The RRP RPA allows RRPs to assess risks and their level of preparedness to deal with the consequences of the identified risks within their region, and communicate with the general public about the risks identified in the RRP RPA.

The RRP RPA focuses on developing resilience and dealing with consequences of rather than causes of emergencies.

There are four stages to the RRP RPA, illustrated in the diagram at Annex B:

1. Understanding the context in the region and identifying the relevant risks based on knowledge and historical or empirical data and review of the NSRA and SRA.
2. Assessing these risks using the best available evidence based on the reasonable worst case scenario.
3. Assessing the level of preparedness to deal with the consequences of these risks and then developing a work plan aimed at filling any capability and capacity gaps.
4. Communicating with the public.

5.1 Stage 1: Context

Context is based around the concept of anticipation. Responders are required to systematically identify new or changing risks within their region. This process is also known as horizon scanning and should consider:

• Environment – What is the region’s geography? What are the vulnerabilities? Are there any protected sites (e.g. sites of special scientific interest)?
• Hazardous sites – What potentially hazardous sites are there in your region? Where are they in relation to communities or sensitive environmental sites?
• Social – What is the demographic, ethnic and socio-economic makeup? Are there any particularly vulnerable groups? Where are the communities situated? How prepared are different communities?
• Infrastructure – Where is key infrastructure in your region (e.g. transport, utilities, business etc)? What are the critical supply networks? Are there sites that are critical for local, regional and national essential services?
• Regional economy – What are the most significant economies in the region? How prepared are these businesses to deal with emergencies?

5.2 Stage 2: Risk Assessment

Risk assessment is a process of understanding the significance of potential events on the basis of likelihood of an impact. The outcome description of each risk is based on the reasonable worst case scenario. It describes a plausible manifestation of the risk and the likely immediate consequences of the event.

Risk assessment is a key part of the emergency planning process and is a statutory responsibility for Category 1 responders. Category 2 responders and other key resilience partners bring a wealth of expertise and knowledge which can enhance the evidence base of the regional risk assessment.

Each region should start with reviewing the two national risk products, the NSRA and the SRA, and consider if the risks contained within are relevant to the area or should be excluded. Regions may also want to consider NSRA and SRA risks outside their area which may have a wider impact.

NSRA

The NSRA is produced every two years by the Civil Contingencies Secretariat (CCS) as a tool used to drive risk management and is an essential part of the way national security is approached. It is an Official Sensitive document, only available on Resilience Direct.

The NSRA assesses the key risks that could potentially damage the safety or security of the UK, or its interests, both domestically and overseas. Each risk is evaluated in a consistent manner using a reasonable worst case scenario approach and is assessed in terms of likelihood and impact. It also draws out the consequences should such a scenario occur.

Historically the CCS produced a National Risk Assessment (NRA) focussed on domestic emergencies over a five year timescale and an NSRA which focussed on broader national security risks (including international risks) over a 20 year timescale, separately. These were combined and, together with previous iterations of the NRA and NSRA, deliver a unified risk assessment framework, which enables the direct comparison of risks that are malicious and non-malicious, as well as those that are domestic and international.

Scottish Risk Assessment

The purpose of the SRA is to help the resilience community in Scotland understand civil contingencies emergencies which Scotland may face within the next five years, and to use this to prepare for and respond to these should they occur.

The SRA provides Scottish context for risks where Scotland would be affected differently to the rest of the UK and is designed to supplement the NSRA, while remaining a stand-alone document.

The SRA is developed using information from the UK NSRA, together with Scottish-specific information from subject matter experts. The SRA uses an adaptation of the methodology used for the UK’s National Risk Assessment (NRA), the predecessor to the current NSRA, with impact scales adjusted appropriately for Scotland and a focus on natural hazards and accidents.

It should be noted that the SRA uses impact scores to describe the overall severity of the impacts of an emergency whereas the RRP RPA uses 12 common consequences (which are discussed later) to highlight potential response scenarios.

As a strategic tool, the SRA does not replace or replicate more detailed risk assessment products and evidence, whether that be dynamic intelligence threat assessments or short term hazards forecasts.

The SRA will continue to be developed on a two year cycle with those risks that need specific consideration for Scotland assessed with Scottish responders, scientific experts and policy leads. These risks will be identified by subject matter experts and validation groups. Those risks that do not need specific Scottish consideration i.e. where the scenario described in the NSRA is accurate for Scotland and the science is the same, would not be assessed separately for Scotland.

Risk analysis

For each NSRA or SRA risk identified, the RRP should consider the extent to which the likelihood and impact applies to their region. The NSRA and SRA set out the Reasonable Worst Case Scenario (RWCS) at the national level. The impact of this RWCS may differ at the regional or local level when local expertise and empirical evidence are reviewed. In such cases it is, therefore, necessary that responders conduct their own assessment of risk for their area, using the national NSRA and SRA RWCS as a basis, with the rationale clearly documented and noting that the revised regional likelihood and/or impact scores should not be higher than the national levels. The RRP should notify the SG and provide robust evidence if a likelihood score is ever found to be higher than that in the NSRA or SRA.

When considering regional variations, however, there may be some risks unique to a region which could provide a significant challenge but which are not covered in the NSRA or SRA. A risk unique to the region and not dealt with in either the NSRA or SRA would require a risk assessment for that specific risk to be undertaken, guided by the SRA methodology to ascertain likelihood and impacts scores. The RRP should then notify the SG and supply robust evidence of the risk.

In completing the risk assessment stage, the RRP should make good use of previous RRP RPA work, and in particular consider whether there has been any change in the risk or the preparedness of the region to deal with the consequences of the risk since the previous RRP RPA.

Risk Evaluation

The identified risks can be plotted on a risk matrix based on likelihood and impact with the strategy of prioritising planning towards greatest impact. By planning for high impact risks the consequences of lower impact risks are inherently planned for.

Monitoring and Reviewing

Risks should be monitored continuously and updated if there is any change in context within the region or if any disruptive events occur.

5.3 Stage 3: Preparedness Assessment - Consequence based planning

Stage 3 of the RRP RPA moves from focussing on risk to the assessment of preparedness, where RRPs consider their level of preparedness to deal with the consequences of risks.

Emergencies can be caused by a wide range of factors but the effects will often share identical or similar consequences. For instance, care for people issues can arise from a wide range of incidents which share few other characteristics. A flood, a terrorist attack or an industrial incident can all lead to similar requirements for shelter and support to a local community. As a result, many aspects of preparation can be generic in nature, focusing on managing the consequences of an emergency whilst, from a planning perspective, paying relatively little attention to the cause of the disruption.

This all-risks approach, concentrating on consequences rather than causes, allows a process of generic planning which can be adapted readily to fit to a wide range of issues around response and recovery. It helps avoid duplication and allows resources to be allocated optimally, reserving more resource intensive specific planning for risks which are very high priority risk or have unique consequences which generic planning cannot cover.

Whilst the all-risks approach is effective, each emergency will have unique aspects, some of which may be unforeseen. Therefore, the ability to be flexible and adaptable is a crucial quality. Emergencies cannot always be accurately predicted and responders must always be ready to adapt plans to suit a situation unfolding in an unforeseen way.

The 12 common consequences

To assist with a consequence-based planning approach, the consequences of emergencies have been broadly grouped into 12 groups, the ‘12 Common Consequences’, as detailed in Table 1.

The 12 Common Consequences have been developed using the meaning of “emergency” as defined in section 1, parts 1 – 3 of the CCA:

1. In this Part “emergency” means -
   
   1. an event or situation which threatens serious damage to human welfare in a place in the United Kingdom,
   2. an event or situation which threatens serious damage to the environment of a place in the United Kingdom, or
   3. war, or terrorism, which threatens serious damage to the security of the United Kingdom.
2. For the purposes of subsection (1)(a) an event or situation threatens damage to human welfare only if it involves, causes or may cause -
   
   1. loss of human life,
   2. human illness or injury,
   3. homelessness,
   4. damage to property,
   5. disruption of a supply of money, food, water, energy or fuel,
   6. disruption of a system of communication,
   7. disruption of facilities for transport, or
   8. disruption of services relating to health.
3. For the purposes of subsection (1)(b) an event or situation threatens damage to the environment only if it involves, causes or may cause -
   
   1. contamination of land, water or air with biological, chemical or radio-active matter, or
   2. disruption or destruction of plant life or animal life.

For each consequence either one risk, or a small number of risks, that has the potential to cause the greatest severity of that particular consequence is used to define the level of preparedness required. These are often referred to as “driver risks” during planning activities.

Details of the potential severity of the “driver risks” are included in the NSRA and SRA, and where applicable, local risk assessment.

In addition the UK Government produces National Resilience Planning Assumptions (NRPAs) that define the impact that should be prepared for nationally, and Local Risk Management Guidance containing non-statutory guidance and advice for local responders, as NRPAs should be scaled down to regional and local levels.

5.4 Stage 4: Communication

One of the seven main duties placed on Category 1 responders is the duty to communicate with the public. The mandatory requirements under the Act and the Regulations are to arrange for the publication of risk assessments where publication is necessary or desirable to:

• Prevent an emergency
• Reduce, control or mitigate the effects of an emergency
• Enable action to be taken in connection with an emergency

In publishing information, responders should ensure that they do not cause unnecessary alarm. Due regard should be given to the warning and informing arrangements maintained by other responders and agencies.

Sensitive information should not prevent publication, some aspects of the risk process may be sensitive and care should always be taken prior to any public release, ensuring always that proper assessment is undertaken and appropriate permissions are sought.