Monitoring and Reviewing

Risks should be monitored continuously and updated if there is any change in context within the region or if any disruptive events occur.

Stage 3: Preparedness Assessment

Consequence based planning

RRP plans should be focused on the consequences of, and not the causes of emergencies. Emergencies can be caused by a wide range of factors but the effects will often share identical or similar consequences. For instance, care for people issues can arise from a wide range of incidents which share few other characteristics. A flood, a terrorist attack or an industrial incident can all lead to similar requirements for shelter and support to a local community. As a result, many aspects of preparation can be generic in nature, focusing on mitigating the consequences of an emergency whilst, from a planning perspective, paying relatively little attention to the cause of the disruption. This all-risks approach, concentrating on consequences rather than causes, allows a process of generic planning which can be adapted readily to fit to a wide range of issues around response and recovery.

Whilst the all-risks approach is effective, each emergency will have unique aspects, some of which may be unforeseen. Therefore, the ability to be flexible and adaptable is a crucial quality. Emergencies cannot always be accurately predicted and responders must always be ready to adapt plans to suit a situation unfolding in an unforeseen way.

This approach helps avoid duplication and allows resources to be allocated optimally, reserving more resource intensive specific planning for risks which are very high priority risk or have unique consequences which generic planning cannot cover.

The UK National Resilience Planning Assumptions

National Resilience Planning Assumptions define the impact that should be prepared for nationally. This should be scaled down to a regional level (local planning assumptions) and used to drive the development of capabilities. Capability is ordinarily the expertise, ability and experience required to deal with a range of consequences and capacity is the people and assets required.

Capacity is the level of resource available to sustain a determined response. A capacity is not just a resource but the ability to undertake a task and the capacity to do so. A capacity may be defined as a demonstrable ability to respond to and recover from a hazard. It also has to be determined if there is sufficient capacity to deliver the capability requirements.

Firstly, decide which risk should define the planning assumptions based on the risk matrix below which can be grouped into Priority 1 and Priority 2 capability drivers. The risk that has the potential to cause the greatest severity of that particular consequence is then used to define the level of capability required. Building generic capacity set by the higher risks ensures the ability to respond to lower risks that are not specifically driving resilience planning.


Table 2: Scottish Risk Matrix
Table 2: Scottish Risk Matrix


Preparedness analysis can then be conducted to baseline current capacity and capability against the assessed level of capacity required as defined in the local planning assumptions. The gaps identified can then inform the programme of work to build capacity and reduce the gaps.

Stage 4: Communication

One of the seven main duties placed on Category 1 responders is the duty to communicate with the public. The mandatory requirements under the Act and Regulations are to arrange for the publication of risk assessments where publication is necessary or desirable to:

  • Prevent an emergency
  • Reduce, control or mitigate the effects of an emergency
  • Enable action to be taken in connection with an emergency.

In publishing information, responders should ensure that they do not cause unnecessary alarm. Due regard should be given to the warning and informing arrangements maintained by other responders and agencies.

Sensitive information should not prevent publication, however consideration should be given to the implications of publishing and any necessary permissions required. Some aspects of the risk process may be sensitive and care should always be taken prior to any public release, ensuring always that proper assessment is undertaken and appropriate permissions are sought.

Community Risk Register

The CRR is the document that the three RRPs use to communicate with the general public about risks identified in the RPA process that have the highest likelihood and potential to have significant impact and cause disruption to communities.

The purpose of a CRR is to:

  • Inform the public about the highest risks and their consequences
  • Educate them on what the Resilience Partnership is doing.
  • Provide them with links to organisations and websites to find out more and,
  • Encourage steps to be taken for them to become better prepared and more resilient in their homes, businesses and community.
  • Act as the Resilience Partnership’s core public warning and informing document.

A CRR should be reviewed and updated regularly as the final stage of the RPA process. The CRRs for Resilient Partnerships across Scotland can be found on the SFRS website at:

CRRs are the statutory requirement of RRPs but there are other communication outputs from the RPA process for example a gap analysis report or reports to the RRP Chair or Scottish Ministers.

Community Resilience

Community resilience is based on a culture of preparedness, in which individuals, communities and organisations take responsibility to prepare for, respond to and recover from emergencies. The CRR provides a summary of the key risks specific to the three RRPs which provides a shared understanding of the risks that communities may face. By communicating clearly with the public about the risks they might face, they will be empowered to take more responsibility in preparing for, responding to and recovering from the impacts of those risks.

Communities may also have knowledge of the local impacts of risks, which can complement responders’ understanding. In some circumstances communities might be better placed or quicker to address particular needs than Category 1 and other responders. By communicating with communities in advance they can be more aware, and more prepared, to help themselves and each other.

For further information on community resilience and business resilience, please see the relevant spokes on Ready Scotland.

Stay Informed

Ready Scotland regularly publishes alerts on both Twitter and Facebook. Follow and like our pages to keep up to date wherever you are.

Scottish Government


COVID-19 Government Guidance

For the latest advice on schools, workplaces, shopping and more please visit the Scottish Government website.

Visit Gov.Scot