Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012

<!DOCTYPE html>   <html class="no-js" lang="en" dir="ltr">    <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1" /> <meta name="description" content="Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012" /> <meta name="dcterms.title" content="Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012" /> <meta name="dcterms.issued" content="2018-12-21" /> <meta name="dcterms.modified" content="2016-01-19" /> <meta name="keywords" content="Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012" /> <meta name="dcterms.subject" content="Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012" /> <meta name="dcterms.language" title="ISO639-2" content="eng" /> <title> Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012 </title>      <script src="//assets.adobedtm.com/be5dfd287373/0127575cd23a/launch-f7c3e6060667.min.js"></script>   <link href="/dist/assets/favicon.ico" rel="icon" type="image/x-icon" /><link rel="stylesheet" href="/dist/css/wet-boew.min.css" />   <link rel="stylesheet" href="/dist/Invitation-manager/Overlay.css" /><link rel="stylesheet" href="/css/custom.css" />  <link rel="stylesheet" href="/dist/css/theme.min.css">   <noscript> <link rel="stylesheet" href="/dist/css/noscript.min.css" /> </noscript> <meta name="dcterms.creator" content="Public Safety Canada" /><meta name="dcterms.service" content="ps-sp" /><meta name="dcterms.accessRights" content="2" /></head> <body vocab="http://schema.org/" typeof="WebPage"> <ul id="wb-tphp"> <li class="wb-slc"> <a class="wb-sl" href="#wb-cont">Skip to main content</a> </li> <li class="wb-slc visible-sm visible-md visible-lg"> <a class="wb-sl" href="#wb-info">Skip to "About this site"</a> </li> </ul>  <header role="banner"> <div id="wb-bnr"> <div id="wb-bar"> <div class="container"> <div class="row"> <object id="gcwu-sig" type="image/svg+xml" tabindex="-1" role="img" data="/dist/assets/sig-en.svg" aria-label="Government of Canada"></object> <ul id="gc-bar" class="list-inline"> <li><a href="http://www.canada.ca/en/index.html" rel="external">Canada.ca</a></li> <li><a href="http://www.canada.ca/en/services/index.html" rel="external">Services</a></li> <li><a href="http://www.canada.ca/en/gov/dept/index.html" rel="external">Departments</a></li> <li id="wb-lng"> <h2>Language selection</h2> <ul class="list-inline"> <li><a lang="fr" href="http://securitepublique.gc.ca/cnt/rsrcs/pblctns/ll-hzrds-ssssmnt-archvd/index-fr.aspx">Français</a></li> </ul> </li> </ul> <section class="wb-mb-links col-xs-12 visible-sm visible-xs" id="wb-glb-mn"> <h2>Search and menus</h2> <ul class="pnl-btn list-inline text-right"> <li><a href="#mb-pnl" title="Search and menus" aria-controls="mb-pnl" class="overlay-lnk btn btn-sm btn-default" role="button"><span class="glyphicon glyphicon-search"><span class="glyphicon glyphicon-th-list"><span class="wb-inv">Search and menus</span></span></span></a></li> </ul> <div id="mb-pnl"></div> </section> </div> </div> </div> <div class="container"> <div class="row"> <div id="wb-sttl" class="col-md-5"> <a href="/index-en.aspx"> <span>Public Safety Canada</span> </a> </div> <object id="wmms" type="image/svg+xml" tabindex="-1" role="img" data="/dist/assets/wmms.svg" aria-label="Symbol of the Government of Canada"></object>  <section id="wb-srch" class="visible-md visible-lg"> <h2>Search</h2> <form action="https://www.canada.ca/en/public-safety-canada/search.html?#wb-land" method="get" role="search" class="form-inline"> <div class="form-group"> <input id="wb-srch-q" class="wb-srch-q form-control" name="q" type="search" value="" size="27" maxlength="150" placeholder="Search Public Safety"> </div> <button type="submit" id="wb-srch-sub" class="btn btn-default">Search</button> </form>               </section> </div> </div> </div>  <nav role="navigation" id="wb-sm" data-trgt="mb-pnl" class="wb-menu visible-md visible-lg" typeof="SiteNavigationElement"> <h2 class="wb-inv">Topics menu</h2> <div class="container nvbar"> <div class="row"> <ul class="list-inline menu"> <li> <a href="#section0" class="item">National Security</a> <ul class="sm list-unstyled" id="section0" role="menu"> <li><a href="/cnt/ntnl-scrt/cntr-trrrsm/index-en.aspx">Counter-Terrorism</a></li> <li><a href="/cnt/ntnl-scrt/crss-cltrl-rndtbl/index-en.aspx">Connecting with Canadian Communities</a></li> <li><a href="/cnt/ntnl-scrt/cntr-trrrsm/cntr-prlfrtn/index-en.aspx">Counter Proliferation</a></li> <li><a href="/cnt/ntnl-scrt/crtcl-nfrstrctr/index-en.aspx">Critical Infrastructure</a></li> <li><a href="/cnt/ntnl-scrt/cbr-scrt/index-en.aspx">Cyber Security</a></li> <li><a href="/cnt/ntnl-scrt/frgn-ntrfrnc/index-en.aspx">Foreign Interference</a></li> <li class="slflnk"><a href="/cnt/ntnl-scrt/index-en.aspx">National Security – More</a></li> </ul> </li> <li> <a href="#section1" class="item">Border Strategies</a> <ul class="sm list-unstyled" id="section1" role="menu"> <li><a href="/cnt/brdr-strtgs/bynd-th-brdr/index-en.aspx">Beyond the Border</a></li> <li><a href="/cnt/brdr-strtgs/brdr-lw-nfrcmnt/index-en.aspx">Border Law Enforcement</a></li> <li><a href="/cnt/brdr-strtgs/mmgrtn-nfrcmnt-en.aspx">Immigration Enforcement</a></li> <li><a href="/cnt/brdr-strtgs/prclrnc/index-en.aspx">Preclearance in Canada and the United States</a></li> <li><a href="/cnt/brdr-strtgs/crss-brdr-crm-frm-en.aspx">Canada-US Cross Border Crime Forum</a></li> <li class="slflnk"><a href="/cnt/brdr-strtgs/index-en.aspx">Border Strategies – More</a></li> </ul> </li> <li> <a href="#section2" class="item">Countering Crime</a> <ul class="sm list-unstyled" id="section2" role="menu"> <li><a href="/cnt/cntrng-crm/plcng/index-en.aspx">Policing</a></li> <li><a href="/cnt/cntrng-crm/crm-prvntn/index-en.aspx">Crime Prevention</a></li> <li><a href="/cnt/cntrng-crm/crrctns/index-en.aspx">Corrections and Criminal Justice</a></li> <li><a href="/cnt/cntrng-crm/rgnzd-crm/index-en.aspx">Organized Crime</a></li> <li><a href="/cnt/cntrng-crm/llgl-drgs/index-en.aspx">Illegal Drugs</a></li> <li><a href="/cnt/cntrng-crm/chld-sxl-xplttn-ntrnt/index-en.aspx">Child Sexual Exploitation on the Internet</a></li> <li><a href="/cnt/cntrng-crm/hmn-trffckng/index-en.aspx">Human Trafficking</a></li> <li><a href="/cnt/cntrng-crm/hmn-smgglng/index-en.aspx">Human Smuggling</a></li> <li><a href="/cnt/cntrng-crm/frrms/index-en.aspx">Firearms</a></li> <li><a href="/cnt/cntrng-crm/gn-crm-frrms/index-en.aspx">Gun and Gang Violence</a></li> <li><a href="/cnt/cntrng-crm/nt-mny-lndrng/index-en.aspx">Anti-money laundering</a></li> <li><a href="/cnt/cntrng-crm/frcd-lbr-cndn-spply-chns/index-en.aspx">Forced Labour in Canadian Supply Chains</a></li> <li><a href="/cnt/bt/mmrl-grnt-prgrm/index-en.aspx">Memorial Grant Program for First Responders</a></li> <li class="slflnk"><a href="/cnt/cntrng-crm/index-en.aspx">Countering Crime – More</a></li> </ul> </li> <li> <a href="#section3" class="item">Emergency Management</a> <ul class="sm list-unstyled" id="section3" role="menu"> <li><a href="/cnt/mrgnc-mngmnt/dsstr-prvntn-mtgtn/index-en.aspx">Disaster Prevention and Mitigation</a></li> <li><a href="/cnt/mrgnc-mngmnt/mrgnc-prprdnss/index-en.aspx">Emergency Preparedness</a></li> <li><a href="/cnt/mrgnc-mngmnt/ntrl-hzrds/index-en.aspx">Natural Hazards of Canada</a></li> <li><a href="/cnt/mrgnc-mngmnt/rspndng-mrgnc-vnts/index-en.aspx">Responding to Emergency Events</a></li> <li><a href="/cnt/mrgnc-mngmnt/rcvr-dsstrs/index-en.aspx">Recovery from Disasters</a></li> <li><a href="/cnt/bt/mmrl-grnt-prgrm/index-en.aspx">Memorial Grant Program for First Responders</a></li> <li class="slflnk"><a href="/cnt/mrgnc-mngmnt/index-en.aspx">Emergency Management – More</a></li> </ul> </li> <li> <a href="#section4" class="item">Resources</a> <ul class="sm list-unstyled" id="section4" role="menu"> <li><a href="/cnt/trnsprnc/cts-rgltns/index-en.aspx">Acts and Regulations</a></li> <li><a href="/cnt/rsrcs/cndn-dsstr-dtbs/index-en.aspx">Canadian Disaster Database</a></li> <li><a href="/cnt/rsrcs/frquntl-skd-qustns-en.aspx">Frequently Asked Questions</a></li> <li><a href="/cnt/rsrcs/fndng-prgrms/index-en.aspx">Funding Programs</a></li> <li><a href="/cnt/rsrcs/hlp-en.aspx">Help</a></li> <li><a href="/cnt/rsrcs/lbrr/index-en.aspx">Library and Information Centre</a></li> <li><a href="/cnt/nws/nws-rlss/index-en.aspx">News Releases</a></li> <li><a href="/cnt/rsrcs/pblctns/index-en.aspx">Publications and Reports</a></li> <li><a href="/cnt/rsrcs/svc-stndrds-tpp/index-en.aspx">Service Standards for Transfer Payment Programs</a></li> <li class="slflnk"><a href="/cnt/rsrcs/index-en.aspx">Resources – More</a></li> </ul> </li> </ul> </div> </div> </nav>   <nav role="navigation" id="wb-bc" property="breadcrumb"> <h2>You are here:</h2> <div class="container"> <div class="row"> <ol class="breadcrumb"> <li><a href="/index-en.aspx">Home</a></li><li><a href="/cnt/rsrcs/index-en.aspx">Resources</a></li><li><a href="/cnt/rsrcs/pblctns/index-en.aspx">Publications</a></li><li><a href="/cnt/rsrcs/pblctns/ll-hzrds-ssssmnt-archvd/index-en.aspx">Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012</a></li> </ol> </div> </div> </nav>  </header>  <main role="main" property="mainContentOfPage" class="container" id="wb-cont"> <h1>Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012</h1> <section id="archived" class="alert alert-warning wb-inview" data-inview="archived-bnr"> <h2>Archived Content</h2> <p>Information identified as archived is provided for reference, research or record-keeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.</p> </section> <section id="archived-bnr" class="wb-overlay modal-content overlay-def wb-bar-t"> <header> <h2 class="wb-inv">Archived</h2> </header> <p><a href="#archived">This page has been archived on the Web.</a></p> </section> <div class="col-md-3 text-center"> <img src="ll-hzrds-ssssmnt-archvd-cvr-eng.jpg" class="img-responsive" alt=""> <p>ISBN: 978-1-100-20258-7</p> <p><a href="ll-hzrds-ssssmnt-archvd-eng.pdf" class="button button-large ui-link">PDF (1087 KB)</a></p> </div> <div class="col-md-9 well"> <h2>Table of Contents</h2> <ul class="list-unstyled"> <li><a href="#iap">Introduction and Purpose</a></li> <li><a href="#ahra_emp">Background – AHRA in Emergency Management Planning</a></li> <li><a href="#ahra_process">Overview of the AHRA Process</a></li> <li><a href="#ahra_business">Federal AHRA Business Cycle</a></li> <li><a href="#step1">Step 1: Setting the Context</a> <ul> <li><a href="#step1_objective">Objective of Setting the Context</a></li> <li><a href="#step1_inputs_required">Inputs Required</a></li> <li><a href="#step1_tasks">Tasks and Activities Expected in Setting the Context</a> <ul> <li><a href="#step1_threat">Short-Term Threat/Hazards Analysis</a></li> <li><a href="#step1_risk">Emerging and Future Risk Analysis</a></li> </ul> </li> <li><a href="#step1_outputs">Outputs for Setting the Context</a></li> </ul> </li> <li><a href="#step2">Step 2: Risk Identification</a> <ul> <li><a href="#step2_objective">Objective of Risk Identification</a></li> <li><a href="#step2_inputs">Inputs Required</a></li> <li><a href="#step2_tasks">Tasks and Activities Expected in Risk Identification</a> <ul> <li><a href="#step2_risk">Initial Risk Identification</a></li> <li><a href="#step2_risk_event">Risk Event Scenario Development</a> <ul> <li><a href="#step2_composite_risk">Use of Composite Risk Event Scenarios</a></li> </ul> </li> </ul> </li> <li><a href="#step2_outputs">Outputs for Risk Identification</a></li> </ul> </li> <li><a href="#step3">Step 3: Risk Analysis</a> <ul> <li><a href="#step3_objectives">Objectives of Risk Analysis</a></li> <li><a href="#step3_inputs">Inputs Required</a></li> <li><a href="#step3_tasks">Tasks and Activities Expected in Risk Analysis</a> <ul> <li><a href="#step3_likelihood">Likelihood Analysis</a></li> <li><a href="#step3_impact_analysis">Impact/Consequence Analysis</a></li> <li><a href="#step3_impact_categories">Impact Categories</a></li> <li><a href="#step3_approach">Approach for Impact Rating</a></li> </ul> </li> <li><a href="#step3_ahra_scoring_tool">AHRA Scoring Tool</a></li> <li><a href="#step3_confidence">Confidence Level and Justification for Likelihood Analysis and Impact/Consequence Analysis</a></li> <li><a href="#step3_outputs">Outputs for Risk Analysis</a></li> <li><a href="#step3_impact_assessment">Impact Assessment Categories</a> <ul> <li><a href="#step3_people">People</a></li> <li><a href="#step3_economy">Economy</a> <ul> <li><a href="#step3_direct">Direct Economic Loss</a></li> <li><a href="#step3_indirect">Indirect Economic Loss</a></li> </ul> </li> <li><a href="#step3_environment">Environment</a> <ul> <li><a href="#step3_magnitude_response">Magnitude of Response Required to Deal with an Event</a></li> <li><a href="#step3_geographical">Geographical Extent of Damage</a></li> <li><a href="#step3_magnitude_damage">Magnitude of Damage Based on Environmental Adverse Effects</a></li> <li><a href="#step3_modifier">Modifier for Duration of Damage</a></li> </ul> </li> <li><a href="#step3_territorial">Territorial Security</a> <ul> <li><a href="#step3_modifier_disruption">Modifiers for Duration of Disruption and Population Density</a></li> </ul> </li> <li><a href="#step3_reputation">Canada's Reputation and Influence</a></li> <li><a href="#step3_society">Society and Psycho-Social</a></li> </ul> </li> <li><a href="#step3_likelihood_2">Likelihood Assessment</a> <ul> <li><a href="#step3_malicious">Malicious Threats</a> <ul> <li><a href="#step3_likelihood_rating">Likelihood Rating for Malicious Scenarios</a></li> </ul> </li> <li><a href="#step3_non_malicious">Non-Malicious Hazards</a></li> </ul> </li> </ul> </li> <li><a href="#step4_risk_evaluation">Step 4: Risk Evaluation</a> <ul> <li><a href="#step4_objective">Objective of Risk Evaluation</a></li> <li><a href="#step4_inputs">Inputs Required</a></li> <li><a href="#step4_tasks">Tasks and Activities Expected in Risk Evaluation</a></li> <li><a href="#step4_outputs">Outputs for Risk Evaluation</a></li> </ul> </li> <li><a href="#step5_risk">Step 5: Risk Treatment</a> <ul> <li><a href="#step5_objective">Objective of Risk Treatment</a></li> <li><a href="#step5_input">Input Required</a></li> <li><a href="#step5_tasks">Tasks and Activities Expected in Risk Treatment</a> <ul> <li><a href="#step5_scope">Scope of Risk Treatment</a></li> <li><a href="#step5_risk_treatment">Recommending Risk Treatment Avenues to Senior Management</a></li> </ul> </li> <li><a href="#step5_outputs">Outputs for Risk Treatment</a></li> </ul> </li> <li><a href="#step5_data_management">Data Management</a> <ul> <li><a href="#step5_general">General</a></li> <li><a href="#step5_ahra_risk_register">AHRA Risk Register and Database</a></li> <li><a href="#step5_sensitivity">Data Management and Sensitivity</a></li> </ul> </li> <li><a href="#step5_improvement">Accumulating Knowledge and Continuous Improvement of AHRA</a></li> <li><a href="#annex_1">Annex 1 – AHRA Business Cycle</a></li> <li><a href="#annex_2">Annex 2 – SWOT and PESTLE Analysis</a></li> <li><a href="#annex_3">Annex 3 – AHRA Risk Taxonomy</a></li> <li><a href="#annex_4">Annex 4 – Risk Event Scenario Description Template</a></li> <li><a href="#annex_5">Annex 5 – Rating of the Impact on Canada's Reputation and Influence</a></li> <li><a href="#annex_6">Annex 6 – Economic Category Assessment Tool – Direct and Indirect Economic Loss for Repair or Replacement</a></li> <li><a href="#annex_7">Annex 7 – Glossary</a></li> </ul> </div> <div class="clearfix"></div> <h2>Preface</h2> <p>This document has been developed by Public Safety Canada, in close partnership with Defence Research and Development Canada - Centre for Security Science, as part of the federal All Hazards Risk Assessment initiative endorsed by the Assistant Deputy Minister Emergency Management Committee in October 2009. The All Hazards Risk Assessment methodology and process, which are presented in these guidelines, have been developed in consultation with federal government institutions; Public Safety Canada would like to thank federal experts for their significant contribution to strengthening the principles, assumptions and application of the All Hazards Risk Assessment methodology. As well, other risk assessment stakeholders amongst key international government partners in the areas of risk assessment and emergency management in the United States, the United Kingdom and the Netherlands have provided valuable perspectives that have been incorporated into the methodology.</p> <p>The All Hazards Risk Assessment methodology and process are the result of a pilot phase of the All Hazards Risk Assessment initiative, which concluded in October 2011. The information contained in this document is expected to evolve as the All Hazards Risk Assessment process is implemented on a cyclical basis every year and as best practices on risk assessment are established through international exchange and cooperation through organizations such as the Organisation for Economic Cooperation and Development, the World Economic Forum, the International Council on Risk Governance, the Canadian Standards Association, and the International Organization for Standardization. </p> <p><strong>The principal audience for the methodology guidelines is federal government institutions in Canada</strong>. The <em>All Hazards Risk Assessment Methodology Guidelines, 2011-2012</em> can be read on their own for those interested in conducting risk assessments. For readers interested in integrating risk assessment into emergency management planning, the methodology should be read in conjunction with Public Safety Canada's <em>Emergency Management Planning Guide, 2010-2011</em>, available at: <a href="/cnt/rsrcs/pblctns/mrgnc-mngmnt-pnnng/index-eng.aspx">http://www.publicsafety.gc.ca/cnt/rsrcs/pblctns/mrgnc-mngmnt-pnnng/index-eng.aspx</a>.</p> <p>Questions related to the All Hazards Risk Assessment and the current guidelines may be addressed to Public Safety Canada, Emergency Management Planning Division, at <a href="mailto:AHRA-ETR@ps-sp.gc.ca">AHRA-ETR@ps-sp.gc.ca</a>.</p> <h2>Amendments Record</h2> <p>The following is a list of amendments to the Federal All Hazards Risk Assessment Methodology Guidelines:</p> <table class="table table-bordered"> <caption> Amendments Record </caption> <tr> <th>#</th> <th>Date</th> <th>Amended by</th> <th>Comments</th> </tr> <tr> <td>1.0</td> <td>2011-12-01</td> <td>Emergency Management Planning, Public Safety Canada</td> <td>Initial version</td> </tr> </table> <h2>List of Acronyms and Abbreviations</h2> <dl> <dt>AHRA</dt> <dd>All Hazards Risk Assessment</dd> <dt>BSE</dt> <dd>Bovine Spongiform Encephalopathy</dd> <dt>C3I</dt> <dd>Communications, Command, Control and Intelligence</dd> <dt>CDD</dt> <dd>Canadian Disaster Database</dd> <dt>CI</dt> <dd>Critical Infrastructure</dd> <dt>CSS</dt> <dd>Centre for Security Science</dd> <dt>DALY</dt> <dd>Disability-Adjusted Life Year</dd> <dt>DPR</dt> <dd>Departmental Performance Report</dd> <dt>DRDC</dt> <dd>Defence Research and Development Canada</dd> <dt>EM</dt> <dd>Emergency Management</dd> <dt>EMA</dt> <dd>Emergency Management Act</dd> <dt>ESF</dt> <dd>Emergency Support Function</dd> <dt>FERP</dt> <dd>Federal Emergency Response Plan</dd> <dt>FMD</dt> <dd>Foot and Mouth Disease</dd> <dt>FPEM</dt> <dd>Federal Policy for Emergency Management</dd> <dt>GC</dt> <dd>Government of Canada</dd> <dt>GTA</dt> <dd>Greater Toronto Area</dd> <dt>IRAWG</dt> <dd>Interdepartmental Risk Assessment Working Group</dd> <dt>ISO</dt> <dd>International Organization for Standardization</dd> <dt>NATO</dt> <dd>North Atlantic Treaty Organization</dd> <dt>NS</dt> <dd>National Security</dd> <dt>PESTLE</dt> <dd>Political, Economic, Social, Technological/Technical, Legal and Environmental</dd> <dt>PS</dt> <dd>Public Safety Canada</dd> <dt>RPP</dt> <dd>Report on Plans and Priorities</dd> <dt>SARS</dt> <dd>Severe Acute Respiratory Syndrome</dd> <dt>SME</dt> <dd>Subject Matter Expert</dd> <dt>StatCan</dt> <dd>Statistics Canada</dd> <dt>SWOT</dt> <dd>Strengths, Weaknesses, Opportunities and Threats</dd> </dl> <h2 id="iap">Introduction and Purpose</h2> <p>In today's world, a range of natural and health hazards, as well as man-made threats, are increasing in their frequency, complexity and interconnectedness as a result of globalization and natural and political forces. Pandemics, SARS, earthquakes in Japan and Haiti, and terrorism are examples of events that can impact Canada and Canadians. At home, floods, hurricanes, cyber attacks and forms of ideological radicalization are all recent threats and hazards that the Government of Canada (GC), often in collaboration with the provinces and territories, has taken a role in managing.</p> <p>Threats and hazards vary in their likelihood and impact; an effective approach to managing them requires that the GC identify their risk. Increasingly, domestic governments and international organizations recognize that understanding risks through identifying, assessing and monitoring them is a key step to build the foundation for effective emergency management (EM) planning and a country's resilience. The Government of Canada has operated on similar principles by implementing controls in the form of legislation, regulations, policies and guidelines to address risk and assign risk responsibilities. In Canada, the overarching legislative umbrella in emergency management is the 2007 <em>Emergency Management Act</em> (EMA), which establishes the federal role in emergency management, and the role and responsibilities of the Minister of Public Safety as well as those of all Ministers.</p> <p>In support of sound EM principles, the EMA stipulates that Ministers are responsible for identifying risks that are within or related to their mandate and to prepare EM plans to respond to those risks. It identifies the Minister of Public Safety as being responsible for providing leadership and guidance to federal government institutions, including in the preparation, maintenance, and testing of emergency management plans. The Act is articulated by the <em>Federal Policy for Emergency Management</em> (FPEM) and associated tools, such as the <em>Emergency Management Planning Guide</em>, 2010-2011 (Guide).</p> <p>The development of the All Hazards Risk Assessment (AHRA) methodology, led by Public Safety Canada (PS), in close partnership with Defence Research Development Canada (DRDC) – Centre for Security Science (CSS), supports all federal government institutions in fulfilling their legislative responsibility to conduct mandate-specific risk assessments as the basis for EM planning. As risks often cross boundaries and mandates, an effective means to deal with them is through a horizontal approach. In Canada, the approach to EM is based on four components: prevention/mitigation, preparedness, response and recovery. When viewed from this perspective, the ownership of risks is more often than not shared across the mandates of Ministers, or even across jurisdictions. Therefore, a coordinated approach is required to manage risks effectively by assessing them using the same methodology and then treating them through a collaborative approach that recognizes the interdependencies amongst ministerial mandates.</p> <p>The AHRA process is premised on the assumption that risks are co-owned and co-managed. The intention of the process is therefore to produce a whole-of-government risk picture to support EM planning across federal government institutions and to ensure that interdependencies are recorded and managed. The risk picture provides an enhanced planning baseline for federal government institutions to support the development of EM plans, as outlined in the Guide, and future capacity and investment decisions in areas where attention may be required. As well, the methodology can be used by federal institutions to perform their own risk assessment and ensure integration and alignment with the whole-of-government process. Finally, this initiative provides a venue for the creation of a federal AHRA community of practice, and a forum for sharing risk information, tools and methodologies.</p> <p>Risk assessment specific to the critical infrastructure (CI) sectors is beyond the scope of the federal AHRA methodology and would be carried out under the <em>National Strategy and Action Plan for Critical Infrastructure</em>. Going forward, the possibility of aligning these risk assessment activities will be examined.</p> <p>The purpose of the present guidelines document is to describe the AHRA methodology and its process, which is primarily meant to support the EM process at the federal level.</p> <h2 id="ahra_emp">Background – AHRA in Emergency Management Planning</h2> <p>The AHRA initiative incorporates expertise from a wide range of federal government institutions and applies an all hazards approach. It is a comprehensive and integrated means for assessing the impact and likelihood of both malicious and non-malicious hazards and threats that Canada could face over a five year period. By assessing the risks associated with all hazards in an integrated way, efforts may be broadly effective in reducing the vulnerability of people, property, the environment and the economy. </p> <p>More specifically, the AHRA's objectives are to:</p> <ul> <li>Enable federal government institutions to perform AHRA consistently and efficiently as part of their risk management responsibilities under the EMA and other relevant legislation and policies.</li> <li>Address the interconnected nature of Canada's risk environment and provide a means to produce a collective judgment of risk assessments currently being carried out by different federal government institutions into a whole-of-government picture to inform future actions and initiatives.</li> <li>Support the relative ordering of risk events based on their ratings at a federal level, while enhancing decision-making processes within the GC.</li> <li>Capture risks that are significant and are of federal interest.</li> <li>Raise awareness of risks that may not be of federal concern at this time, but are likely to be elevated in the future.</li> <li>Raise awareness of risks that are not of federal concern, but ensure that these risks are monitored.</li> <li>Capture changes in risks over time.</li> <li>Help to foster an AHRA community of practice for the federal community.</li> </ul> <h2 id="ahra_process">Overview of the AHRA Process</h2> <p>The purpose of the federal AHRA process is to assess and view risks in a standardized fashion using a common set of principles and steps. The assessment of risks of a federal interest will be done on an annual basis, starting officially in June every year with the identification of priority threats and hazards. An AHRA business cycle is available at Annex 1. </p> <p>In the context of the federal AHRA, an all hazards approach does not mean that all hazards will be assessed annually, but rather that all hazards will be considered at the beginning of each new cycle. The annual assessment will focus on the most probable and consequential risks. It is neither possible nor necessary to assess all risks within a given year; rather, a thorough risk picture will be built over several cycles under the guidance of federal experts. </p> <p>The federal AHRA process is based on a methodology that comprises the following steps, as identified in ISO 31000, “Risk Management – Principles and Guidelines”:</p> <ol> <li><strong>Setting the Context</strong> – The process of articulating an institution's objectives and defining its external and internal parameters to be taken into consideration when managing risks.</li> <li><strong>Risk Identification</strong> – The process of finding, recognizing, and recording risks.</li> <li><strong>Risk Analysis</strong> – The process of understanding the nature and level of risk, in terms of its impacts and likelihood.</li> <li><strong>Risk Evaluation</strong> – The process of comparing the results of Risk Analysis with risk criteria to determine whether a risk and/or its magnitude is acceptable or tolerable.</li> <li><strong>Risk Treatment</strong> – The process of identifying and recommending risk control or Risk Treatment options.</li> </ol> <p> The AHRA process employs a scenario-based risk assessment approach. From a high-level perspective, the AHRA focuses on the five steps indicated above and is linked back to the overall emergency management approach, as illustrated in Figure 1.</p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 1 – AHRA Process and Linkage to EM Planning</strong></p> <img src="ll-hzrds-ssssmnt-archvd-01-eng.gif" alt="Figure 1 – AHRA Process and Linkage to EM PlanningFigure 1 – AHRA Process and Linkage to EM Planning" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>AHRA Process.</p> <p>STEP 1: Setting the Context Lists. Short-Term (1 to 5 years) Threat/Hazard Analysis, Identify Risk Themes, Exploration for the Future (5 to 25 years). OUTPUT: Lists (Short-Term & Long-Term) of Threats/Hazards for the Federal Government. Risk Themes </p> <p>STEP 2: Risk Identification. Initial Risk Identification, Prepare Risk Statements (Descriptors), Develop Risk Event Scenario Descriptions. OUTPUT: Identified Risks, Repertoire of Risk Event Scenarios </p> <p>STEP 3: Risk Analysis. Likelihood, Impact. OUTPUT: Scored Risk Event Scenarios </p> <p>STEP 4: Risk Evaluation. Risks. OUTPUT: Harmonised List of Rated Risk Event Scenarios </p> <p>STEP 5: Risk Treatment. Publish Federal AHRA Results and Recommendations. OUTPUT: Risk Register, Risk Maps, Planning Assumptions/Scenarios, Other Visual Tools </p> </details> </div> <div class="clearfix"></div> <p>The AHRA process is meant to create a multi-dimensional, high-level view of risks faced by Canadians, while bringing diverse risks from various sources into the same high-level view, as shown at Figure 2.</p> <p>The outputs from the AHRA process should provide decision-makers with an improved understanding of the relevant risks – which is the combination of the likelihood and the consequence of a specified hazard or threat being realized – that could affect objectives as well as certain indicators of the effectiveness of Risk Treatment measures already in place, the potential effectiveness of additional Risk Treatment measures and an appreciation of the inherent uncertainties in all key aspects of the risk assessment process. Generally, risks translate into events or circumstances that, if they materialize, could negatively affect Canada and Canadians. The hazard risk domain is covered by the federal AHRA methodology. However, the operational risk domain (e.g., day-to-day issues confronting an institution) is not, although these aspects may be considered and factored in Setting the Context prior to identifying risks and assigning impact ratings during Risk Analysis.</p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 2. Example of Diverse Risk Event Scenarios Displayed on a Likelihood-Consequence Graph </strong></p> <img src="ll-hzrds-ssssmnt-archvd-02-eng.gif" alt="Figure 2. Example of Diverse Risk Event Scenarios Displayed on a Likelihood-Consequence Graph" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Consequence: Limited Impact, Catastrophic Impact. Likelihood: Low Likelihood, High Likelihood</p> </details> </div> <div class="clearfix"></div> <h2 id="ahra_business">Federal AHRA Business Cycle</h2> <p>In order to support federal institutions in aligning overall emergency management planning activities with departmental integrated corporate planning activities, PS has developed a specific business cycle for the AHRA. An overview of the cycle is provided in the following paragraphs. </p> <p>As indicated in Figure 3 below, the cycle is initiated in the spring quarter, when PS evaluates risks that have been identified by federal institutions and prepares a report. These results will support federal institutions to identify threats and hazards, as well as strategic corporate directions that could become a priority in the context of a new fiscal year. Institutions should analyse these results to better understand their implications in terms of their organization's year-end review and emergency planning activities. </p> <p>The summer quarter is used for assessing current business challenges, including the identification of priority threats and hazards (or risks) for federal institutions to be brought forward for the next federal AHRA cycle. This is the period during which AHRA results from the previous cycle will be reported out to senior management for decision (as necessary) and inform planning and priority setting exercises for the next AHRA and Emergency Management Planning cycles. </p> <p>In the fall quarter, federal institutions launch departmental planning for the next fiscal year, including setting performance objectives, identifying resource needs and incorporating risk assessment results into revised EM plans. In September of each year, institutions should initiate the development of risk event scenarios for those risks that are retained as priorities by the federal community. Further guidance on risk event scenario development for the AHRA is available at the Risk Identification section.</p> <p>During the winter quarter, experts from federal institutions are convened to conduct Risk Analysis based on the risk event scenarios developed during the fall quarter. This activity is the main objective of risk scoring workshops, which will be planned by PS. Initial results from the risk scoring workshops will support institutions in assessing their level of readiness against priority risks. PS will then plan the final AHRA step, in order to complete the process with Risk Evaluation during the spring and prepare final results in time for the next AHRA cycle.</p> <p>In order to ensure a coordinated approach to the AHRA process, PS created an Interdepartmental Risk Assessment Working Group (IRAWG) representing federal institutions participating in the AHRA process. During the summer quarter, the IRAWG is responsible to choose, amongst the entire list of departmental priority threats and hazards, key risks that will be further assessed during each AHRA cycle. The working group is also responsible for providing PS with on-going and timely strategic safety and security advice related to the AHRA methodology and process.</p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 3. AHRA Business Cycle</strong></p> <img src="ll-hzrds-ssssmnt-archvd-03-eng.gif" alt="Figure 3. AHRA Business Cycle" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Fiscal Year. </p> <p>Spring; Mar/Apr/May: Invitation to federal institutions to review Results of AHRA, Evaluation of AHRA results from scoring Workshops, Call to launch review of AHRA Methodology. </p> <p>Summer; Jun/Jul/Aug: Report on the AHRA result (previous cycle) and presentation to decision-makers, ADM EMRO to send outcall letter: risk identification and launch scenario development process, Review of recommendations for change to methodology and communication to stakeholders. </p> <p>Fall; Sept/Oct/Nov: Scenario development process. </p> <p>Winter; Dec/Jan/Feb: Request for experts from federal institutions to conduct risk analysis, 3 – 4 risk scoring workshops </p> </details> </div> <div class="clearfix"></div> <h2 id="step1">Step 1: Setting the Context</h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-09-eng.gif" alt="Step 1: Setting the Context" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>STEP 1: Setting the Context Lists. Short-Term (1 to 5 years) Threat/Hazard Analysis, Identify Risk Themes, Exploration for the Future (5 to 25 years). OUTPUT: Lists (Short-Term & Long-Term) of Threats/Hazards for the Federal Government. Risk Themes</p> </details> </div> <div class="clearfix"></div> <h3 id="step1_objective">Objective of Setting the Context</h3> <p>The first step when initiating a formal AHRA is to develop a comprehensive understanding of the strategic and operating context of an organization. This is the main objective of Setting the Context. Each federal government institution is responsible to research, review and gather relevant data such as applicable legislation, reports on plans and priorities, departmental performance reports, etc. in order to enhance its understanding of its mandate, responsibilities, areas of interest and various information sources that would help inform the next AHRA process step: risk identification.</p> <h3 id="step1_inputs_required">Inputs Required</h3> <p>Many information sources may be reviewed when Setting the Context. The following are key data sources that may be considered during this process:</p> <ul> <li><strong>Departmental planning and reporting documentation</strong>. Used to plan and report at the organizational level, departmental planning and reporting documents support every federal government institution's efforts to effectively plan and evaluate their performance, as well as the budgetary, appropriation and accountability responsibilities of parliament and the GC. Reports on Plans and Priorities (RPP) are annual expenditure plans that provide information on departmental strategic outcomes and program activities, plans and priorities, expected results, performance indicators and resource requirements on a three-year basis. Departmental Performance Reports (DPR) provide a strategic overview of every institution's performance and achievements in past fiscal years. They are primary instruments of transparency and accountability to Parliament and Canadians and are key documents in better evaluating an institution's risk environment.</li> <li><strong>Environmental scans</strong>. An environmental scan involves being aware of the context in which an institution is operating so as to understand how it could be affected. It entails a process of gathering and analyzing information and typically considers both internal and external factors such as policies, capabilities and key societal drivers and trends (e.g. demography, economy, technology) at a local, national and international level. As part of the environmental scan, the institution defines the internal and external parameters to be taken into account when managing risks and setting the scope and risk criteria for the remaining risk assessment process. There are several approaches to developing an institutional environmental scan. Samples of tools such as a SWOT (Strengths, Weaknesses, Opportunities and Threats) analysis and a PESTLE (Political, Economic, Social, Technological/Technical, Legal and Environmental) analysis are provided at Annex 2.</li> <li><strong>Historical Records</strong>. Historical Records include any historical information relevant to the identification of risks within the domain of the federal government institution's mandate, responsibilities or interests. This will include past risk assessments and associated risk database or register information. The Canadian Disaster Database (CDD) contains detailed disaster information on over 900 natural, technological and conflicts events (excluding war) that have directly affected Canadians over the past century. This database helps citizens and governments to better assess and manage risks and also enhances the understanding of how risks have evolved over time: <a href="/cdd">http://www.publicsafety.gc.ca/cdd</a> In addition, statistical data such as census information (population density, profiles, etc) and special economic and infrastructure data and research literature published by Statistics Canada (<a href="http://www.statcan.gc.ca">http://www.statcan.gc.ca</a>) or other research centres (e.g. National Research Council Canada – <a href="http://www.nrc-cnrc.gc.ca/index.html">http://www.nrc-cnrc.gc.ca/index.html</a>) may inform risks frequency of occurrence and consequences.</li> <li><strong>Intelligence Reports</strong>. Intelligence reports are highly relevant to a range of risk types including rapidly time-varying or emerging phenomena and risks associated with malicious activities.</li> <li><strong>Other Information</strong>. The Risk Assessment process should have access to any other information relevant to the identification of risks within the domain of the federal government institution's mandate, responsibilities or interests. For example, legislation applicable to a federal government institution may clearly indicate risks under the purview of an institution's mandate and may therefore be a reliable source for identifying potential risks of interest to an institution.</li> </ul> <p>These information sources will support the identification of risk themes, defined as activities or phenomena of a particular interest to an institution with which significant risks might be associated. A list of themes may be developed, in order to focus the identification of particular risks of interest in preparation for the next AHRA process step. Finally, these sources will also help in understanding the level of tolerance of an institution towards certain risks.</p> <p>Each federal government institution will determine what data and information inputs it requires according to its mandate, responsibilities or interests and information sources.</p> <h2 id="step1_tasks">Tasks and Activities Expected in Setting the Context</h2> <h3 id="step1_threat">Short-Term Threat/Hazards Analysis</h3> <p>Short-term threat/hazard analysis will identify, isolate and assess risk events that could logically and plausibly occur within the next five years and are under federal jurisdiction for at least one of the four components of emergency management (prevention and mitigation, preparedness, response, recovery). Even though some risk events retained may fall in part under provincial or municipal jurisdiction (e.g. floods, foodborne disease outbreak), their inclusion may be warranted because of authorities and responsibilities of the federal government for at least one of the four components of emergency management (e.g. Environment Canada provides scientific and technical advice and research regarding flooding, which are prevention and mitigation activities).</p> <h3 id="step1_risk">Emerging and Future Risk Analysis</h3> <p>Exploration for the future (or forecasting) will identify threats or hazards relevant to the period from 5 to 25 years into the future. Generally, the further into the future forecasts go, the more data deprived we are. To compensate for the lack of data, foresight practitioners and/or futurists resort to looking at trends, indicators etc. and use various techniques: Technology Mapping; Technology Road-Mapping; Expert Technical Panels, etc. These are alternate techniques that attempt to compensate for the uncertainty of the future and most often alternate futures will be explored. Federal risk experts can get emerging and future insights and trend indicators through community of practice networks such as the Policy Horizons Canada (<a href="http://www.horizons.gc.ca">http://www.horizons.gc.ca</a>) environmental scanning practice group. Another source for emerging and future Risk Analysis is the PS-CSS produced Strategic Planning Guidance for the programs managed by CSS. Foresight activity and Risk Analysis play an integral role in this yearly process. For more information on Strategic Planning Guidance, federal institutions can contact PS Science, Technology and Interoperability Division, at <a href="mailto:S&T_Pol@ps-sp.gc.ca">S&T_Pol@ps-sp.gc.ca</a> or CSS at <a href="mailto:css-info@drdc-rddc.gc.ca">css-info@drdc-rddc.gc.ca</a>.</p> <h2 id="step1_outputs">Outputs for Setting the Context</h2> <p>The information outputs for Setting the Context are: </p> <ul> <li>Analysis of short-term (within the next 5 years) threats and hazards, accompanied with a certain level of comprehension regarding an institution's level of risk tolerance.</li> <li>Analysis of emerging and future (in 5 to 25 years) threats and hazards.</li> <li>Risk themes.</li> </ul> <h2 id="step2">Step 2: Risk Identification</h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-10-eng.gif" alt="Step 2: Risk Identification" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>STEP 2: Risk Identification. Initial Risk Identification, Prepare Risk Statements (Descriptors), Develop Risk Event Scenario Descriptions. OUTPUT: Identified Risks, Repertoire of Risk Event Scenarios</p> </details> </div> <div class="clearfix"></div> <h3 id="step2_objective">Objective of Risk Identification</h3> <p>Risk identification is a key component of the risk assessment process. Risk identification is the process of finding, recognizing and recording risks. The objective of risk identification for the purpose of the AHRA is to identify key risks that have significant impact on Canada and/or Canadians, including Canadian federal institutions. Furthermore, the process assists each federal government institution in confirming risks according to its mandate and responsibilities and in developing plans or preparations necessary to reduce, mitigate or prevent these risks. </p> <h3 id="step2_inputs">Inputs Required</h3> <p>The following information input will help in identifying risks:</p> <ul> <li>Analysis of short-term (within the next 5 years) threats and hazards.</li> <li>Analysis of emerging and future (in 5 to 25 years) threats/hazards.</li> <li>Risk themes.</li> </ul> <p>These inputs should be the outputs extracted from activities and tasks of the previous step, Setting the Context. Further input should be regularly sought from: historical data on relevant risk events, current and/or intelligence information, key policy documents and the Government of Canada's agenda.</p> <h3 id="step2_tasks">Tasks and Activities Expected in Risk Identification</h3> <h4 id="step2_risk">Initial Risk Identification</h4> <p>As per the AHRA business cycle (refer to Annex 1 for further details), federal government institutions should initiate the identification of top priority threats and hazards (or risks) which fall within their mandate by June of each year. Risks should be identified through the all hazards risk taxonomy (available at Annex 3). The taxonomy categorizes threats and hazards thus ensuring that a comprehensive span of risks is considered.</p> <p>A departmental-wide environmental scan may be conducted to determine key risks. Environmental scanning may be performed by groups, by individuals or by a combination of groups and individuals. The following methods may be employed in the process of environmental scanning:</p> <ul> <li>Brainstorming</li> <li>Affinity grouping</li> <li>Risk source analysis</li> <li>Checklists</li> <li>Scenario analysis</li> <li>SWOT/PESTLE analysis</li> <li>Use of individual or group risk forms/identification sheets</li> <li>Surveys and questionnaires</li> <li>Interviews and focus groups</li> <li>Other methods as approved by the leader of the Risk Identification activity</li> </ul> <p>Types of environmental scans may include: objective-based Risk Identification, scenario-based Risk Identification, taxonomy-based Risk Identification, common-risk checking and risk charting. An internal risk assessment process should be adopted, facilitating the process of ranking external threats and hazards.</p> <h4 id="step2_risk_event">Risk Event Scenario Development</h4> <p>Risks identified fall within the four component approach of emergency management planning. A risk event scenario template is available at Annex 4 and provides a detailed description of scenarios that seeks to limit assumptions and unknowns, which may interfere with the risk scoring process. The risk event scenario template describes relevant circumstances surrounding the event, provides context and information, mitigation strategies in place and/or data for experts to provide an accurate risk assessment. </p> <p>Call for proposals for the risk event scenario development process will take place in the fall and the development of scenarios will continue up until the third quarter of the annual federal planning process (end of November). During the early portion of this phase (i.e. the summer), federal government institutions are to provide their highest ranking risks which will be utilized during the federal AHRA scoring process for the current year. From year to year, these risks may vary or remain the same. It is the responsibility of federal government institution to re-evaluate and determine top priority risks each year. Leads for specific risk event scenarios will be assigned depending on specific risks owned or led by federal government institutions. In all cases, PS will remain available to provide guidance and standardization to the process. Leads for risk event scenario development will have the following roles and responsibilities:</p> <ul> <li>Identify and contact relevant federal government institutions involved in the development of risk event scenario(s).</li> <li>Provide briefing or consultation if necessary on the risk event scenario development process.</li> <li>Organize and chair regular risk event scenario development working group meetings.</li> <li>Establish terms of reference if necessary.</li> <li>Develop a work plan and identify timelines to accomplish risk event scenario development.</li> <li>Identify and contact relevant federal government institutions involved in the validation of risk event scenario(s).</li> <li>Make the necessary revisions and organize meetings with subject matter experts (SME) to discuss conflicts, clarifications and inconsistencies in the risk event scenario.</li> <li>Hold the pen for the development of risk event scenarios.</li> <li>Finalize risk event scenarios in preparation for the risk scoring workshop. Key departments involved in the risk scoring process should be informed about adequately preparing research and/or data which will be used for the risk scoring process. This is to ensure that ratings are made in an efficient manner.</li> </ul> <p>Risk event scenarios should be based on present day risk events and not on real past events. Historical events provide background and trends regarding hazards and threats, but are not applicable to current prevention, mitigation and preparedness activities in place, nor do they take into account present day infrastructure, technologies and institutional capabilities. Risk event scenarios should generate a “demand” picture rather than describing expected outcomes. A “risk event” is one or more inter-related events that have consequences for the safety and security of Canadians. A “risk event scenario” is a description of such an event in terms that allow for estimation of the likelihood and of the magnitude of the consequences. </p> <p>The risk event scenario should:</p> <ul> <li>Include federal involvement.</li> <li>Be possible in principle, i.e. “it could happen”.</li> <li>Be a plausible story, with factual supporting information – or put another way: a report of events that could occur.</li> <li>Be so specific that is possible to deduce which Risk Treatment capabilities will have to be brought to bear to satisfactorily address the risk.</li> <li>Include the information relevant to the representative description of a risk event.</li> <li>Describe the relevant circumstances surrounding the risk event.</li> <li>Provide the information required to be able to carry out a detailed assessment of likelihood and impacts/consequences.</li> <li>Indicate the capacity to respond e.g. mitigation strategies that are in place and its relative effectiveness.</li> <li>Signal key assumptions, unknowns and uncertainties.</li> </ul> <p>For example, a risk event scenario involving an earthquake would be described with regard to the location, timing and magnitude of the earthquake, as well as the impacts that it can have on people (mortality, injury and displacement), the economy, the environment, territorial security, Canada's reputation and influence and society and psycho-social. </p> <p>Preliminary assessment of likelihood and consequence is undertaken during the preparation of risk event scenarios. The risk event scenario should also include preliminary Risk Treatment planning information.</p> <p>Mandated federal government institutions are responsible for leading the development of risk event scenarios; there will be a designated federal government institution with the legislated mandate related to a key element of an emergency for each risk event scenario. The designated Primary Department <sup id="fn01-rf"><a class="fn-lnk" href="#fn01"><span class="wb-inv">Footnote </span>1</a></sup> will coordinate the development of the risk event scenario between all federal government institutions having responsibilities towards, or an interest in, the risk event.</p> <p>Federal government institutions have discretion in how they choose to develop and coordinate the risk event scenario. Naturally, it will be important for Primary Departments to ensure that the risk event scenario is based on the best available information at the time and consequently, that all relevant information is researched and all relevant specialist judgement is sought. PS will provide guidance and coordinate assistance for the risk event scenario development. The selection of who to involve will be determined by the nature of the risk event scenario and the context, amongst other factors. As a best practice, workshops for risk event scenario development should be organized to facilitate the process and allow for multi-disciplinary contributions.</p> <p>Figure 4 below provides an illustration of the risk event scenario development process and mandatory fields for which information must be provided when developing a risk event scenario.</p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 4 – Process for Developing a Risk Event Scenario</strong></p> <img src="ll-hzrds-ssssmnt-archvd-04-eng.gif" alt="Figure 4 – Process for Developing a Risk Event Scenario" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>IDENTIFY THE RISK EVENT: Risk event name/title. Primary department (for response). Supporting department(s) (for all EM components). </p> <p>RISK EVENT DESCRIPTION:  Description of the risk event. Natural environment. Meteorological conditions. Nature and vulnerability of the affected area.</p> <p>LIKELIHOOD ASSESSMENT: Time period/time horizon during which the risk event might be realized.</p> <p>IMPACTS/CONSEQUENCES ASSESSMENT: Impact categories: nature and scale; People, Environment, Economic, Society & psycho-social, Territorial security, Canada's reputation and influence, Confidence in the consequences/impacts assessment </p> </details> </div> <div class="clearfix"></div> <h4 id="step2_composite_risk">Use of Composite Risk Event Scenarios</h4> <p>One of the limitations to the scenario-based approach is that unless variations in risk event scenarios are introduced, a particular event, location or context is associated with that risk event. Therefore, a continuum of risk events can provide different consequences associated with different contexts for example, location, weather conditions, and size of population. </p> <h5><strong>Nominal</strong></h5> <p>A nominal risk event scenario is considered the median event or a starting point from which risk event scenarios may continue to develop. </p> <h5>Reduced Impact Variation</h5> <p>A reduced impact variation includes reduced impacts and higher likelihoods. Reduced impacts may also be known as “best case” risk scenario events.</p> <h5>Elevated Impact Variation</h5> <p>A risk event scenario that involves an elevated impact represents a higher impact with lower likelihood in terms of outcome. Elevated impacts may also be known as “worst case” risk scenario events. </p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 5 – Three Variations of a Risk Event Scenario, Displayed on a Likelihood-Consequence Graph</strong></p> <img src="ll-hzrds-ssssmnt-archvd-05-eng.gif" alt="Figure 5 – Three Variations of a Risk Event Scenario, Displayed on a Likelihood-Consequence Graph" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Consequence: Limited Impact – Catastrophic Impact. Likelihood: Low – High. Elevated Impact Variation. Nominal Scenario. Reduced Impact Variation.</p> </details> </div> <div class="clearfix"></div> <h5>Risk Event Scenarios for Non-Malicious Hazards </h5> <p>Natural disasters or hazards have historical links. Efforts should be made to develop risk event scenarios that would “challenge” the current approach to emergency planning capacity and/or management or be taken for future consideration. For natural disasters, nominal risk event scenarios coupled with variants is recommended in order determine best and worst case risk event scenarios. It is also recommended that risk event scenarios be developed for accidental hazards based on historical data and current non-compliance trends for regulated products, goods and services, which may be extracted from enforcement actions and results related, for instance, to the transportation of dangerous goods, the importation of products, etc. Enforcement actions may be taken after inspections, screenings and audits and may be recorded in, for example, an inspection report, including a blitz inspection report, a written non-compliance warning, detention or suspension notifications.</p> <h5>Risk Event Scenarios Pertaining to Malicious Threats (National Security)</h5> <p>Due to their sensitive level of classification, malicious threats/national security (NS) risk event scenarios will be led and held by primary security federal government institutions. Primary departments/agencies are to develop risk event scenarios based on availability to provide supporting evidence through intelligence information. In addition, subject matter experts (SMEs) are to provide specialist judgement which is essential to the process. Intelligence details relating to NS risk event scenarios should be identified within the scenario. Upon completion of the working draft of a risk event scenario, supporting and other federal government institutions will provide feedback and input in order to ensure that a four-component approach to emergency management is implemented.</p> <p>Final drafts of the risk event scenarios are to be sent to supporting departments for review and analysis. The majority of the research and analysis should be completed prior to the risk scoring workshop. SMEs are strongly recommended to meet before the risk scoring workshops to agree on data scores and scores which will be decided on during the risk scoring workshop. Preparation for the risk scoring workshop is essential to ensure accuracy and efficiency in the process. During the risk scoring workshops, experts should provide their proposed score and supporting evidence. </p> <p>Risk event scenarios should provide the following outcomes:</p> <ul> <li>Allow for experts to accurately assess risks.</li> <li>Allow for federal government institutions to develop EM plans.</li> </ul> <h3 id="step2_outputs">Outputs for Risk Identification</h3> <p>The information outputs for the Risk Identification process are:</p> <ul> <li>A list of identified top priority threats and hazards (or risks) by federal government institution.</li> <li>One or more risk event scenario(s) for each identified risk, contributing to a “repertoire” of risk event scenarios, to be utilized in the next step of the AHRA process.</li> </ul> <h2 id="step3">Step 3: Risk Analysis<sup id="fn02-rf"><a class="fn-lnk" href="#fn02"><span class="wb-inv">Footnote </span>2</a></sup></h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-11-eng.gif" alt="Step 3: Risk Analysis" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>STEP 3: Risk Analysis. Likelihood, Impact. OUTPUT: Scored Risk Event Scenarios</p> </details> </div> <div class="clearfix"></div> <h3 id="step3_objectives">Objectives of Risk Analysis</h3> <p>The objective of Risk Analysis is to understand the nature and level of each risk in terms of its likelihood and impact. It provides the basis for Risk Evaluation and decisions about Risk Treatment. Risk analysis is carried out by each federal government institution on the risks it has identified and retained for further analysis in terms of their frequency and overall consequence.</p> <h3 id="step3_inputs">Inputs Required</h3> <p>The information gathered during the Risk Identification process should be used as input for the Risk Analysis step. More specifically, risk event scenarios developed using the AHRA scenario template (at Annex 4) and supporting documentation will be required to develop sound estimates for retained risk likelihood and associated impacts.</p> <p>Although not exhaustive, the list below provides the type of information required in order to estimate the likelihood of a risk scenario:</p> <ul> <li>Historical data on past events</li> <li>Historical data on the frequency of contributing events (e.g. weather conditions).</li> <li>Simulation models of sequences of events, protective system failures, and the associated consequences.</li> <li>For malicious acts, intelligence judgements regarding intent, technical feasibility, including access to target, and enabling capabilities such as funding and logistics of adversaries.</li> </ul> <p>In addition, quantitative data extracted from past risk events or extrapolated from experiments or qualitative information derived from experts' judgement may support the estimation of the impacts for each of the following primary impact category:</p> <ul> <li>People</li> <li>Economy</li> <li>Environment</li> <li>Territorial Security</li> <li>Canada's Reputation and Influence</li> <li>Society and Psycho-Social</li> </ul> <h3 id="step3_tasks">Tasks and Activities Expected in Risk Analysis</h3> <p>There are two processes within Risk Analysis:</p> <ul> <li>Likelihood/probability analysis</li> <li>Impacts/consequences analysis</li> </ul> <h4 id="step3_likelihood">Likelihood Analysis</h4> <p>Likelihood is an estimate of the chance of an event or an incident happening, whether defined, measured or determined objectively or subjectively. It can be described using general terms or mathematical variables, such as a probability or a frequency over a time period. The term 'likelihood' will be retained for the AHRA process, regardless if the risk assessed is of natural causes, or results from an accidental or malicious source.</p> <p>The assessment of the likelihood of a Risk Event being realized, or of “happening”, relates to evaluating factual data in order to better understand how a Risk Event might occur. Likelihood can be estimated using either quantitative or qualitative techniques, or by using approaches that combine the two methods. </p> <p>Likelihood can be assessed quantitatively using deterministic methods (models and simulations) or probabilistic methods (calculating probabilities from historical data or proxy indicators<sup id="fn03-rf"><a class="fn-lnk" href="#fn03"><span class="wb-inv">Footnote </span>3</a></sup>). Probabilistic methods provide more information on the range of risks and can effectively capture uncertainty, but require more data and resources. Qualitative analysis is conducted where non-tangible aspects of risk are to be considered, such as the intent associated with terrorism or sabotage, or where there is a lack of adequate information and the numerical data or resources necessary for a statistically significant quantitative approach. Descriptive scales can be formed or adjusted to suit the circumstances, and different descriptions can be used for different risks. Qualitative data can often be estimated from interviews with experts. Qualitative analysis is often simpler, but may result in higher uncertainty in the results.</p> <p>More details on likelihood analysis for non-malicious risk events and malicious risk events can be found under the section on Likelihood Assessment.</p> <h4 id="step3_impact_analysis">Impact/Consequence Analysis</h4> <p>Risks can have many potential impacts/consequences which, by definition, can potentially affect many institutional objectives. Impacts/consequences can be expressed quantitatively through physical event modelling or extrapolation from experiments, studies or past data; or qualitatively as a descriptive representation of the likely potential outcome for each risk. For instance, a pre-determined set of impact questions can be used to better assess risk consequences, such as:</p> <ul> <li>Does the risk have the potential to impact a large geographic area?</li> <li>Does the risk have the potential to impact the health of the population?</li> <li>Does the risk have the potential to impact on the Canada-United States border?</li> <li>Does the risk have the potential to impact the environment in the long term?</li> </ul> <p>Impacts can be expressed in terms of monetary, technical, operational, social or human criteria. They can be evaluated against predetermined segments of interest to institutions (e.g., impacts on people, the economy, the environment, national security and law enforcement).</p> <p>The terms <em>impact</em> and <em>consequence</em> are sometimes used interchangeably. For the purpose of these guidelines, the term <em>impact</em> is used to estimate the extent of harm within each of the impact categories presented below. When describing a composite measure of impacts (considering more than one impact category), the term <em>consequence</em> is applied.</p> <p>Impact Analysis generally comprises the following steps:</p> <ol> <li>Identification of all individual impacts from all hazards and threats associated with the risk event.</li> <li>Quantification of the impacts from all hazards and threats associated with the risk event, based on the six impact categories and their respective rating schemes as described in detail below.</li> <li>Consolidation of all impacts into high-level impact dimensions.</li> <li>Aggregation of the high-level impacts into an overall impact for the risk event, together with an expression of the level of confidence in the estimates.</li> </ol> <h4 id="step3_impact_categories">Impact Categories</h4> <p>In the context of the AHRA, the primary impact categories are:</p> <ul> <li>People – which includes fatalities and injuries, including physical injuries, displacement, chronic diseases and mental illnesses.</li> <li>Economy – which encompasses direct and indirect losses on the Canadian economy.</li> <li>Environment – which captures the type of response, the geographical extent, magnitude and duration of damage.</li> <li>Territorial Security – which includes the disruption in the effective functioning of an area or a border, including the area affected, combined with duration and population density.</li> <li>Canada's Reputation and Influence – which are situations that would result in a shift in views towards the reputation and influence of Canada and actions taken by citizens and/or stakeholders as a consequence.</li> <li>Society and Psycho-Social – which captures the impact of widespread public anxiety and outrage.</li> </ul> <h4 id="step3_approach">Approach for Impact Rating</h4> <p>The proposed Impact Rating approach was designed with several considerations in mind, which include:</p> <ul> <li>The impact categories should be as “orthogonal”, or independent, as is possible, to avoid double counting of effects.</li> <li>The risk should be calculated explicitly for each impact category. This will provide a useful intermediate result for groups with a focused interest (e.g., the health sector might only be interested in “risk to people”).</li> <li>More details, through subordinate impact factors, can easily be added for each impact category without affecting the overall framework or interoperability with prior assessments. As is shown below, the “impact on people” is assessed through the three subordinate factors of “killed”, “injured” – including physical injuries, chronic and mental illnesses – and “displaced or lacking basic necessities of life”. This allows a more granular assessment that may be useful for the further development or refinement of detailed scenarios or might be of a particular interest to specific prevention and mitigation program areas for which that subordinate factor is important.</li> <li>Subordinate factors can be independent, and assessed as such – e.g., under the “People” factor, the number of killed, injured and displaced is independently assessed – or they can be additive, where multiplicative “dimensions” of impact are combined to produce one rating. For example, under the “Territorial Security” category, “modifiers” are used to change the rating for a base factor, “response magnitude”, to incorporate the population density of the affected area as well as the duration of disruption into the final rating. This will have the benefit of not only taking into consideration factors that may increase the final rating for a particular impact category, but these factors may also have a positive impact on the final rating. In other words, some modifiers might “improve” the final rating by, for instance, considering subordinate factors that indicate a tolerable disruption because its duration may be minimal or under a certain pre-determined threshold.</li> </ul> <p>More details are provided at the section on Impact Assessment Categories, when scoring tables for each impact category are discussed.</p> <p>In order to ensure a consistent mathematical framework for the impact and risk scores, the impact category scores are defined as the “magnitude” of the severity associated with a loss for the category. This implies a constant ratio for the increase in severity from one level to the next. The proposed tables for each impact category use a logarithmic scale, with half scores for ratio increments of the square root of 10, used to increase the resolution of the assessment. Thus, the ratio for increased severity from one scoring level to the next is approximately 3.16 times (i.e., a severity of a “2.5” impact level is 3.16 times that of a “2” , and the severity of a “4” is also 3.16 times that of a “3.5”). You will note that the ratio for two levels (or one integer score) difference is 10 (3.16 X 3.16). This approach allows an easier comparison of values associated to each level, which cover a large range in terms of the severity magnitude. </p> <h4 id="step3_ahra_scoring_tool">AHRA Scoring Tool</h4> <p>An AHRA tool prototype was created to help users (generally risk analysts) define and score potential hazards and threats across the different categories of impacts and determine the likelihood of the risk event occurring within a five-year timeframe. The tool was built as a user-friendly Excel program with step-by-step prompts. The AHRA tool considers impacts to the following categories: people, economy, environment, territorial security, Canada's reputation and influence and society and psycho-social as described earlier in the guidelines. Each impact category includes the option(s) to define assessors' confidence level for the inputs as well as any justification they may wish to include. The tool can be demonstrated by contacting PS's Emergency Management Planning Unit, at <a href="mailto:AHRA-ETR@ps-sp.gc.ca">AHRA-ETR@ps-sp.gc.ca</a>. </p> <h4 id="step3_confidence">Confidence Level and Justification for Likelihood Analysis and Impact/Consequence Analysis</h4> <p>For each impact category, assessors must indicate their level of confidence in the estimates they have provided with respect to harm caused by the defined Risk Event Scenario. A confidence level from A to E is used to describe the confidence of assessors in the value they have defined or selected. The degree of confidence in the ratings produced will vary, depending on the availability of data, relevant experience and existing body of knowledge. Capturing the confidence level associated with each rating produced provides a crucial piece of information that helps complete the risk assessment picture. Confidence levels will be presented, along with final results, to indicate to decision makers where some low or very low confidence assessments may necessitate caution in interpretation. On the other hand, assessments accompanied with high or very high confidence levels will inspire trust in immediate actions required to treat pressing risks. </p> <p>The following table presents definitions for confidence levels that must be used for each rating: </p> <table class="table table-bordered"> <caption> Confidence levels </caption> <tr> <th>Confidence Level</th> <th>Quantification</th> </tr> <tr> <td>A</td> <td>Very High confidence in the judgement based on a thorough knowledge of the issue, the very large quantity and quality of the relevant data and totally consistent relevant assessments.</td> </tr> <tr> <td>B</td> <td>High confidence in the judgement based on a very large body of knowledge on the issue, the large quantity and quality of the relevant data and very consistent relevant assessments.</td> </tr> <tr> <td>C</td> <td>Moderate confidence in the judgement based on a considerable body of knowledge on the issue, the considerable quantity and quality of relevant data and consistent relevant assessments.</td> </tr> <tr> <td>D</td> <td>Low confidence in the judgement based on a relatively small body of knowledge on the issue, the relatively small quantity and quality of relevant data and somewhat consistent relevant assessments.</td> </tr> <tr> <td>E</td> <td>Very Low confidence in the judgement based on small to insignificant body of knowledge on the issue, quantity and quality of relevant data and/or inconsistent relevant assessments</td> </tr> </table> <p>In addition, any justifications, assumptions and/or references for the various inputs defined by assessors during Risk Analysis should be recorded, along with the rating of each impact category.</p> <h3 id="step3_outputs">Outputs for Risk Analysis</h3> <p>The information outputs related to the Risk Analysis process are:</p> <ul> <li>An assessment of the likelihood of the realisation of the hazards and threats associated with the risk event, with an associated confidence level.</li> <li>An assessment of the impact for the risk event in terms of each of the primary impact categories, with associated confidence levels.</li> <li>An assessment of the overall impact for the risk event, with an associated confidence level.</li> <li>Other information generated during the Risk Analysis Process, such as assumptions and justifications.</li> </ul> <h3 id="step3_impact_assessment">Impact Assessment Categories</h3> <p>In the AHRA process, each risk scenario is analyzed with respect to multiple impact categories. By consistently considering all of the possible dimensions of consequences, a whole-of-government view of risk can emerge. </p> <p>The AHRA process uses the following impact categories, which are explained below:</p> <ul> <li>People</li> <li>Economy</li> <li>Environment</li> <li>Territorial Security</li> <li>Canada's Reputation and Influence</li> <li>Society and Psycho-Social</li> </ul> <p>It is important to note that during the rating of each impact category, experts will provide their input for the various factors without actually relying on the quantitative scales (i.e. exact numbered rating) that are associated with their qualitative input, in order to avoid any distraction that could be caused by the actual numbered scales. Their input will be translated into a final rating in the scoring tool by the AHRA scoring tool itself at the end of the assessment exercise. The final score is made known after an entire Risk Event Scenario is scored, at the “Input Summary” sheet of the AHRA scoring tool.</p> <h4 id="step3_people">People</h4> <p>A priority for the federal government is to protect the health and safety of Canadians. With that objective in mind, this category assesses the number of people killed, injured, and displaced or lacking the basic essentials of life following a given risk event. The focus of this impact category is to take into account the combined impact of various degrees of acute and chronic injury and the potential loss of life after the onset of a risk event. </p> <p>To capture diverse health outcomes, analysts often use composite burden of disease measures. The Disability-Adjusted Life Years (DALY) is one such measure used to estimate health impacts by combining impacts from fatalities, non-fatal injuries and chronic diseases. The DALY measure for each injury type is composed of the product of the severity, the duration and the number of injuries. The severity scale ranges between 0 (perfect health) and 1 (death). The duration of the injury is represented in years. The DALY measure is also used to measure the impact of fatalities. The severity of a fatality is always equal to 1, while an estimate of the number of years of life-expectancy at the time of death is the appropriate measure of duration. This yields a higher estimate of impact for fatalities in children, as compared to fatalities among adults.</p> <p>DALYs by Injury Type = Number of Cases x Severity x Duration</p> <p>DALYs due to Fatalities = Number of Cases x Years of Life Lost</p> <p>Total DALYs = Sum of DALYs by Injury Type + DALYs due to Fatalities</p> <p>The table below shows the conversion of the number of DALYs into an impact rating on a scale from 0 to 5. The conversion associated with the table below is generated by the AHRA scoring tool itself after assessors record their information into the People impact category Excel sheet. </p> <p>Note that 0 on this impact rating scale is not the same as “No Impact.” Where a risk scenario results in no impact whatsoever for an impact category, this is not assigned a numerical score; it is captured as “No Impact.” The rightmost column is provided to show the linkage between fatalities and the overall People Impact rating. An adult fatality, on average, can be assigned a score of approximately 40 (for 40 years of lost life). </p> <table class="table table-bordered"> <caption> People Impact Category – Disability-Adjusted Life Years Conversion Table </caption> <tr> <th>Magnitude of Impact Rating</th> <th>Total DALYs Combining Injury and Fatality</th> <th>Equivalent Number of Adult Fatalities</th> </tr> <tr> <td>No Impact</td> <td>0</td> <td>0</td> </tr> <tr> <td>0</td> <td>40</td> <td>1</td> </tr> <tr> <td>0.5</td> <td>120</td> <td>3</td> </tr> <tr> <td>1</td> <td>400</td> <td>10</td> </tr> <tr> <td>1.5</td> <td>1,200</td> <td>30</td> </tr> <tr> <td>2</td> <td>4,000</td> <td>100</td> </tr> <tr> <td>2.5</td> <td>12,000</td> <td>300</td> </tr> <tr> <td>3</td> <td>40,000</td> <td>1,000</td> </tr> <tr> <td>3.5</td> <td>120,000</td> <td>3,000</td> </tr> <tr> <td>4</td> <td>400,000</td> <td>10,000</td> </tr> <tr> <td>4.5</td> <td>1,200,000</td> <td>30,000</td> </tr> <tr> <td>5</td> <td>4,000,000</td> <td>100,000</td> </tr> </table> <h4 id="step3_economy">Economy</h4> <p>The Economy impact category captures the dollar value following damage(s) or loss to economically productive assets and disruptions to the normal functioning of the Canadian economic system, which may result in the loss of service as a result of a risk event occurring. This loss is broken down into the following:</p> <h4 id="step3_direct">Direct Economic Loss</h4> <ul> <li>Direct economic loss (stock losses) is the immediate economic damage generated by the disaster. These losses can be measured by the repair or replacement costs (at the pre-event price level) for assets that have been damaged or destroyed. In particular, this would include damage to: <ul> <li>Building construction: industrial, commercial, and institutional buildings (e.g. plants, offices, recreational facilities, hospitals, etc.).</li> <li>Engineering construction: road infrastructure, water systems, marine construction (irrigation, docks, terminals, etc.), other transportation, electric power, and oil and gas engineering.</li> <li>Machinery and equipment used in the production process (furniture, agricultural and industrial machinery, computers and software, telecommunication equipment, trucks, etc.).</li> <li>Residential structures and content.</li> <li>Raw materials: mineral fuels (coal, crude oil, natural gas), grains (crops ready to be harvested), animal and animal products (e.g. cattle and hogs-swine for slaughter, milk and eggs, fish), wood, ferrous and non-ferrous metals, non-metallic minerals, etc.</li> </ul> </li> </ul> <p>Two additional elements are “non-reproducible assets” (land, timber, subsoil resource stocks, etc.) and “human capital stock” (loss of lives and injuries). However, these, as well as other environmental, ecological, welfare and non-economic quality of life impacts will not be considered in the “economic loss” impact category thus avoiding the risk of “double counting”. This reflects the fact that these “nonmarket” impacts are difficult to translate into monetary terms. However, they should be taken into account in the People and Environment impact categories. </p> <h4 id="step3_indirect">Indirect Economic Loss</h4> <ul> <li>Indirect economic loss (flow losses) refers to the flows of goods and services which will not be produced due to damages to productive assets and economic infrastructure. This interruption or reduction in production should be measured in terms of <strong>value-added</strong> to avoid double-counting issues.<sup id="fn04-rf"><a class="fn-lnk" href="#fn04"><span class="wb-inv">Footnote </span>4</a></sup> For instance, this would include: <ul> <li>Production or service provision losses due to the full or partial paralysis of activities (e.g. losses in agricultural/industrial production due to damage to factories or shortages of raw materials/energy supplies)</li> <li>Higher operational costs due to the destruction of productive assets or losses to production and income (e.g. a ban on beef and cattle exports would first translate into higher maintenance cost due to rising inventory levels of live animals).</li> <li>Lost production due to linkages effects (e.g. the destruction of a factory reduces the economic activities of suppliers who have no alternative markets or of clients who have no other suppliers).</li> <li>Additional costs incurred due to the need to use alternative and potentially inferior means of production or provision of essential services (e.g. greater operating costs arising from reduced transportation or energy capacity).</li> <li>Costs of required government response (e.g. emergency and rescue operations).</li> </ul> </li> </ul> <p>Estimates of indirect losses should be undertaken with caution as some effects might be difficult to identify or quantify.<sup id="fn05-rf"><a class="fn-lnk" href="#fn05"><span class="wb-inv">Footnote </span>5</a></sup> It is suggested that only relevant external factors that significantly modify the estimate of the economic loss should be considered. Indirect losses should be made relative to the duration of the disruption. For instance, one could calculate how many days-worth of value-added in the transportation, financial, manufacturing, or tourism sector before a return to normal activities. Also, the assessment should ensure that no double-counting takes places: if effects are calculated on the production side, they must not be included again on the income side. For example, government compensation to farmers affected by an outbreak of foot and mouth disease (FMD) should not be included in addition to the associated production losses. </p> <p>It is important to note that indirect losses can sometimes be counteracted by built-in mechanisms and behavioural changes, e.g. consumer-demand shift following a bovine spongiform encephalopathy (BSE) outbreak, substitution of inputs and/or reallocation of resources following a pandemic, use of alternative transportation means or production rescheduling following rail/airport closures, business relocations following an earthquake, etc.  It is important to capture these “built-in counteractions” as assumptions, along with the rating of the Economic category.  Finally, disasters sometimes produce benefits that can be estimated and must be deducted as well from the total losses estimate, e.g. a rise in land productivity following a flood. </p> <p>Once all the contributions to the economic loss have been identified, all costs are added and the rating for this category is based on the final dollar figure.</p> <table class="table table-bordered"> <caption> Economic Impact Category </caption> <tr> <th>Magnitude of Impact Rating</th> <th>Economic Loss</th> </tr> <tr> <td>No impact</td> <td>No impact</td> </tr> <tr> <td>0</td> <td>$10M</td> </tr> <tr> <td>0.5</td> <td>$30M</td> </tr> <tr> <td>1</td> <td>$100M</td> </tr> <tr> <td>1.5</td> <td>$300M</td> </tr> <tr> <td>2</td> <td>$1B</td> </tr> <tr> <td>2.5</td> <td>$3B</td> </tr> <tr> <td>3</td> <td>$10B</td> </tr> <tr> <td>3.5</td> <td>$30B</td> </tr> <tr> <td>4</td> <td>$100B</td> </tr> <tr> <td>4.5</td> <td>$300B</td> </tr> <tr> <td>5</td> <td>$1,000B</td> </tr> </table> <p>It is important to note that macroeconomic studies provide a complementary way to assess the repercussions of direct and indirect economic losses. For instance, estimates of macroeconomic effects would take into account that some indirect effects could be exacerbated or mitigated in the aggregate by changes in prices or flexibility in the production process (e.g. through reallocations in spending/production across sectors or through the mobilization of production factors if production is not at full capacity). Estimates of high-order impacts require the use of more sophisticated economic models. </p> <p>A table summarizing elements that should be considered in estimating economic losses can be found at Annex 6.</p> <h4 id="step3_environment">Environment</h4> <p>Another priority for the federal government is to protect the environment, as it recognizes that Canada's natural environment shapes our national identity, our health and our prosperity. In the area of the environment, the Government of Canada has a number of programs focused on conserving and restoring Canada's natural environment. Accordingly, this impact category relates to the preservation of specific components of the environment pertaining to air, water and soil ecosystems, including fauna and flora. The environment rating scale thus focuses on environmental damage caused by a risk event or an emergency. In the context of the AHRA, environmental damage refers to loss of environmental assets or environmental quality that requires intervention<sup id="fn06-rf"><a class="fn-lnk" href="#fn06"><span class="wb-inv">Footnote </span>6</a></sup>. This category will exclude assessing economic aspects created by such loss, as they should be captured under the Economy impact category in order to avoid double counting impacts. </p> <p>The Environment impact category considers four elements that characterize the size and severity of environmental damage from a risk event or an emergency: 1) the principal element to factor in when rating environmental damage significance is the magnitude of a response required to deal with a situation, which involves the type of response required (local, regional, multi-jurisdictional, general, specialized, etc.); 2) the geographical extent of the damage; 3) the magnitude of damage based on adverse effects to different components of the environment; and 4) the duration of the damage including the level of recovery efforts.</p> <h4 id="step3_magnitude_response">Magnitude of Response Required to Deal with an Event</h4> <p>The magnitude refers to the type of response necessary when treating an event affecting the environment. </p> <p>A <strong>local</strong> response will indicate that the damage and/or contamination is limited to a municipality or a region within a province, requiring a response from these authorities. In this instance, a federal surveillance and monitoring capacity from an institution may be required. </p> <p>A <strong>multi-regional</strong> response will indicate that the extent of the damage and/or contamination is limited to two or more regions within a single province and response is expected by affected authorities. A multi-regional response may require some “for information” notification amongst federal government institutions about the incident, without a request for support. It may also involve some regional coordination activities amongst federal government institutions, with a possible request for support from regions affected. </p> <p>A <strong>multi-jurisdictional</strong> extent and response will indicate that the extent of the damage and/or contamination affects an area comprised over two or more provinces and response is expected by affected jurisdictions. A multi-jurisdictional response will require mobilization from federal authorities in the form of some response capacity. </p> <p>A <strong>national and international</strong> extent and response will indicate that leads are exclusively federal government institutions and that the extent of damage and/contamination crosses international borders. Rapid federal response capacity will be mobilized. </p> <p>In essence, federal implication or assistance may be required, even if the type of response and extent of damage may be estimated to remain local (e.g. flood response is usually local, but surveillance and modelling capabilities may be shared with federal government institutions).</p> <p>A response may require some intervention from general emergency response teams, such as workers from a fire or police department. Other emergencies may require specialized teams to contain and restore an affected area contaminated by a hazardous substance. In addition, a multi-functional response may be warranted depending on a risk event situation. A multi-functional response team is defined as a team of responders composed of police forces and emergency services, but also from community organizations and services, businesses and workplaces, and other members of an affected community or affected communities. </p> <table class="table table-bordered"> <caption> Environment Impact Category – Response Magnitude </caption> <tr> <th>Base Rating</th> <th>Response Magnitude</th> </tr> <tr> <td> </td> <td>Type of Response</td> </tr> <tr> <td>No Impact</td> <td>No Impact</td> </tr> <tr> <td>0</td> <td>Some local general response, but no specialized response</td> </tr> <tr> <td>0.5</td> <td>Some local specialized response</td> </tr> <tr> <td>1</td> <td>Some local specialized response, and surveillance and monitoring from federal authorities</td> </tr> <tr> <td>1.5</td> <td>Some local multifunctional and specialized response, and surveillance and monitoring from federal authorities</td> </tr> <tr> <td>2</td> <td>Multi-regional general response, and notification from federal authorities</td> </tr> <tr> <td>2.5</td> <td>Multi-regional specialized response, and notification from federal authorities</td> </tr> <tr> <td>3</td> <td>Multi-functional, multi-regional specialized response, and notification from federal authorities</td> </tr> <tr> <td>3.5</td> <td>Multi-functional, multi-regional specialized response, and regional coordination involving federal authorities</td> </tr> <tr> <td>4</td> <td>Multi-functional, multi-jurisdictional specialized response, and mobilization from federal authorities</td> </tr> <tr> <td>4.5</td> <td>Multi-functional, multi-jurisdictional specialized response, and rapid mobilization from federal authorities</td> </tr> <tr> <td>5</td> <td>Multi-functional, national and international, specialized response, and rapid mobilization from federal authorities</td> </tr> </table> <h4 id="step3_geographical">Geographical Extent of Damage</h4> <p>Localized damage may not be significant. Alternatively, widespread damage may be significant. The geographical extent of damage will be represented in terms of square kilometres of damage to the environment and will be applied as a modifier, in the sense that it will increase the overall rating of the magnitude of a response required to deal with a situation.</p> <table class="table table-bordered"> <caption> Environment Impact Category – Modifier – Geographical Extent of Damage </caption> <tr> <th>Geographical Extent Modifier</th> <th>Size of Damage (km<sup>2</sup>)</th> </tr> <tr> <td>+0.5</td> <td>5</td> </tr> <tr> <td>+1</td> <td>15</td> </tr> <tr> <td>+1.5</td> <td>50</td> </tr> <tr> <td>+2</td> <td>150</td> </tr> <tr> <td>+2.5</td> <td>500</td> </tr> <tr> <td>+3</td> <td>1,500</td> </tr> </table> <p><strong>Fact: The Greater Toronto Area (GTA) is about 7,200 km<sup>2</sup></strong><sup></sup></p> <h4 id="step3_magnitude_damage">Magnitude of Damage Based on Environmental Adverse Effects</h4> <p>The magnitude refers to the severity of the adverse environmental effects, based on each criterion that applies to a risk event or an emergency and its associated severity value. This component will be applied as a modifier. </p> <p>The following criteria and associated value can be used for determining the magnitude of damage based on adverse environmental effects:</p> <ul> <li>loss of rare or endangered species (value: 2)</li> <li>reductions in species diversity (value: 1)</li> <li>loss of critical/productive habitat (value: 2)</li> <li>transformation of natural landscapes (value: 0.5)</li> <li>loss of current use of lands resources (value: 1)</li> <li>loss of current use of water resources (value: 2)</li> <li>environmental losses from air pollution (value: 0.5)</li> </ul> <p>As every criterion has its own value, the total value of the modifier will be reached by a simple addition of those applicable to a risk event.</p> <h4 id="step3_modifier">Modifier for Duration of Damage</h4> <p>A modifier to increase or decrease the rating will be applied for the duration of damage.</p> <p>When rating the magnitude of response required to deal with a risk event and the extent of the damage, the duration of the actual damage needs to be taken into account and reflected in the rating. In addition, recovery efforts will be factored in the rating of this modifier. If recovery efforts are made or positively expected to be made (recovery enforced by law, government or company commitment, etc.), the rating will be improved. The total rating will be reflected by adding the duration modifier with the recovery efforts, as described in the table below.</p> <table class="table table-bordered"> <caption> Environment Impact Category – Modifier – Duration of Damage </caption> <tr> <th>Duration modifier</th> <th>Duration of disruption</th> <th>Recovery efforts <br> No effort – value is 0<br /> Low – value is -0.5<br /> Medium – value is -1<br /> High – Value is -1.5</th> <th>Total rating for duration of disruption</th> </tr> <tr> <td>0.5</td> <td>1 week</td> <td> </td> <td> </td> </tr> <tr> <td>1</td> <td>3 weeks (about 1 month)</td> <td> </td> <td> </td> </tr> <tr> <td>1.5</td> <td>10 weeks (about 2 months)</td> <td> </td> <td> </td> </tr> <tr> <td>2</td> <td>8 months</td> <td> </td> <td> </td> </tr> <tr> <td>2.5</td> <td>2 years</td> <td> </td> <td> </td> </tr> <tr> <td>3</td> <td>6 years</td> <td> </td> <td> </td> </tr> <tr> <td>3.5</td> <td>20 years</td> <td> </td> <td> </td> </tr> </table> <p>A cumulative factor will affect the final score for this category: the geographical extent of the damage, the magnitude of damage based on environmental adverse effects and the duration of the damage will be added to the base rating score as assessed by the magnitude of response, without exceeding 5.</p> <h4 id="step3_territorial">Territorial Security</h4> <p>Territorial security is a core responsibility of the GC and provides the conditions permitting the free movement of Canadians, other people and legitimate goods within the country and across borders. It represents the effective functioning and control of international borders, and provides for the safety and security of Canadians to go about their lives in an ordinary fashion.</p> <p>In a globalized society, there are an increasing number of challenges to the Government's ability to protect and maintain territorial security. Challenges can come from abroad (e.g. terrorist attacks, nuclear capability of adversarial states, challenges to Arctic sovereignty) or from natural disasters (e.g. hurricanes, earthquakes, infectious diseases). Ecological and/or geological loss in its strict sense will be captured under the environment category in order to avoid double counting impacts. </p> <p>The Territorial Security impact category reflects losses in the ability of Canada to control its territory, either through annexation or invasion. This dimension captures conditions in which there is a loss in the ability of the Government of Canada to secure the territory or the border and to secure the safety of citizens. For this category, the baseline rating is rooted in geographical area of the country at risk or affected. The final score is determined by the area affected, with factors including the duration of disruption and population density.</p> <p>Impact Score = (Area Affected) + (Duration Score) + (Population Density Modifier)</p> <p><strong>Fact: The <em>total</em> area of Canada (combines land and marine boundaries) is 9,984,670 km<sup>2</sup></strong><sup></sup></p> <table class="table table-bordered"> <caption> Territorial Security – Size of Impact </caption> <tr> <th>Base Rating for Area Affected</th> <th>Size of Impact (km<sup>2</sup>)</th> </tr> <tr> <td>No impact</td> <td>No impact</td> </tr> <tr> <td>0</td> <td>100</td> </tr> <tr> <td>0.5</td> <td>300</td> </tr> <tr> <td>1</td> <td>1,000</td> </tr> <tr> <td>1.5</td> <td>3,000</td> </tr> <tr> <td>2</td> <td>10,000</td> </tr> <tr> <td>2.5</td> <td>30,000</td> </tr> <tr> <td>3</td> <td>100,000</td> </tr> <tr> <td>3.5</td> <td>300,000</td> </tr> <tr> <td>4</td> <td>1,000,000</td> </tr> <tr> <td>4.5</td> <td>3,000,000</td> </tr> <tr> <td>5</td> <td>10,000,000</td> </tr> </table> <h4 id="step3_modifier_disruption">Modifiers for Duration of Disruption and Population Density</h4> <p>Modifiers to increase or decrease the rating will be applied for the duration of the disruption, as well as the population density of the area affected.</p> <h5>Duration of Disruption</h5> <table class="table table-bordered"> <caption> Duration of Disruption </caption> <tr> <th>Duration modifier</th> <th>Duration of disruption</th> </tr> <tr> <td>-2</td> <td>1 hour</td> </tr> <tr> <td>-1.5</td> <td>3 hours</td> </tr> <tr> <td>-1</td> <td>10 hours (about ½ day)</td> </tr> <tr> <td>-0.5</td> <td>1 day</td> </tr> <tr> <td>0</td> <td>3 days (about ½ week)</td> </tr> <tr> <td>+0.5</td> <td>10 days</td> </tr> <tr> <td>+1</td> <td>1 month</td> </tr> <tr> <td>+1.5</td> <td>3 months</td> </tr> <tr> <td>+2</td> <td>1 year</td> </tr> <tr> <td>+2.5</td> <td>3 years</td> </tr> <tr> <td>+3</td> <td>10 years and over (not permanent)</td> </tr> <tr> <td>+3.5</td> <td>Permanent</td> </tr> </table> <h5>Population Density of Area Affected</h5> <table class="table table-bordered"> <caption> Population Density of Area Affected </caption> <tr> <th>Density modifier</th> <th>Density of area affected or at risk (People per km)</th> </tr> <tr> <td>-1</td> <td>0.1</td> </tr> <tr> <td>-0.5</td> <td>0.3</td> </tr> <tr> <td>0</td> <td>1</td> </tr> <tr> <td>+0.5</td> <td>3</td> </tr> <tr> <td>+1</td> <td>10</td> </tr> <tr> <td>+1.5</td> <td>30</td> </tr> <tr> <td>+2</td> <td>100</td> </tr> </table> <p>A cumulative factor will affect the final score for this category: the duration of disruption and population density modifiers will be added to the base rating score, with the total not exceeding 5.</p> <h4 id="step3_reputation">Canada's Reputation and Influence</h4> <p>The interconnected nature of economies, societies, and governments means that the international reaction to an emergency event in Canada, or an event that involves Canadians abroad, can have widespread repercussions for the way foreign governments, populations, and organizations view Canada, and the influence Canada maintains on a global stage. Since the international reputation and influence of the GC and/or Canadians plays an important role in advancing Canada's interests and foreign relations, the potential of risk events to impact Canada's reputation and influence needs to be factored into the risk assessment in order to develop appropriate risk management strategies. </p> <p>This category represents an expert assessment of the potential international reaction to an emergency event occurring in Canada, or involving Canadians abroad. Examples of potential triggers/events that can signal that an emergency has the potential to impact Canada's reputation and influence include damage or loss of control over Canada's embassies, suspension of international agreements, protests against Canada, imposition of travel restrictions to Canada, deterioration of bilateral political relations, etc. This category presents a non-exhaustive list of situations that would demonstrate a shift in views towards Canada's reputation and influence by foreign governments, international actors and populations, and the types of responses that could arise from such a shift. </p> <p>This assessment should be made based on reactions to similar emergency events previously experienced within Canada and/or in other countries. If such information is unavailable, departmental experts will provide a thoughtful assessment of potential outcomes. </p> <p>As with other impact categories, the Canada's Reputation and Influence impact category is based on a 0-5 level log-scale. Half scales in this category are generally more difficult to determine due to the nature of potential actions, and political and non-political relations, but may still be assigned should experts feel it is appropriate. Aspects of an event situation to take into consideration when establishing an assessment could include the international consequences of a risk event, the extent and duration of people affected, the nature of the threat and its potential to spread across borders, the level of devastation experienced, among others.</p> <table class="table table-bordered"> <caption> Canada's Reputation and Influence – Repercussions </caption> <tr> <th>Rating Level</th> <th>Repercussions</th> </tr> <tr> <td>0</td> <td>No damage to Canada's reputation and influence</td> </tr> <tr> <td>1</td> <td><p>Insignificant damage to Canada's reputation and influence</p> <ul> <li><em>Minor, short term and localised reaction that is limited to small groups of individuals and has no repercussions for Canada or Canadians</em></li> </ul></td> </tr> <tr> <td>2</td> <td><p>Minor damage to Canada's reputation and influence</p> <ul> <li><em>Minor, medium- to long-term, international reaction by groups of individuals that has a minor effect on Canada or Canadians</em></li> </ul></td> </tr> <tr> <td>3</td> <td><p>Significant damage to Canada's reputation and influence</p> <ul> <li><em>Significant, short to medium-term, international reaction by groups of individuals, foreign governments and/or organizations that has a medium term effect on Canada and Canadians</em></li> </ul></td> </tr> <tr> <td>4</td> <td><p>Major damage to Canada's reputation and influence</p> <ul> <li><em>Major, short- to medium-term, widespread reaction by large groups, foreign governments and/or organizations that has a long lasting effect on Canada and Canadians</em></li> </ul></td> </tr> <tr> <td>5</td> <td><p>Severe damage to Canada's reputation and influence</p> <ul> <li><em>Major, long term, widespread reaction by large groups, foreign governments and/or organizations that has a lasting effect on Canada and Canadians</em></li> </ul></td> </tr> </table> <p>There is a list at Annex 5 that includes possible examples of changes in international positions towards Canada, and ways the GC and/or Canadians may be impacted by a risk event that has international implications. </p> <h4 id="step3_society">Society and Psycho-Social</h4> <p>Social actions, such as protests, civil disturbances or vandalism, can be provoked by an event and can impact response and recovery efforts. Social actions can be rooted in people's understanding and perception of the incident as well as their sense of control over the outcome. At the same time, even if people do not engage in social action following an event, they can nevertheless experience the psycho-social effects of disaster that can lead to changes in their individual pattern of behaviour over the short or long term. Psycho-social effects can also impact the effectiveness of the overall response and recovery efforts if they are not appropriately managed. Over the longer term, continued exposure to the source of stress or lack of support for the population may result in secondary disorders.</p> <p>When scoring for this impact category, consideration should be provided to the dimension of public mood. The scoring of public mood is based on a subjective assessment that focuses on two criteria: public outrage and public anxiety. The descriptors for each of these attempt to capture how people's behaviour might be affected by an event and the score, although subjective, points to the possibility of short to long-term psycho-social impacts.</p> <table class="table table-bordered"> <caption> Society and Psycho-Social Impacts </caption> <tr> <th>Impact Score</th> <th>Public outrage descriptor</th> <th>Public anxiety descriptor</th> </tr> <tr> <td>No Impact</td> <td><ul> <li>No Impact</li> </ul></td> <td><ul> <li>No Impact</li> </ul></td> </tr> <tr> <td>0</td> <td><ul> <li>Insignificant</li> </ul></td> <td><ul> <li>Insignificant: no changes in people's normal routine</li> </ul></td> </tr> <tr> <td>0.5-1</td> <td><ul> <li>Minor</li> <li>No authority or person perceived to be culpable or incompetent</li> <li>Impact targeted on one particular group associated with the government (rather than being indiscriminate)</li> <li>Little symbolic value</li> </ul></td> <td><ul> <li>Minor anxiety but no change in people's behaviours</li> <li>Short term avoidance of transport modes</li> <li>Risk to children or future generations limited</li> <li>Strong public familiarity with/understanding of the risk and its consequences</li> <li>Less than a thousand people feel more vulnerable</li> </ul></td> </tr> <tr> <td>1.5/2</td> <td><ul> <li>Significant but localized and temporary</li> <li>Consequences are largely one-off</li> <li>Public acceptance that the risk was a natural disaster or avoidable and largely not caused/exacerbated by human failure</li> <li>Little symbolic value of site or target</li> </ul></td> <td><ul> <li>Minor, localized and temporary changes in people's normal routines</li> <li>Short to medium-term avoidance of transport modes</li> <li>Good public understanding of the ris</li> <li>Thousands of people feel more vulnerable (but less than 10,000 people)</li> </ul></td> </tr> <tr> <td>2.5/3</td> <td><ul> <li>Serious, widespread</li> <li>Consequences will not just be one-off, but still short-term</li> <li>High impact on those perceived as vulnerable (i.e. elderly, women, children)</li> <li>Public perception that the disruptive outcome was a result of someone/the government's failur</li> <li>High symbolic value</li> </ul></td> <td><ul> <li>Moderate anxiety leading to medium to short-term changes in peoples' routines</li> <li>Medium term avoidance of some modes of transport</li> <li>Shortage of essential supplies due to panic-buying</li> <li>Conceivable that the event could occur again</li> <li>Impact was indiscriminate (as opposed to being focused on a specific group such as government officials or industrial workers)</li> <li>Lack of control or helplessness</li> <li>Some concern about potential health risk to future generations</li> <li>Limited public understanding of the risk</li> <li>Tens of thousands of people feel more vulnerable (but less than 100,000 people)</li> </ul></td> </tr> <tr> <td>3.5/4</td> <td><ul> <li>Serious national-wide concern, with strong calls for government action</li> <li>The adverse impact was intentional/ malicious</li> <li>Domestic pressure for resignations; public perception that government/ person significantly failed</li> <li>Risk results from human action rather than natural causes</li> <li>Consequences will be medium-term rather than just one-off</li> <li>Indiscriminate and very significant impact</li> <li>Significant impact on those perceived as vulnerable (i.e. elderly, women, children)</li> <li>Very high symbolic value</li> </ul></td> <td><ul> <li>High levels of anxiety leading to sustained changes in people's normal routines</li> <li>Intense and widespread information seeking by the public</li> <li>High levels of concern about risks to children or future generations</li> <li>High levels of concern that catastrophic event could occur again</li> <li>Impact was indiscriminate and affected large (but less than 1,000,000) number of people (as opposed to being focused on a specific group such as government officials or industrial workers)</li> <li>Significant sense of lack of control/helplessness</li> <li>Lack of informed public knowledge or understanding of the risk</li> <li>Millions of people feel more vulnerable</li> </ul></td> </tr> <tr> <td>4.5/5</td> <td><ul> <li>Extreme, nation-wide, sustained</li> <li>Widespread calls for severe governmental reprisal (i.e. the adverse impact was intentional/malicious)</li> <li>Persistent domestic pressure for resignations at national/CEO level</li> <li>Consequences will be long-term rather than one-off</li> <li>Risk results from human action rather than natural causes</li> <li>Indiscriminate and catastrophic impact</li> <li>Severe impact on those perceived as vulnerable (i.e. elderly, women, children)</li> <li>Very high symbolic value</li> </ul></td> <td><ul> <li>Extreme, widespread, prolonged</li> <li>Widespread avoidance of an area</li> <li>Social conflict and community tensions resulting from fear-induced behaviour</li> <li>Severe loss of confidence in government's ability to protect citizens</li> <li>Severe and prolonged loss of confidence in the financial markets</li> <li>Significant concern about risks to children or future generations</li> <li>Significant concern that catastrophic event could occur again</li> <li>Severe sense of lack of control/helplessness</li> <li>Impact was indiscriminate and directly affected very large (i.e., 10,000,000 or more) number of people perception that the adverse consequences could happen to anyone</li> <li>Very little informed public knowledge or understanding of the risk</li> <li>Significant proportions of people feel more vulnerable</li> </ul></td> </tr> </table> <h3 id="step3_likelihood_2">Likelihood Assessment</h3> <p>Likelihood assessment defines the chance of an event occurring in the next five years, whether it is a natural hazard or a malicious threat.</p> <h4 id="step3_malicious">Malicious Threats</h4> <p>The malicious likelihood scale takes into consideration technical feasibility, enabling capability and intent. The overall likelihood score is based on the principle of the “weakest link”, meaning that if the capability is present but the intent is low, than the score for intent will take precedence. A successful adversarial attack cannot occur if one of the elements is absent, lacking or unobtainable; in other words, an attack is assessed as impracticable if the level for one element of the overall capability is below a necessary level to being materialized. Risk scores associated with malicious risk events are based on an intelligent adversary. Therefore scores are decided upon by the intelligence community and/or organization's estimate of technical feasibility, enabling capability and intent.</p> <h4 id="step3_likelihood_rating">Likelihood Rating for Malicious Scenarios</h4> <p>Estimating the likelihood of malicious scenarios is considerably different than for other threats/hazards, as these estimates must take into account the determined and adaptive nature of an intelligent adversary. Such an adversary will make a choice to carry out an attack based, on the one hand, on the statement they want to make, in accordance with the individual's or the organization's ideology. To capture this dimension, the current approach relies on the intelligence community to provide expert judgment on an individual's or organization's <em>intent</em> to carry out an attack, as described in the scenario. On the other hand, the adversary's choice of an attack is also based on considerations of whether mounting an attack is technically feasible, as well as whether they have adequate organizational and support means to carry it out. Again, the current approach relies on judgment from domain experts to assess various components of the <em>technical feasibility</em> of a malicious attack scenario, and on the intelligence community to provide expert judgment on whether an individual or organization has sufficient <em>capability</em> to carry it out. The combined assessments of feasibility, capability, and intent are used to generate an overall assessment or composite judgment of likelihood. </p> <h5>Technical Feasibility</h5> <p>The Technical Feasibility is rated across a number of components or indicators: </p> <ul> <li>Materials</li> <li>Equipment</li> <li>Access to target</li> <li>Technical expertise</li> <li>Access to critical information</li> </ul> <p>Each component can be seen as a hurdle on the path to a successful scenario or event (see diagram below). The Technical Feasibility Score is determined by selecting the lowest component rating, across all components, thus reflecting the highest hurdle or biggest constraint on the feasibility of the given scenario or event; the lower the feasibility, the higher the hurdle.  </p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 6. Technical Feasibility</strong></p> <img src="ll-hzrds-ssssmnt-archvd-06-eng.gif" alt="Figure 6. Technical Feasibility" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Technical Feasibility: The lowest technical feasibility dominates overall technical feasibility. 1st Hurdle: 3, 2nd Hurdle: 5, 3rd Hurdle: 1;  Highest Hurdle, 4th Hurdle: 3.</p> </details> </div> <div class="clearfix"></div> <p>The same principle applies when comparing the overall capability rating to the intent rating.  Again, the lower of the overall capability and intent ratings would determine the overall likelihood.</p> <p>Each of these feasibility components is rated based on a “verbal descriptor scale”, as shown in the table below:</p> <table class="table table-bordered"> <caption> Likelihood Ratings for Malicious Scenarios – Technical Feasibility </caption> <tr> <th colspan="6">Feasibility</th> </tr> <tr> <th>Scoring:</th> <th>Material</th> <th>Equipment</th> <th>Access to the Target or System</th> <th>Technical Expertise</th> <th>Access to Critical Information</th> </tr> <tr> <td>0</td> <td>Almost impossible to produce or acquire</td> <td>Requires custom designed and/or state of the art manufactured equipment</td> <td>Almost impossible</td> <td>Requires controlled advanced specialized technical training</td> <td>Almost impossible</td> </tr> <tr> <td>0.5-1</td> <td>Extremely difficult to produce or acquire</td> <td>Requires custom designed and/or controlled manufactured equipment</td> <td>Extremely difficult</td> <td>Requires advanced specialized technical training</td> <td>Extremely difficult</td> </tr> <tr> <td>1.5-2</td> <td>Very difficult to produce or acquire</td> <td>Requires specialized equipment</td> <td>Very difficult</td> <td>Requires advanced technical training</td> <td>Very difficult</td> </tr> <tr> <td>2.5-3</td> <td>Difficult to produce or acquire</td> <td>Requires some specialized equipment components</td> <td>Difficult</td> <td>Requires some advanced technical training</td> <td>Difficult</td> </tr> <tr> <td>3.5-4</td> <td>Easily produced or acquired </td> <td>Requires standard laboratory and/or manufacturing equipment</td> <td>Accessible</td> <td>Requires minimal technical training</td> <td>Easily accessible</td> </tr> <tr> <td>4.5-5</td> <td>Readily available</td> <td>Requires no specialized equipment</td> <td>Very accessible</td> <td>Requires very low technical training</td> <td>Readily accessible</td> </tr> <tr> <td><strong>Ratings:</strong></td> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> </table> <p><strong>Minimum Feasibility Score:</strong></p> <p>The technical feasibility score is given by the lowest rating across the various components, which is a reflection of the feasibility within a given scenario.</p> <h5>Enabling Capability</h5> <p>Once the technical feasibility has been assessed, the organizational and support capabilities of various malicious actors are assessed relative to whether they are sufficient to enable the level of technical feasibility assessed for the malicious scenario, as shown in the table below:</p> <table class="table table-bordered"> <caption> Likelihood Ratings for Malicious Scenarios – Enabling Capability </caption> <tr> <th colspan="3">Scenario-Specific Enabling Capabilities</th> </tr> <tr> <th>Scoring:</th> <th>Organization / Command, Control and Communications Intelligence (C3I) (organizational structure and ability, human resources, C3I functions) </th> <th>Support & Logistics (funding, infrastructure)</th> </tr> <tr> <td>0</td> <td>Organization or individual has little-to-no organizational/C3I capability, only sufficient to enable a much lower level of technical feasibility than the one assessed for this scenario. </td> <td>Organization or individual has little-to-no support & logistics capability, only sufficient to enable a much lower level of technical feasibility than the one assessed for this scenario.</td> </tr> <tr> <td>0.5-1</td> <td>Organization or individual has limited organizational/C3I capability, only sufficient to enable a lower level of technical feasibility than the one assessed for this scenario.</td> <td>Organization or individual has limited support & logistics capability, only sufficient to enable a lower level of technical feasibility than the one assessed for this scenario.</td> </tr> <tr> <td>1.5-2</td> <td>Organization or individual has some organizational/C3I capability to enable the level of technical feasibility assessed for this scenario.</td> <td>Organization or individual has some support & logistics capability to enable the level of technical feasibility assessed for this scenario.</td> </tr> <tr> <td>2.5-3</td> <td>Organization or individual has demonstrated organizational/C3I capability to enable the level of technical feasibility assessed for this scenario.</td> <td>Organization or individual has demonstrated support & logistics capability to enable the level of technical feasibility assessed for this scenario.</td> </tr> <tr> <td>3.5-4</td> <td>Organization or individual has demonstrated organizational/C3I capability to enable a higher level of technical feasibility than the one assessed for this scenario. </td> <td>Organization or individual has demonstrated support & logistics capability, sufficient to enable a higher level of technical feasibility than the one assessed for this scenario.</td> </tr> <tr> <td>4.5-5</td> <td>Organization or individual has demonstrated organizational/C3I capability to enable a much higher level of technical feasibility than the one assessed for this scenario.</td> <td>Organization or individual has demonstrated support & logistics capability, sufficient to enable a much higher level of technical feasibility than the one assessed for this scenario.</td> </tr> <tr> <td><strong>Ratings:</strong></td> <td> </td> <td> </td> </tr> </table> <p><strong>Minimum Enabling Capability Score:</strong></p> <p>Once again, the minimum scoring across the two enabling capability components is retained. This rating is used further to determine an overall capability score, together with the technical feasibility rating. The technical feasibility rating will be adjusted based on the assessed level of enabling capability. This will reflect whether any malicious actors potentially behind an attack such as the one described in the scenario have adequate organizational and support capability components to enable the technical capability requirements to carry it out. The adjustment will consider a “baseline” or threshold level of enabling capability required to carry out the scenario, given the assessed technical feasibility, and will modify the feasibility assessment negatively, if the enabling capability level is found insufficient compared to the baseline, or positively, if the enabling capability level is found more than sufficient compared to the baseline. An example of modifier values associated with the various enabling capability levels is shown below:</p> <table class="table table-bordered"> <caption> Likelihood Ratings for Malicious Scenarios – Modifiers for Various Enabling Capability Levels </caption> <tr> <th> Combined Capability Rating (min(C<sub>org/C3I</sub>,C<sub>suport/logistics</sub>))</th> <th>Associated modifier applied to Feasibility Rating</th> </tr> <tr> <td>0</td> <td>-3</td> </tr> <tr> <td>0.5</td> <td>-2.5</td> </tr> <tr> <td>1</td> <td>-2</td> </tr> <tr> <td>1.5</td> <td>-1.5</td> </tr> <tr> <td>2</td> <td>-1</td> </tr> <tr> <td>2.5</td> <td>-0.5</td> </tr> <tr> <td>3</td> <td>0</td> </tr> <tr> <td>3.5</td> <td>0.5</td> </tr> <tr> <td>4</td> <td>1</td> </tr> <tr> <td>4.5</td> <td>1.5</td> </tr> <tr> <td>5</td> <td>2</td> </tr> </table> <h5>Overall Capability Score</h5> <p>The overall capability score is obtained by combining the technical feasibility score with the enabling capability score, as described in the paragraph above.</p> <h5>Intent</h5> <p>The intent judgment is meant to provide an indication of an individual's or group's motivation to carry out the scenario being assessed. The intent is rated using the following table: </p> <table class="table table-bordered"> <caption> Likelihood Ratings for Malicious Scenarios – Intent </caption> <tr> <th>Scoring</th> <th>Intent</th> </tr> <tr> <td>0</td> <td>There is <em><strong>little to no evidence</strong></em> of an individual's or a group's <em><strong>intention</strong></em>.</td> </tr> <tr> <td>0.5-1</td> <td>There is <em><strong>limited evidence</strong></em> of an individual's or a group's <em><strong>intention</strong></em>.</td> </tr> <tr> <td>1.5-2</td> <td>There is at least <em><strong>some evidence</strong></em> of an individual's or a group's <em><strong>demonstrated intention</strong></em>.</td> </tr> <tr> <td>2.5-3</td> <td>There is <em><strong>at least one documented case of evidence</strong></em> of an individual's or a group's <em><strong>demonstrated intention</strong></em>.</td> </tr> <tr> <td>3.5-4</td> <td>There are <em><strong>several documented cases of evidence</strong></em> of an individual's or a group's <em><strong>demonstrated intention</strong></em>. </td> </tr> <tr> <td>4.5-5</td> <td>There are <em><strong>ample documented cases of evidence</strong></em> of an individual's or a group's <em><strong>demonstrated intention</strong></em>.</td> </tr> <tr> <td> </td> <td><strong><em>Intent Rating</em></strong></td> </tr> </table> <h5>Overall Likelihood for Malicious Threats</h5> <p>The overall Likelihood assessment will reflect the lowest of the ratings for Intent and Capability, following again the “weakest link” principle.</p> <h4 id="step3_non_malicious">Non-Malicious Hazards</h4> <p>Likelihood estimates for non-malicious hazards can be based either on historical frequencies, predictive models, or expert judgment. When using historical frequencies, the likelihood estimate can be modified if an increasing or decreasing trend is expected compared to historical conditions.</p> <p>Table 1, below, represents the level of detail expected in likelihood estimates. Within the scoring approach, all likelihood estimates are converted to a five-year timeframe for occurrence.</p> <p>It is important to consider that global climate change has created conditions where natural disasters are changing in frequency and magnitude. While some natural events may not have been experienced in the past, they may be more common today or in five years. An approach that takes into consideration differing situations and foresight will allow for a more robust assessment of non-malicious likelihood.</p> <p>Similarly, for health-related matters, as global trade and tourism continue to expand, increased numbers of Canadians and Canadian products will have the potential to be exposed to unfamiliar or uncommon diseases. International travel and commerce will also help spread disease more quickly than historically encountered creating a situation that must also be considered for accurate assessment.</p> <table class="table table-bordered"> <caption> Likelihood – Frequency </caption> <tr> <th>Estimated frequency, once every X years, where X is:</th> </tr> <tr> <td>100,000 (years)</td> </tr> <tr> <td>30,000</td> </tr> <tr> <td>10,000</td> </tr> <tr> <td>3,000</td> </tr> <tr> <td>1,000</td> </tr> <tr> <td>300</td> </tr> <tr> <td>100</td> </tr> <tr> <td>30</td> </tr> <tr> <td>10</td> </tr> <tr> <td>3</td> </tr> <tr> <td>1</td> </tr> </table> <h2 id="step4_risk_evaluation">Step 4: Risk Evaluation</h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-12-eng.gif" alt="Step 4: Risk Evaluation" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>STEP 4: Risk Evaluation. Risks. OUTPUT: Harmonised List of Rated Risk Event Scenarios</p> </details> </div> <div class="clearfix"></div> <h3 id="step4_objective">Objective of Risk Evaluation</h3> <p>Risk Evaluation is the process of comparing the results of Risk Analysis with risk criteria to determine whether a risk and/or its magnitude is/are acceptable or tolerable. The purpose of Risk Evaluation is to support the development of sound recommendations about risks that may need treatment or may be identified as priority for treatment. Risk Evaluation also provides a baseline of the risks without any management measures.</p> <h3 id="step4_inputs">Inputs Required</h3> <p>The information inputs for the Risk Evaluation process are:</p> <ul> <li>The likelihood of the realisation of the hazards/threats associated with the risk event, with an associated confidence level and assumptions and/or justifications, as applicable.</li> <li>Assessments of the impact for the risk event in terms of each of the primary impact categories, with associated confidence levels and assumptions and/or justifications, as applicable.</li> <li>The total impact for the risk event, with an associated confidence level and assumptions and/or justifications, as applicable.</li> <li>Other information from the Risk Analysis Process, as supporting or background information.</li> </ul> <h3 id="step4_tasks">Tasks and Activities Expected in Risk Evaluation</h3> <p>The Risk Evaluation generally comprises the following steps:</p> <ul> <li>a. Determination of the risk magnitude (i.e. likelihood and impact) for the risk.</li> <li>b. Aggregation and consolidation of risk assessment results for all federal government risks into a whole-of-government AHRA.</li> <li>c. Production of selected AHRA information products and/or graphical representations of results.</li> </ul> <p>As previously stated, Risk Evaluation is the process of comparing the results of the Risk Analysis against risk criteria to determine whether the level of risk requires further study. Existing controls, Risk Treatment and policies are considered when recommending mitigation measures/options. Risk criteria are based on internal and external contexts and can reflect the institution's values, objectives, resources and risk appetite (i.e. an over-arching expression of the amount and type of risk an institution is prepared to take or tolerate).</p> <p>Risks can be ranked by comparing them in terms of their individual likelihood and impact estimates. The relative ordering of risk events based on their ratings can be shown graphically in a logarithmic risk diagram, risk-rating matrix or other forms of tabular or visual representations. The one most commonly used is the risk matrix which normally plots the likelihood and impact on the x- and y-axes (the measured components of risks). The three figures below provide examples of options for visualizing the Risk Analysis results. </p> <p>In a risk diagram such as Figure 7, a clustering of risks can be shown. Such a plot can help risk managers and decision-makers establish acceptable or intolerable risk levels, and identify their respective courses of action. </p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 7. Example of a Risk Event Rating Scatter Plot</strong></p> <img src="ll-hzrds-ssssmnt-archvd-07-eng.gif" alt="Figure 7. Example of a Risk Event Rating Scatter Plot" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Impact / Likelihood. This graph demonstrates the different event risks that have been assessed and mapped on a scatterplot graph.  Risks through this graphical representation can be compared in terms of their impact and likelihood. </p> </details> </div> <div class="clearfix"></div> <p>Figure 8 shows an example of how multiple scenarios or scenario variants can be compared across impact categories, which provides a picture of the areas most affected by the risk scenario being studied. </p> <div class="col-md-9"> <div class="text-center"> <p><strong>Figure 8. Example of an Impact Rating Plot by Impact Category and Risk Scenario Variant</strong></p> <img src="ll-hzrds-ssssmnt-archvd-08-eng.gif" alt="Figure 8. Example of an Impact Rating Plot by Impact Category and Risk Scenario Variant" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Impact Category Score / Risk Scenario Variant.  Scenarios can be assessed based on varying degrees of severity (nominal, reduced and elevated risk events) against the different impact categories (people, economy, environment, territorial security, society and psycho-social, and Canada's reputation and influence).</p> </details> </div> <div class="clearfix"></div> <p>Based on a risk diagram or rating matrix, a clustering of risks can be shown, leading to recommendations and/or decisions on the relative ordering of risk events based on their ratings. Such a plot can help risk managers and decision-makers establish acceptable or intolerable risk levels, and identify their respective courses of action. Risk mitigation options (risk reduction) and even risk tolerance levels could also be represented graphically to enhance risk communication.</p> <h3 id="step4_outputs">Outputs for Risk Evaluation</h3> <p>The information outputs from the Risk Evaluation process are:</p> <ul> <li>Risk Evaluation results or list of rated risk event scenarios (in the form of a report and/or a presentation).</li> <li>Various AHRA information products and graphical representations of the analysis and evaluation data (AHRA information products could include the consolidated likelihood and impact data for each scenario in a risk fiche).</li> <li>Various risk indicators such as whole-of-government or institutional thresholds for risk aversion and/or risk acceptance may be derived from the outputs of Risk Evaluation.</li> </ul> <h2 id="step5_risk">Step 5: Risk Treatment</h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-13-eng.gif" alt="Step 5: Risk Treatment" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>STEP 5: Risk Treatment. Publish Federal AHRA Results and Recommendations. OUTPUT: Risk Register, Risk Maps, Planning Assumptions/Scenarios, Other Visual Tools</p> </details> </div> <div class="clearfix"></div> <h3 id="step5_objective">Objective of Risk Treatment</h3> <p>Risk Treatment is the process of developing, selecting and implementing risk controls measures. </p> <p>Step 5 of the AHRA methodology is the development of recommendations for Risk Treatment options, from a risk analyst perspective, based on the results of the Risk Evaluation and other considerations. These recommendations are meant to inform risk managers and decision-makers in their formulation of Risk Treatment options.</p> <h3 id="step5_input">Input Required</h3> <p>The information inputs to Risk Treatment are the outputs of the Risk Evaluation:</p> <ul> <li>Risk Evaluation results or list of rated risk event scenarios (in the form of a report and/or a presentation).</li> <li>Various AHRA information products and graphical representations of the analysis and evaluation data (AHRA information products could include the consolidated likelihood and impact data for each scenario in a risk fiche).</li> <li>Various risk indicators such as whole-of-government or institutional thresholds for risk aversion and/or risk acceptance may be derived from the outputs of Risk Evaluation.</li> </ul> <h3 id="step5_tasks">Tasks and Activities Expected in Risk Treatment</h3> <h4 id="step5_scope">Scope of Risk Treatment</h4> <p>As previously stated, Risk Treatment is the process of developing, selecting and implementing risk control measures. Treatments that deal with negative consequences are also referred to as risk mitigation, risk elimination, risk prevention, risk reduction, risk repression and risk correction. Treatment options can include, but are not limited, to:</p> <ul> <li>Avoiding the risk by deciding not to continue with the activity that gives rise to the risk.</li> <li>Removing the source of the risk.</li> <li>Changing the nature or magnitude of the likelihood.</li> <li>Changing the consequences.</li> <li>Reducing exposures or vulnerabilities.</li> <li>Sharing the risk with another party.</li> <li>Retaining the risk by choice.</li> </ul> <p>Risk Treatment options can be prioritized by considering a number of factors, including institutional obligations, political impetus, humanitarian grounds, cost, etc. and by considering risk severity, risk tolerance, effectiveness of Risk Treatment measures, cost and benefits, the horizontal nature of the risk, and existing constraints. These treatment options, forming recommendations, would be used to develop the Risk Treatment step in the risk management or emergency management cycle.</p> <p>Risk Treatment options should be assessed, to better understand if residual risk levels are tolerable to an institution. If they are not, a new Risk Treatment should be considered and its effectiveness, assessed. Risk tolerance levels within an institution should be promptly identified during the AHRA process, as early as when Setting the Context.</p> <h4 id="step5_risk_treatment">Recommending Risk Treatment Avenues to Senior Management</h4> <p>In recommending Risk Treatment options, the risk analyst must do so based on the results of the Risk Analysis and Risk Evaluation at hand, and be mindful of the level of inherent uncertainty and reliability of the treated data. In certain risk areas that are data deprived (e.g., low frequency and potentially high consequence events), qualitative judgements will likely be the source of data, with their own associated uncertainty and reliability. It remains important to qualify any recommendation with a clear statement on those aspects, including the source of the data, the reliability of the data, and the uncertainty. </p> <p>Another aspect, in formulating recommendations, is the notion of risk reduction and the ability to demonstrate the potential for risk reduction. This is particularly difficult due to the fact that risk reduction metrics are very difficult to isolate and measure. This is especially true for speculative cases where there is no case history. </p> <p>In most cases, the risk analyst should endeavour to communicate (verbally, in text and in graphics) the results of the Risk Analysis and Risk Evaluation in a way that will help risk managers and decision-makers isolate their own options. By using a framework process that is repeatable and offers the ability to consider additional elements (i.e., new impact categories and factors), it will open the possibilities for further exploration and analysis; and possibly address issues such as uncertainty. </p> <p>As recommendations form part of the overall risk assessment, they must be captured in such a way as to facilitate tracking throughout successive iterations of the risk assessment process. The following section will discuss the aspect of data management.</p> <h3 id="step5_outputs">Outputs for Risk Treatment</h3> <p>The information output from Risk Treatment is a set of recommendations for Risk Treatment options, from a risk analyst perspective, based on the results of the Risk Evaluation and other considerations. These recommendations are meant to inform risk managers and decision-makers in their formulation of Risk Treatment options.</p> <h2 id="step5_data_management">Data Management</h2> <h3 id="step5_general">General</h3> <p>A major shortfall in many risk assessment processes is the lack of adequate data management capability and associated resources. Since risk assessments are conducted periodically and across many federal government institutions, domains and entities, the satisfactory management of the related data over time becomes crucial. It is particularly so when trying to establish the effectiveness of risk reduction measures and their impact over time. In the case of the AHRA, each federal government institution is encouraged to strive for the implementation of a number of data management options ranging from a formatted spreadsheet to allow for the capture of risk ratings, all the way to a risk register to capture all the information meaning from each risk assessment steps taken to fully understand risks. It is understood that these techniques and tools will evolve over time through exploration and implementation of the federal AHRA every year. Simplicity will be crucial in ensuring that the data management principles and practices can be universally applied.</p> <p>It is important to note that these data management tools, their relative configuration and the software programs which will be employed to implement them are subject to change as the AHRA methodology and the understanding of optimal means for its implementation also evolve over a period of time.</p> <p>Other data management tools will be explored to enhance the accessibility to, analysis and visualization of risk data. These may include the use of geo-referenced risk maps and other graphical options.</p> <h3 id="step5_ahra_risk_register">AHRA Risk Register and Database</h3> <p>The results of the AHRA will be compiled by PS in a report and inventoried in an electronic risk register, using Excel or a similar software program. The AHRA risk register will inventory the pertinent information linked to each assessed risk. The risk register will typically describe each risk event, capture the likelihood that it may occur, list possible consequences if it does occur, provide a relative ordering of risk events based on their ratings, and identify proposed treatment strategies. It can be a useful tool for managing and addressing risks, as well as facilitating risk communication to stakeholders. A risk portfolio or profile can be created from the register, helping to compile common risks in order to assess interdependencies and to provide a relative order of risk events based on their ratings by groups. The risk register is meant to provide a lasting record and will be adjusted as risk assessment results change. </p> <p>This register will be maintained by PS with data from each successive cycle of risk assessment. The register will permit easy access to the risk data for analysts and decision-makers. </p> <p>The AHRA register will catalogue the data relevant to the current AHRA cycle and will also hold the data from previous AHRA cycles, to be used for: </p> <ul> <li>Tracking the progress of risks and risk assessments over time.</li> <li>Analysis of trends in emerging risks.</li> <li>Lessons-Learned analyses.</li> <li>Information on the AHRA Community of Practice for the federal community.</li> </ul> <h3 id="step5_sensitivity">Data Management and Sensitivity</h3> <p>Data will be managed in accordance with its sensitivity and classification, as established by an injury test. It will also be handled according to applicable legislation and policies relating to security and information management, including the GC security policy and the information management policy.</p> <p>Data will be retained and maintained for historical value, for government archives, for trend analysis and to support risk management activities.</p> <h2 id="step5_improvement">Accumulating Knowledge and Continuous Improvement of AHRA</h2> <p>The AHRA process will be iterative, in recognition of the fact that the array of risks facing Canada as well as our level of knowledge about these risks is constantly changing. For example, development along rivers can increase the potential impact of flooding, the introduction of a vaccination program may decrease the impact of an infectious disease outbreak scenario, and surveillance activities may identify an emerging source of malicious activity. These changing conditions can prompt updated risk assessments, and the evolving risk picture can be tracked over time. </p> <p>Once the standardized methodology has been applied by the various federal government institutions, regular updating of the outputs based on changing conditions would be a relatively less intensive undertaking. In addition, as new information becomes available, it is expected that each round of risk assessment will be improved by incorporation of more accurate data, expertise and experience gained during previous iterations of the assessment process.</p> <p>Finally, international work performed by the GC in relation to the sharing of leading risk assessment and risk management practices will continue to make the AHRA methodology and its process evolve, emphasizing on the federal government's commitment towards continuous improvement of the AHRA.</p> <h2 id="annex_1">Annex 1 – AHRA Business Cycle</h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-14-eng.gif" alt="AHRA Business Cycle" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Fiscal Year. </p> <p>Spring; Mar/Apr/May: Invitation to federal institutions to review Results of AHRA, Evaluation of AHRA results from scoring Workshops, Call to launch review of AHRA Methodology. </p> <p>Summer; Jun/Jul/Aug: Report on the AHRA result (previous cycle) and presentation to decision-makers, ADM EMRO to send outcall letter: risk identification and launch scenario development process, Review of recommendations for change to methodology and communication to stakeholders. </p> <p>Fall; Sept/Oct/Nov: Scenario development process. </p> <p>Winter; Dec/Jan/Feb: Request for experts from federal institutions to conduct risk analysis, 3 – 4 risk scoring workshops</p> </details> </div> <div class="clearfix"></div> <h2 id="annex_2">Annex 2 – SWOT and PESTLE Analysis</h2> <p>A <strong>SWOT analysis</strong> is a planning tool used to evaluate the Strengths, Weaknesses, Opportunities and Threats of an organization as they relate to a set outcome.</p> <ul> <li><strong>S</strong>trengths – attributes of the organization that are helpful to achieving the objective(s).</li> <li><strong>W</strong>eaknesses – attributes of the organization that are harmful to achieving the objective(s)</li> <li><strong>O</strong>pportunities – <em>external</em> conditions that are helpful to achieving the objective(s)</li> <li><strong>T</strong>hreats – <em>external</em> conditions which could do damage to the objective(s)</li> </ul> <p>The analysis involves specifying the objectives of the initiative and identifying the internal and external factors that are favourable and unfavourable to achieving them. The first step to a SWOT analysis is therefore to define the desired “end state” or goal. In the case of emergency management planning, this “end state” is to have an effective institutional emergency management program.</p> <p>Below are simple rules for a successful SWOT analysis:</p> <ul> <li>Be realistic about the strengths and weaknesses of the organization.</li> <li>Distinguish between where your organization is today and where it could be in the future.</li> <li>Be specific.</li> <li>Keep it short and simple.</li> </ul> <table class="table table-bordered"> <caption> Table 1: Sample SWOT table </caption> <tr> <th> </th> <th>Helpful (to achieve the goals)</th> <th>Harmful (to achieve the goals)</th> </tr> <tr> <td>Internal Origin (attributes of the organization)</td> <td>Strengths</td> <td>Weaknesses </td> </tr> <tr> <td>External Origin (attributes of the environment) </td> <td>Opportunities </td> <td>Threats </td> </tr> </table> <p>In conducting a PESTLE (Political, Economic, Social, Technological/Technical, Legal, Environmental) analysis, first list external PESTLE factors that may impact on an institution. This may require brainstorming and expert advice. Then identify the implications of each PESTLE factor for an institution. Lastly, decide on the importance of the implications of the external factors–rank or rate them.</p> <p>(PESTLE = Political, Economic, Social, Technological/Technical, Legal, Environmental)</p> <table class="table table-bordered"> <caption> Table 2: Sample PESTLE analysis table </caption> <tr> <th>PESTLE element that may impact EM planning</th> <th>Timeline (short < 1 yr, medium 2-3 yrs, long term 3+ years)</th> <th>Impact (low, medium and high) and relevance</th> <th>Internal or external to institution</th> <th>Action (if applicable)</th> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> </td> <td> </td> <td> </td> <td> </td> <td> </td> </tr> </table> <h2 id="annex_3">Annex 3 – AHRA Risk Taxonomy</h2> <div class="col-md-9"> <div class="text-center"> <img src="ll-hzrds-ssssmnt-archvd-15-eng.gif" alt="All-Hazards Risk Event Categories" class="img-responsive" /> </div> <details> <summary>Image Description</summary> <p>Adaptive/Malicious Threats: <br> Intentional Threats; Criminal:, Terrorist Act, Extremist Act, Individual Criminal Act, Organised Crime, Corporate/Insider Sabotage, Corporate Espionage.<br> Foreign State:, State-Sponsored Terrorism, Espionage, Act of War. </p> <p>Non-Malicious Threats/Hazards: <br> Social :, Migration, Social Unrest/Civil Disobedience. <br> Technical/Accidental:, Spill, Fire, Explosion, Structural Collapse, System Error(s) Yielding Failure. <br> Health Threats/Hazards: Pandemics/Epidemics:, Human Health Related, Animal Health Related <br> Large-Scale Contamination:, Drugs and Health Products Contaminant, Food/Water/Air Contaminant, Environment Contaminant. <br> Emerging Phenomena & Technologies:, Biological Science & Technology, Health Sciences, (Re) emerging Health Hazards, Chemical Compounds, Emerging Natural Hazard(s), Material Science & Engineering, Information Technologies</p> <p>Risk Taxonomy: <br> Natural Threats/Hazards: <br> Meteorological:, Hurricane, Tornado/Wind Storm, Hail/Snow/ Ice Storm, Flood/Storm Surge, Avalanche, Forest Fire, Drought, Extreme Temperatures. <br> Geological:, Tsunami, Earthquake, Volcanic Eruption, Land/Mudslide, Land Subsidence, Glacier/Iceberg Effects, Space Weather. <br> Ecological/Global Phenomena:, Infestations, Effects of Over-Exploitation, Effects of Excessive Urbanisation, Global Warming, Extreme Climate Change Conds.</p> </details> </div> <div class="clearfix"></div> <h2 id="annex_4">Annex 4 – Risk Event Scenario Description Template</h2> <p>Please indicate the level of CLASSIFICATION of the scenario here</p> <table class="table table-bordered"> <caption> RISK EVENT SCENARIO DESCRIPTION </caption> <tr> <th colspan="2">RISK EVENT SCENARIO DESCRIPTION</th> </tr> <tr> <td><strong>Risk event name/title:</strong></td> <td><p><em>Baseline description used to evaluate both likelihood and impact</em>.</p> <p><em>In areas where likelihood and impact should be considered and scored, text should be marked with (L) for likelihood and (I) for impact. This is suggested for text that is embedded in descriptions and not obvious to the reader.</em></p></td> </tr> <tr> <td>Applicable risk code(s) for the principal constituent threat or hazard (including the category(ies) of the standard AHRA risk taxonomy affected): </td> <td><em>Please refer to the AHRA taxonomy, Annex 3.</em></td> </tr> <tr> <td>Applicable risk code(s) for the secondary threat(s) or hazards (s) (including the category(ies) of the standard AHRA risk taxonomy affected):</td> <td><em>This field is optional and related to risks that have secondary effects, such as floods that occur after a hurricane.</em></td> </tr> <tr> <td><strong>Primary department (for response):</strong></td> <td><em>The Federal Emergency Response Plan (2011) describes the primary department as a federal government institution with a mandate related to a key element of an emergency. Several federal government institutions may be designated as primary departments, depending on the nature or severity of the emergency. </em></td> </tr> <tr> <td><strong>Supporting department (for all EM components):</strong></td> <td><em>According to the Federal Emergency Response Plan (2011), a supporting department is a federal government institution that provides general or specialized assistance to a primary department in response to an emergency.</em></td> </tr> <tr> <td>Key information sources for the risk event scenario description - please tag the information as <em>Unclassified</em> (U) or <em>Classified</em> (C; S; TS; TS SA): </td> <td><p><em>Identification of supporting documentation is important, especially in cases where qualitative and/or quantitative data supports scores decided upon during the risk scoring workshop. This ensures credibility and legitimacy of risk scores. In addition, reference can be made back to decision points at any point in time and by anyone.</em></p> <p><em>Clearly identify unclassified and classified information, for ease of reference when assessing likelihood components for malicious threats.</em></p></td> </tr> <tr> <th colspan="2">RISK EVENT DESCRIPTION</th> </tr> <tr> <td><strong>Description (context, setting, cause, source, nature, scale), of the risk event:</strong></td> <td><p><em>The description entered here must be plausible in that factual information would support such an occurrence. The considered time-frame from which events are considered in the AHRA process is short-term (within the next 5 years) threats/hazards. Long-term threats/hazards (that span 5 – 25 years into the future) are not currently considered in the AHRA.</em></p> <p><em>Background information leading up to the risk event provides context to the scenario without making broad assumptions which may skew results during the risk scoring workshop. Information inserted in this area should take into consideration the assessment of the following impact categories: People, Environment, Economic, Territorial Security, Canada's Reputation and Influence and Society and Psycho-Social.</em></p></td> </tr> <tr> <td>Description of the lead-up to the incident, consisting of the (underlying) cause and any underlying insidious process:</td> <td><em>This section is optional.</em></td> </tr> <tr> <td>Geographical considerations (location, geographical extent, region):</td> <td><em>This section is optional. Geographical coordinate system (latitudinal and longitudinal lines), country, province, territory or region is to be included in this section.</em></td> </tr> <tr> <td><strong>Natural environment:</strong></td> <td><em>Relevant physical or environmental characteristics are inserted in this area facilitating the assessment of the Environmental impact category.</em></td> </tr> <tr> <td><strong>Meteorological conditions:</strong></td> <td><em>Relevant meteorological condition(s) that influence the outcome of the scenario should be inserted in this area. If applicable variants may be inserted in this area.</em></td> </tr> <tr> <td>Seasonal:</td> <td><em>This section is optional and left to the discretion of the scenario developers. Dependant on the scenario, seasonal changes may influence the outcome of assessment of a particular risk.</em></td> </tr> <tr> <td>Hazard characteristics:</td> <td><em>Characteristics of chemical, biological, radiological and/or nuclear agent(s) involved in the scenario are inserted in this area. Elements captured should relate to: toxicity, transmissibility, behaviour, fate and persistency to indicate a hazard severity and duration.</em></td> </tr> <tr> <td><strong>Nature and vulnerability of the affected area (context, population density, degree of urbanisation, key infrastructure, economic considerations, political considerations, etc.):</strong></td> <td><p><em>This area is important to note as it provides relevant information from which subject matter experts score risks.</em></p> <p><em>Population density, degree of urbanisation and key infrastructure influence the People and possibly the Society and Psycho-Social impact category.</em></p> <p><em>Economic considerations affect the Economic impact category.</em></p> <p><em> Political, geographical and territorial considerations influence Canada's Reputation and Influence and Territorial Security impact categories.</em></p></td> </tr> <tr> <td>Any other relevant assumptions made in describing the risk event scenario:</td> <td><p><em>If assumptions relating to the risk event description can be identified or isolated they should be inserted in this area. </em></p> <p><em>Although this field is considered optional, the information may still be required in the risk scoring tool.</em></p></td> </tr> <tr> <td>Uncertainty or variability in the risk event description:</td> <td><p><em>If there are areas of uncertainty or unpredictability, it should be inserted in this area.</em></p> <p><em>Although this field is considered optional, information may be required in the risk scoring tool.</em></p></td> </tr> <tr> <td>Other relevant information, notes or comments:</td> <td><em>Any other relevant information relating to the risk event description should be identified in this area.</em></td> </tr> <tr> <th colspan="2"><strong>LIKELIHOOD ASSESSMENT</strong></th> </tr> <tr> <td><strong>Time period/time horizon during which the risk event might be realised: </strong></td> <td><em>The translation of the data in likelihood of occurrence on a yearly basis will be done in the risk scoring tool.</em></td> </tr> <tr> <td>Uncertainty in the likelihood assessment:</td> <td><em>Unknown factors which would influence the likelihood assessment should be inserted in this area.</em></td> </tr> <tr> <td>Other relevant information, notes or comments:</td> <td><em>Any other relevant information relating to the primary likelihood assessment should be inserted in this area.</em></td> </tr> <tr> <td colspan="2"><strong>IMPACTS/CONSEQUENCES ASSESSMENT</strong></td> </tr> <tr> <td colspan="2"><strong>Impact categories: nature and scale</strong></td> </tr> <tr> <td><strong><em>1. People:</em></strong></td> <td><em>Specific indicators have been selected to evaluate the effect of hazards and threats on people. Estimated figures should be inserted in this box e.g. the number of fatalities, serious injuries, etc.</em></td> </tr> <tr> <td><strong><em>2. Economy:</em></strong></td> <td><em>Based on the Department of Finance Canada's criteria of risks and hazards on the economy. This impact category captures direct and indirect loses. Direct loses are immediate economic damage as a result of a risk event. Losses are measured based on repair or replacement costs. Indirect loses refer to the flow of goods and services which will not be produced as a result of damage to productive assets and infrastructure.</em></td> </tr> <tr> <td><strong><em>3. Environment:</em></strong></td> <td><em>Based on the indicators developed by Public Safety Canada, in close collaboration with Environment Canada, on the effects of hazards and threats on the environment.</em></td> </tr> <tr> <td><strong><em>4. Territorial security:</em></strong></td> <td><em>Based on indicators that capture conditions in which there is a loss in the ability of the Government of Canada to secure the territory or the border and to secure the safety of citizens.</em></td> </tr> <tr> <td><strong><em>5. Canada's reputation and influence:</em></strong></td> <td><em>Based on expert assessment of the potential international reaction to an emergency event occurring in Canada, or involving Canadians abroad.</em></td> </tr> <tr> <td><strong><em>6. Society and psychosocial:</em></strong></td> <td><em>Based on indicators regarding public outrage and public anxiety, as well as social actions, such as protests, civil disturbances or vandalism, can be provoked by a risk event.</em></td> </tr> <tr> <td>Uncertainty in the impacts/consequences assessment:</td> <td><em>Uncertainty, unpredictability or areas of doubts relating to the impacts/consequences assessment should be inserted in this area.</em></td> </tr> <tr> <td>Other relevant information, notes or comments:</td> <td><em>Other relevant information relating to the impacts/consequences assessment should be inserted in this area.</em></td> </tr> <tr> <td colspan="2"><strong>PRELIMINARY RISK TREATMENT PLANNING</strong></td> </tr> <tr> <td>Baseline risk treatment plan (treatment actions, timeframe(s), readiness, etc.):</td> <td><em>This area is optional. Federal institutions may choose to fill it out after the completion of the risk scoring workshop. This area would assess the capacity of the Emergency Support Functions (ESF).</em></td> </tr> <tr> <td><strong>Risk treatment measures already in place</strong></td> <td><p><em>As the AHRA takes into consideration mitigation measures in place when assessing the likelihood of occurrence and the impacts of a risk, (all or some of) these measures should be clearly captured somewhere in the risk event scenario template.</em></p> <p><em>This will force divisions which “own” mitigation measures (usually Program divisions) to share their information with EM divisions (usually under GOC, Operations or Corporate Branches).</em></p></td> </tr> <tr> <td>Degree to which the risk (likelihood, impacts) can be reduced by Risk Treatment.</td> <td><em>This area may be completed by departments and agencies. This area would assess the capacity of the ESF.</em></td> </tr> <tr> <td>Additional risk treatment resources required.</td> <td><em>Additional information relating to risk treatment may be inserted in this area.</em></td> </tr> <tr> <td>Other relevant information, notes or comments:</td> <td><em>Other relevant information relating to the impacts/consequences assessment should be inserted in this area.</em></td> </tr> </table> <h2 id="annex_5">Annex 5 – Rating of the Impact on Canada's Reputation and Influence</h2> <table class="table table-bordered"> <caption> Annex 5 – Rating of the Impact on Canada's Reputation and Influence </caption> <tr> <th>Level</th> <th>Actions</th> <th>Political Relations</th> <th>Non-Political Relations</th> </tr> <tr> <td>0 – 1.0 <strong><br> Insignificant</strong></td> <td><ul> <li>Canadian missions abroad are not affected.</li> <li>Concentrated and short-lived condemnation of Canada/Government of Canada.</li> <li>Canadians abroad are not affected.</li> </ul></td> <td><ul> <li>Trade regulations slow Canadian exports into some minor foreign markets but are not stopped.</li> <li>Canadian mission staff are not affected.</li> <li>Bilateral trade agreements are temporarily suspended.</li> <li>International working level meetings are delayed.</li> </ul></td> <td><ul> <li>No effect on international events.</li> <li>International travel is discouraged to one region within Canada by foreign governments.</li> </ul></td> </tr> <tr> <td>1.0 – 2.0 <br> <strong>Minor damage to Canadian reputation</strong></td> <td><ul> <li>Canadian missions abroad receive threats but none materialise.</li> <li>Short-lived condemnation of Canada internationally.</li> <li>Threats issued to Canadians abroad but are unlikely.</li> </ul></td> <td><ul> <li>Temporary trade bans and/or sanctions are imposed by a few minor trading partners.</li> <li>Canadian mission staff exercises increased levels of vigilance.</li> <li>Canadians delayed at border crossings but visas are not imposed.</li> <li>Cancellation of meetings with minor international partners.</li> <li>Minor trade agreements are temporarily suspended.</li> </ul></td> <td><ul> <li>International conferences see fewer participants.</li> <li>International travel is discouraged to several regions within Canada by foreign governments.</li> </ul></td> </tr> <tr> <td>2.0 – 3.0 <strong><br> Significant damage to Canadian reputation/prestige</strong></td> <td><ul> <li>Canadian missions abroad receive serious threats and are forced to close.</li> <li>Significant condemnation of Canada and/or the Government of Canada internationally.</li> <li>The Government of Canada encourages citizens not to travel due to threats abroad.</li> </ul></td> <td><ul> <li>Trade bans and/or sanctions imposed by a few major and minor trading partners and trading blocs (United States, Japan, United Kingdom, China not included).</li> <li>Canadian mission staff leaves host country due to insecurity.</li> <li>Entry visa requirement imposed on Canadians travelling abroad.</li> <li>Cancellation of bilateral meetings with major and minor international partners.</li> <li>Minor trade agreements are cancelled.</li> </ul></td> <td><ul> <li>International events are forced to reschedule.</li> <li>International travel to Canada is discouraged by foreign governments.</li> </ul></td> </tr> <tr> <td>3.0 – 4.0 <br> <strong>Major damage to Canadian reputation/ prestige</strong></td> <td><ul> <li>Attempted invasion, occupation, and/or destruction of Canadian missions abroad.</li> <li>Wide-spread condemnation of Canada and/or the Government of Canada nationally and internationally.</li> <li>Persistent threats to Canadians abroad.</li> </ul></td> <td><ul> <li>Trade bans, embargoes, blockades and regulations imposed by some major and minor trading partners and trading blocs (United States not included).</li> <li>Forced deportation of Canadian mission staff.</li> <li>Denial of entry Visas to a number of countries or the imposition of extreme fees (e.g. United Arad Emirats Visa).</li> <li>Temporary suspension of trade agreements such as the North American Free Trade Agreement.</li> <li>Cancellation of major and minor international delegations to Canada or the rejection of Canadian delegations to other countries.</li> </ul></td> <td><ul> <li>Significant international events are cancelled.</li> <li>International travel to Canada is discouraged by international organizations such as the World Health Organization, the United Nations, American Government, etc.</li> </ul></td> </tr> <tr> <td>4.0 – 5.0 <strong><br> Severe damage to Canadian reputation/ prestige</strong></td> <td><ul> <li>Invasion, occupation, and/or destruction of Canadian missions abroad.</li> <li>Wide-spread and continuous condemnation of Canada and/or the Government of Canada nationally and internationally.</li> <li>Threats to Canadians abroad materialise.</li> </ul></td> <td><ul> <li>Trade bans, embargoes, blockades and regulations imposed by major and minor trading partners and trading blocs (ex: United States, Japan, United Kingdom, China, etc.).</li> <li>Deportation, arrest and/or killing of Canadian mission staff.</li> <li>Denial of entry Visas to many countries.</li> <li>Cancellation of Canadian trade agreements such as the North American Free Trade Agreement.</li> <li>Canada is expelled from major security organizations such as the North Atlantic Treaty Organization.</li> <li>Relations between the Government of Canada and foreign governments cease.</li> <li>Public cancellation of major international visits (ex: State Visit by the President).</li> </ul></td> <td><ul> <li>Refusal by major and minor Canadian partners to attend significant international events, such as the G8/20, Olympics, etc.</li> <li>Cancellation of major international events in Canada by event organizers (ex: International Olympic Committee, International Federation of Association Football, la Francophonie, the Commonwealth, etc.).</li> <li>Ban on international travel to Canada. Ban on Canadians travelling overseas.</li> </ul></td> </tr> </table> <h2 id="annex_6">Annex 6 – Economic Category Assessment Tool – Direct and Indirect Economic Loss for Repair or Replacement</h2> <table class="table table-bordered"> <caption> Direct Economic Loss (those involving damages to stock and assets occurring at the time of the disaster or soon after) </caption> <tr> <td><strong><em>Buildings</em></strong>: e.g. industrial, commercial, institutional (plants, offices, recreational facilities, hospitals). </td> <th> </th> </tr> <tr> <td><strong><em>Infrastructure</em></strong>: e.g. roads, water systems, irrigation, docks, terminals, other transportation, electric power, oil and gas engineering.</td> <td> </td> </tr> <tr> <td><strong><em>Machinery and equipment</em></strong>: e.g. computers and software, agricultural and industrial machinery, furniture, trucks, etc.</td> <td> </td> </tr> <tr> <td><strong><em>Residential housing and contents</em></strong>.</td> <td> </td> </tr> <tr> <td><strong><em>Raw materials</em></strong>: e.g. coal, crude oil, natural gas, grains, animals and animal products, wood, ferrous, non-ferrous, non-metallic.</td> <td> </td> </tr> </table> <br /> <table class="table table-bordered"> <caption> Indirect Economic Loss (those involving a loss in the flow of production of goods and services which begin after the disaster and may extend through the reconstruction period) </caption> <tr> <td><strong><em>Production or service provision losses</em></strong> due to the full or partial paralysis of productive activities: e.g. loss in industrial production due to damage to factories or shortages of raw materials/energy supplies, loss in agricultural production due to flooding or prolonged drought, loss of profits in the fishing and tourism industry following an oil spill, loss of production due to illness following a pandemic or listeriosis outbreak, etc.</td> <th> </th> </tr> <tr> <td><strong><em>Higher operational costs</em></strong> due to destruction of physical infrastructure and inventories or losses to production or income: e.g. a ban on beef and cattle exports would first translate into higher maintenance costs due to rising inventory of live animals.</td> <td> </td> </tr> <tr> <td><strong><em>Lost production due to linkage effects</em></strong>: e.g. destruction of a factory reduces the economic activities of suppliers who have no alternative markets.</td> <td> </td> </tr> <tr> <td>Additional <em><strong>costs incurred due to the need to use alternative means</strong></em> of production or provision of essential services: e.g. costs arising out of need to use alternative roads or transportation means due to damage to principal routes and critical infrastructures. </td> <td> </td> </tr> <tr> <td><strong><em>Costs of required government response</em></strong> due to emergency and rescue operations: e.g. overtime payments to provide emergency assistance and repair critical infrastructure, additional expenses incurred to accommodate evacuees or for investigation, productivity loss induced from distortion of government resources and time allocation, etc.</td> <td> </td> </tr> </table> <br /> <table class="table table-bordered"> <caption> Mitigating Factors, if applicable (disasters sometimes involve indirect benefits or adjustments over the short-medium term which we may want to flag) </caption> <tr> <td><strong><em>Shift in consumer demand/spending</em></strong>: e.g. following a BSE outbreak, demand for other types of meat may increase. </td> <th> </th> </tr> <tr> <td><strong><em>Change in the productivity of assets</em></strong>: e.g. following a flood, land productivity sometimes rises. </td> <td> </td> </tr> <tr> <td><strong><em>Labour reallocation</em></strong>: e.g. some workers could work longer or harder to make up for the shortfall in labour supply due to a pandemic outbreak. </td> <td> </td> </tr> <tr> <td><strong><em>Reconstruction activity</em></strong>: e.g. rebuilding activities after a hurricane. </td> <td> </td> </tr> </table> <h2 id="annex_7">Annex 7 – Glossary</h2> <table class="table table-bordered"> <caption> Annex 7 – Glossary </caption> <tr> <th>Term</th> <th>EM Vocabulary Approved Terms<sup id="fn07-rf"><a class="fn-lnk" href="#fn07"><span class="wb-inv">Footnote </span>7</a></sup></th> </tr> <tr> <td><strong>Accident</strong></td> <td><p>An unintended, unplanned and unexpected event that interrupts an activity and sometimes causes injury or damage.</p> <p><strong>Note:</strong> Examples of accidents include transportation accidents, hazardous material spills or releases, fire and accidental explosions.</p></td> </tr> <tr> <td><strong>All Hazards</strong></td> <td><p>Referring to the entire spectrum of hazards, whether they are natural or human-induced. </p> <p><strong>Note:</strong> For example, hazards can stem from industrial accidents, national security events or cyber events.</p></td> </tr> <tr> <td><strong>All Hazards Approach </strong></td> <td><p>An emergency management approach that recognizes that the actions required to mitigate the effects of emergencies are essentially the same, irrespective of the nature of the incident, thereby permitting an optimization of planning, response and support resources.</p> <p><strong>Note: </strong>The intention of an all-hazards approach is to employ generic emergency planning methodologies, modified as necessary according to the circumstances.</p></td> </tr> <tr> <td><strong>All Hazards Risk Assessment </strong></td> <td>The process of identifying, analyzing and evaluating risks using an all-hazards approach.</td> </tr> <tr> <td><strong>Disaster </strong></td> <td><p>An event that results when a hazard impacts a vulnerable community in a way that exceeds or overwhelms the community's ability to cope and may cause serious harm to the safety, health or welfare of people, or damage to property or the environment.</p> <p><strong>Note:</strong> A disaster may be triggered by a naturally occurring phenomenon that has its origins within the geophysical or biological environment or by human action or error, whether malicious or unintentional, including technological failures and terrorist acts.</p></td> </tr> <tr> <td><strong>Emergency</strong></td> <td>A present or imminent event that requires prompt coordination of actions concerning persons or property to protect the health, safety or welfare of people, or to limit damage to property or the environment.</td> </tr> <tr> <td><strong>Emergency Management</strong></td> <td>The management of emergencies concerning all-hazards, including all activities and risk management measures related to prevention and mitigation, preparedness, response and recovery.</td> </tr> <tr> <td><strong>Frequency</strong></td> <td>The number of occurrences of an event in a defined period of time.</td> </tr> <tr> <td><strong>Hazard</strong></td> <td>A potentially damaging physical event, phenomenon or human activity that may cause the loss of life or injury, property damage, social and economic disruption or environmental degradation.</td> </tr> <tr> <td><strong>Hazard Analysis</strong></td> <td><em>To be defined.</em></td> </tr> <tr> <td><strong>Hazard Identification</strong></td> <td><p>The process of identifying, characterizing and validating hazards.</p> <p><strong>Note:</strong> Hazard identification looks at the type, the properties and the potential effects of hazards and is part of hazard assessment.</p></td> </tr> <tr> <td><strong>Likelihood</strong></td> <td>The chance of an event or an incident happening, whether defined, measured or determined objectively or subjectively.</td> </tr> <tr> <td><strong>Mitigation </strong></td> <td><p>Actions taken to reduce the impact of disasters in order to protect lives, property and the environment, and to reduce economic disruption.</p> <p><strong>Note:</strong> Mitigation includes structural mitigative measures (e.g. construction of floodways and dykes) and non-structural mitigative measures (e.g. building codes, land-use planning and insurance incentives). Prevention and mitigation may be considered independently or one may include the other.</p></td> </tr> <tr> <td><strong>Natural Hazards</strong></td> <td><p>A source of potential harm originating from a meteorological, environmental, geological or biological event.</p> <p><strong>Note:</strong> Examples of natural hazards include tornadoes, floods, glacial melt, extreme weather, forest and urban fires, earthquakes, insect infestations, infectious diseases</p></td> </tr> <tr> <td><strong>Probability</strong></td> <td>In statistics, a measure of the chance of an event or an incident happening.</td> </tr> <tr> <td><strong>Qualitative Assessment</strong></td> <td><p>A risk assessment method that assigns non-statistical values to risks.</p> <p><strong>Note:</strong> A qualitative assessment produces narrative, descriptive or comparative information about risks. It can be based on limited information, numerically incomparable data or complex non-linear relationships.</p></td> </tr> <tr> <td><strong>Quantitative Assessment</strong></td> <td>A risk assessment method that assigns statistical values to risks.</td> </tr> <tr> <td><strong>Residual Risk</strong></td> <td>Risk that remains after implementing risk mitigation measures.</td> </tr> <tr> <td><strong>Resilience</strong></td> <td><p>The capacity of a system, community or society to adapt to disruptions resulting from hazards by persevering, recuperating or changing to reach and maintain an acceptable level of functioning.</p> <p><strong>Note:</strong> Resilience is built through a process of empowering citizens, responders, organizations, communities, governments, systems and society to share the responsibility to keep hazards from becoming disasters.</p></td> </tr> <tr> <td><strong>Risk </strong></td> <td>The combination of the likelihood and the consequence of a specified hazard being realized; refers to the vulnerability, proximity or exposure to hazards, which affects the likelihood of adverse impact.</td> </tr> <tr> <td><strong>Risk Analysis</strong></td> <td><p>A process to comprehend the nature of a risk and to determine its level.</p> <p><strong>Note:</strong> Risk Analysis provides the basis for Risk Evaluation and decisions about Risk Treatment.</p></td> </tr> <tr> <td><strong>Risk Assessment</strong></td> <td>The overall process of Risk Identification, Risk Analysis and Risk Evaluation.</td> </tr> <tr> <td><strong>Risk Avoidance</strong></td> <td>An informed decision to avert or to withdraw from, an activity in order not to be exposed to a particular risk.</td> </tr> <tr> <td><strong>Risk Communication</strong></td> <td><p>The imparting, exchanging and/or receiving of clear, credible and timely information about the existence, nature, form, likelihood, severity, acceptability, treatment or other aspects of risk to improve decision-making in risk management.</p> <p><strong>Note:</strong> Risk communication is carried out among public authorities, risk assessors, risk managers, the public and all other interested parties. It is intended to achieve a better understanding of risks and risk management.</p></td> </tr> <tr> <td><strong>Risk Identification</strong></td> <td>The process of finding, recognizing and recording risks.</td> </tr> <tr> <td><strong>Risk Management</strong></td> <td>The use of policies, practices and resources to analyze, assess and control risks to health, safety, environment and the economy.</td> </tr> <tr> <td><strong>Risk Perception</strong></td> <td><p>A stakeholder's view on a risk.</p> <p><strong>Note:</strong> Risk perception reflects the stakeholder's needs, issues, knowledge, beliefs and values.</p></td> </tr> <tr> <td><strong>Risk Profile </strong></td> <td>A description of an entity's existing management practices, common vulnerabilities, tolerance and key interdependencies concerning its particular risks, as well as an assessment of their relative likelihood, consequences and priority.</td> </tr> <tr> <td><strong>Risk Register </strong></td> <td><p>A register that contains a list of identified risks and related information used to facilitate the monitoring and management of risks.</p> <p><strong>Note:</strong> The risk register is generally in the form of a table, spreadsheet or database and may contain the following information: statement or description of the risk, source of risk, areas of impact, cause of the risk, status or action of sector network, existing controls, risk assessment information and any other relevant information.</p></td> </tr> <tr> <td><strong>Risk Taxonomy</strong></td> <td>A comprehensive and common set of risk categories that is used within an organization.</td> </tr> <tr> <td><strong>Risk Tolerance</strong></td> <td><p>The willingness of an organization to accept or reject a given level of residual risk. </p> <p><strong>Note:</strong> Risk tolerance may differ across an organization, but must be clearly understood by those making risk-related decisions.</p></td> </tr> <tr> <td><strong>Threat </strong></td> <td><p>The presence of a hazard and an exposure pathway.</p> <p><strong>Note:</strong> A threat may be natural or human-induced, accidental or intentional.</p></td> </tr> <tr> <td><strong>Threat Assessment</strong></td> <td>A process consisting of the identification, analysis and evaluation of threats.</td> </tr> <tr> <td><strong>Vulnerability</strong></td> <td><p>A condition or set of conditions determined by physical, social, economic and environmental factors or processes that increases the susceptibility of a community to the impact of hazards.</p> <p> <strong>Note:</strong> Vulnerability is a measure of how well prepared and equipped a community is to minimize the impact of or cope with hazards.</p></td> </tr> <tr> <td><strong>Vulnerability Assessment</strong></td> <td>The process of identifying and evaluating vulnerabilities, describing all protective measures in place to reduce them and estimating the likelihood of consequences. </td> </tr> </table> <div class="wb-fnote" role="note"> <section> <h2 id="footnotes">Footnotes</h2> <ol class="list-unstyled"> <li id="fn01"><a href="#fn01-rf" class="fn-lnk pull-left">1</a> According to the Federal Emergency Response Plan (FERP 2011), a Primary Department is a federal government institution with a mandate related to a key element of an emergency. Several federal government institutions may be designated as primary departments, depending on the nature of the emergency. A supporting department is a federal government institution that provides general or specialized assistance to a primary department in response to an emergency. PS is the federal coordinating department based on the legislated responsibility of the Minister of Public Safety under the EMA. As such, PS is responsible for engaging relevant federal government institutions.</li> <li id="fn02"><a href="#fn02-rf" class="fn-lnk pull-left">2</a> This section presents information at a high-level since subsequent sections provide detailed information on likelihood and impact assessments.</li> <li id="fn03"><a href="#fn03-rf" class="fn-lnk pull-left">3</a> In statistics, a proxy variable is something that might not in itself be of interest, but can represent a 'condition' for which there is no existing data.</li> <li id="fn04"><a href="#fn04-rf" class="fn-lnk pull-left">4</a> In the case of production sectors, losses must be assessed at producer prices because they represent the value of what was not produced as a result of the disaster. In the case of interrupted service production (days or months of classes, the number of medical consultations, increased transportation costs due to detours, etc.), the most suitable approach is to value services not generated as a result of the event based on the prices or fares paid by the final consumer or end user.</li> <li id="fn05"><a href="#fn05-rf" class="fn-lnk pull-left">5</a> For instance, indirect losses could also include the loss of income resulting from the non-provision of goods and services or from the destruction of previously used means of production. However, these are difficult to adequately quantify.</li> <li id="fn06"><a href="#fn06-rf" class="fn-lnk pull-left">6</a> Adapted from: Glossary of Environment Statistics, Studies in Methods, Series F. No.67, United Nations, New York, 1997.</li> <li id="fn07"><a href="#fn07-rf" class="fn-lnk pull-left">7</a> In January 2011, PS initiated a project to standardize terminology used for emergency management, in partnership with terminologists from the Translation Bureau, Public Works and Government Services Canada (PWGSC). An EM vocabulary working group was created, to provide a departmental forum for standardization of key terms and their definitions in emergency management. Over 230 bilingual EM terms and associated definitions were standardized through the publication of the Emergency Management Vocabulary whose contents is accessible in <em>TERMIUM Plus</em> (<a href="http://btb.termiumplus.gc.ca/tpv2alpha/alpha-eng.html?lang=eng">http://btb.termiumplus.gc.ca/tpv2alpha/alpha-eng.html?lang=eng</a>). Only risk-related terms and definitions from this project are provided in the current annex.</li> </ol> </section> </div> <div class="clearfix"></div> <dl id="wb-dtmd"> <dt>Date modified: </dt> <dd><time property="dateModified">2016-01-19</time></dd> </dl> </main>  <footer role="contentinfo" id="wb-info" class="visible-sm visible-md visible-lg wb-navcurr"> <div class="container"> <nav role="navigation"> <h2>About this site</h2> <ul id="gc-tctr" class="list-inline"> <li><a rel="license" href="https://www.publicsafety.gc.ca/cnt/ntcs/trms-en.aspx">Terms and conditions</a></li> <li><a href="https://www.publicsafety.gc.ca/cnt/trnsprnc/index-en.aspx">Transparency</a></li> </ul> <div class="row"> <section class="col-sm-3"> <h3>About us</h3> <ul class="list-unstyled"> <li><a href="/cnt/bt/mnstr-en.aspx#mn">Our Ministers</a></li> <li><a href="/cnt/bt/mnstr-en.aspx#ps">Parliamentary Secretaries</a></li> <li><a href="/cnt/bt/dpt-mnstr-en.aspx">Deputy Minister</a></li> <li><a href="/cnt/rsrcs/pblctns/index-en.aspx?t=dprtmntl">Departmental reports</a></li> <li><a href="/cnt/bt/index-en.aspx">About Us – More</a></li> </ul> </section> <section class="col-sm-3"> <h3>News</h3> <ul class="list-unstyled"> <li><a href="/cnt/nws/nws-rlss/index-en.aspx">News Releases</a></li> <li><a href="/cnt/nws/pht-gllr/index-en.aspx">Multimedia gallery</a></li> <li><a href="/cnt/nws/spchs/index-en.aspx">Speeches</a></li> <li><a href="/cnt/nws/index-en.aspx">News – More</a></li> </ul> </section> <section class="col-sm-3"> <h3>Contact Us</h3> <ul class="list-unstyled"> <li><a href="/cnt/nws/md-cntctcs-en.aspx">Media</a></li> <li><a href="/cnt/bt/crrs/index-en.aspx">Careers</a></li> <li><a href="/cnt/bt/cntct-en.aspx">Contact Us – More</a></li> </ul> </section> <section class="col-sm-3"> <h3>Stay Connected</h3> <ul class="list-unstyled"> <li><a href="/cnt/sty-cnnctd/index-en.aspx#fcbk">Facebook</a></li> <li><a href="/cnt/sty-cnnctd/index-en.aspx#twttr">Twitter</a></li> <li><a href="/cnt/sty-cnnctd/index-en.aspx#tyb">YouTube</a></li> <li><a href="/cnt/sty-cnnctd/index-en.aspx#rss">RSS</a></li> <li><a href="/cnt/sty-cnnctd/index-en.aspx">Stay Connected – More</a></li> </ul> </section> </div> </nav> </div> <div id="gc-info"> <div class="container"> <nav role="navigation"> <h2>Government of Canada footer</h2> <ul class="list-inline"> <li><a href="http://healthycanadians.gc.ca"><span>Health</span></a></li> <li><a href="http://travel.gc.ca"><span>Travel</span></a></li> <li><a href="http://www.servicecanada.gc.ca/eng/home.shtml"><span>Service Canada</span></a></li> <li><a href="http://www.jobbank.gc.ca"><span>Jobs</span></a></li> <li><a href="http://www.budget.gc.ca/"><span>Economy</span></a></li> <li id="canada-ca"><a href="http://www.canada.ca/en/index.html">Canada.ca</a></li> </ul> </nav> </div> </div> </footer>    <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script> <script src="/dist/js/wet-boew.min.js"></script>     <script type="text/javascript">_satellite.pageBottom();</script>  <script src="/dist/Invitation-manager/Overlay.js"></script> <script src="/dist/Invitation-manager/InvitationManager.js"></script> </body> </html>

CINXE.COM

Archived - All Hazards Risk Assessment Methodology Guidelines 2011-2012