Risk Assessment and Risk Planning

Our inquiry has come at a critical time. Nearly two years have passed since the COVID-19 pandemic emerged, placing a spotlight on the Government’s planning for the most serious risks facing the UK or its interests overseas. The pandemic has led to unprecedented levels of uncertainty and shock across the world with many countries struggling to respond to the virus. Prior to the onset of COVID-19, the UK’s approach to risk assessment and risk management was internationally commended and viewed as rigorous. However, the pandemic has exposed the UK’s risk management system as deficient and too inflexible to provide the protection our nation needs.

The risks we face are changing. Technological advances have raised the threat posed by the malicious deployment of technologies which could be used for good or ill, while traditional threats such as those from nuclear or chemical warfare remain. The risk of the failure of ageing critical infrastructure such as nuclear power stations, dams and bridges grows day on day without sufficient intervention. A reliance on electricity and the internet and the increasing complexity and interdependence of the networks underpinning daily life have left us vulnerable to cascading failures which could proliferate rapidly and cause widespread devastation. The UK’s risk management system must adapt to ensure that we are prepared for the evolving extreme and systemic risks on the horizon to protect us today and into the future.

Many inquiries are seeking to document the Government’s actions on COVID-19. Yet, a pandemic is only one of many risks, a fact which was clearly demonstrated to us over the course of this inquiry. It is inevitable that an inquiry of this nature would be overtaken by risks arising since the conclusion of our evidence gathering programme. Through the summer of 2021, and since, the UK has faced severe supply chain disruption and threats to the nation’s fuel supply. This has raised concerns about the fragility of the just-in-time networks on which our food, fuel and essential services rely. The fall of Afghanistan to the Taliban has raised alarm about the security of the region and heightened the threat of global terrorism. Risks will continue to materialise which require action, prevention, mitigation or response. The Government must be able to identify lessons from all crises quickly and ensure it can translate them into real change. The current pandemic offers a unique opportunity to take stock of the UK’s risk assessment and risk management process. We must assess and strengthen our national resilience to ensure that we are better prepared for the next crises.

Our inquiry has concluded that the UK must be better at anticipating, preparing for and responding to a range of challenging scenarios, including those which it has never experienced before. The Government’s current strategy of centralised and opaque risk assessment and risk management, which fails to make adequate preparations, has left the UK vulnerable.

The UK must adopt a whole of society approach to resilience, one which emphasises the important role played by all sections of society in preparing for, adapting to and recovering from the effects of risk. Risk and resilience are not solely the concern of central Government policymakers; they have the capacity to alter the lives of millions. The Government must ensure it properly accounts for and involves all elements of society in its risk assessment and planning. Our recommendations are aimed at ensuring this.

The COVID-19 pandemic has shown that communities can step up and help ensure national safety. The Government must see our people as an essential building block of any response and as active participants in creating resilience. They must provide them with the support and information to help them prepare for the risks they face. Volunteering represents a key opportunity to involve the public in risk management and response. The UK has a strong voluntary sector which must form the foundation of any future reservist force used in times of crisis.

Risk assessment and risk planning are a routine undertaking in the private sector. Conversations between business and industry and the Government must be held to ensure that business and industry understand what impacts they may expect to incur from the manifestation of a risk or how they may be expected to act in response. Such conversations would allow the Government to understand and learn from business and industry. Conversations of this type do occur, but currently they are ad hoc and insufficient. We urge the Government to undertake more structured and open engagement with business and industry on risk and resilience.

Our inquiry has raised significant concerns about the Government’s culture and practice of risk assessment and planning. The current risk management system is veiled in an unacceptable and unnecessary level of secrecy. The UK’s risk plans need to be shared widely to maximise their efficacy. Only through transparency and a healthy culture of challenge can we provide society with a reliable foundation to respond to emerging risks. While secrecy does have an important place, the UK Government defaults to secrecy too readily. This has hampered our preparedness, as society’s front-line responders, including Local Resilience Forums, local government, volunteer groups and businesses and industry all struggle to access the information they need. Fear of criticism can drive an unnecessary reliance on secrecy. Our recommendations aim to bring transparency into the risk assessment process and to build better preparedness as a result.

We found that the Government’s risk assessment process is unable to encompass the complexity of risks facing the UK. It fails to account for interconnected or cascading risks and chronic or long-term risks, and has a bias against low likelihood-high impact risks. As a list of risks facing the UK, it is insufficient to aid mitigation and preparedness efforts. The present approach of assessing likelihood and impact may be misleading, and lead to a false sense of confidence, particularly in terms of prioritisation of risks. The Government’s risk assessment must be replaced by a more dynamic, data driven output, directly linked to preparation, mitigation and response.

No matter how sophisticated the assessment of risks, it is of little value if it is not matched by practical measures to ensure preparedness and resilience. The Government must not only anticipate risks but prepare for and respond to them effectively. Much of the Government’s time and resources are focused on responding to crises and emergencies, from flooding to terrorist attacks. They must bridge the gap between analysis and operational capability to ensure the safety and security of the population. We must place a premium on possessing the competence, capacity and skills to manage these crises. Risk plans must be frequently tested, challenged and scrutinised.

Preparation, mitigation and response plans must be scrutinised, and planners must be accountable both within Government and to Parliament, creating a system of audit which is appropriately resourced. We have proposed changes to ensure a clear governance structure and sustained, independent pressure and annual audit. Risk plans should be dynamic, resourced and every stakeholder involved should know what the mitigation process requires.

Despite the fact that prevention is significantly cheaper than response, the government has a traditional disincentive to invest against possible risks, especially low-probability high-impact risks. Spending policy for risk and resilience needs to be readdressed. Within the national security and critical national infrastructure communities there is a strong emphasis on prevention, leading to proactive resourcing. We urge the Government to ensure that spending in the civic sphere emulates this approach. Government spending should, where possible, be directed towards preparing for, preventing and mitigating disaster.

The Government will not succeed in anticipating every threat or hazard. For that reason, the country needs to be prepared to recover from shocks to which it is vulnerable. That capacity to recover must be based on a flexible, adaptable and diverse population that appreciates the need for its own resilience.