Improved Risk Assessment Approach

3.1 The Welsh Government acknowledges the importance of robust risk evidence and management to support the prioritisation of emergency preparedness and response capabilities.

3.2 Our understanding of civil contingencies risks in Wales, whether from natural hazards and public health emergencies to major accidents and malicious threats (including those from terrorism, cyber attacks or adversary state-sponsored activity) has improved considerably in recent years.

3.3 Partly in response to lessons emerging from the pandemic, the Welsh Cabinet commissioned officials in 2023 to develop a tailor-made risk register for Wales, moving away from a reliance on the National Security Risk Assessment to creating a bespoke risk register, which addresses the specific characteristics and challenges unique to Wales.

3.4 Over the last two years, work has been undertaken on creating a suite of risk evidence documents to provide an improved risk evidence base for Welsh responders and the Welsh Government. This Wales-specific evidence base provides:

• Higher quality information to raise awareness and collective understanding of short, medium and long-term civil protection risks and to inform emergency preparedness and response and recovery capability building work.

• Identification and assessment of concurrent risks to help inform preparedness and consequence management planning.

• An assessment of preparedness of each of the four Local Resilience Forums in Wales against the common consequences that could arise should any given risk materialise in future, and specific preparedness assessments against each system-wide disruptive challenge identified in the UK National Security Risk Assessment. This preparedness element of the risk register is unique in terms of national risk assessments in the UK and contributes to the development of our capabilities programme.

• Help to inform the Welsh Government’s risk management and preparedness work while complementing emergency responders’ work at the local level by supporting them in fulfilling their statutory risk assessment and emergency planning obligations.

3.5 The bespoke risk register draws upon the National Security Risk Assessment data but working directly with Wales’s four Local Resilience Forums has enabled us to better account for the impact of the full range of risks on different communities across Wales, as well as Welsh specific risks, not covered in the National Security Risk Assessment. The methodology was endorsed by the Wales Resilience Forum in December 2023 following close consultation with the Local Resilience Forums. The Emergency Planning College have independently assessed the register, stating the risk assessment process is ‘robust’, and the preparedness methodology is ‘logical and pragmatic’, which delivers ‘good and leading practice.’

3.6 This is the first version of the Welsh risk register and to ensure it remains a robust and dynamic process, it will require ongoing review and updates to reflect the ever-changing risk landscape. We will continue to work with the UK Government in the development of risk assessment processes for the UK National Security

Risk Assessment to ensure our risk register can continue to draw upon it in the future and ensure continued consistency.

3.7 The Welsh Government’s new risk assessment products have been designed specifically to complement Wales’ Local Resilience Forums Risk Group outputs, including Category 1 responder statutory requirements to update and maintain Community Risk Registers, while supporting and informing the work of the Welsh Government’s Risk and Preparedness Committee.

3.8 An external public summary of the Wales Risk Register will be published in early 2025.

The Scottish Government accepts this recommendation. We will continue to work with the UK Government and devolved governments on improving the approach to risk assessment across the UK. We are reviewing how we can optimise use of the UK-wide risk assessment and improve our process for taking into account Scotland’s circumstances and characteristics, including the impact that risks may have on the most vulnerable in our society.

We support all four nations of the UK working together to ensure a joined up and continually improving risk assessment approach.

We have well-established and positive working relationships with the UK Government and devolved governments and acknowledge the ongoing development of the UK-wide risk assessment, the National Security Risk Assessment (NSRA), led by the UK Government. We have seen substantial steps taken to address several of the methodological points suggested in this recommendation. For example, the NSRA 2022 (and the dynamic NSRAs from 2023 onwards) include multiple risk scenarios to assess risks where different planning and/or response may be required; the introduction of the ‘Linked Risks’ section in first cycle of the dynamic NSRA which identifies risks which cause or increase the likelihood of another risk manifesting; and the UK Government development of a Chronic Risks Assessment (shared with the Scottish Government) to identify and assess longer term challenges facing the UK and designed to be used in conjunction with the NSRA.

We are committed to being involved in the ongoing review and development of the NSRA methodology as was the case in our contribution to the 2020-2021 House of Lords Risk Assessment Inquiry and the Royal Academy of Engineering review of the NSRA methodology, commissioned by the UK Government in January 2021.

We consider the NSRA to be a comprehensive, evidence-led assessment of potential risks to inform planning and preparation within Scotland. We are reviewing how we can optimise use of the NSRA (and supporting tools), as well as improve our process for taking into account Scotland’s circumstances and characteristics, through the establishment of a short life working group comprising internal and external stakeholders.

Since 2018, we have produced a Scottish Risk Assessment (SRA) every two to three years, designed to supplement the NSRA with Scotland specific information and analysis where this adds value.

SRAs have been produced in collaboration with a wide range of partners from within the Scottish Government and across the wider resilience community. The Scottish Government policy teams or national agencies lead on the development and assessment of individual scenarios which fall within their remit, as they have the expertise and links to subject-matter experts. They develop appropriate scenarios and assess the risk using the SRA methodology. Consideration is given by the SRA risk authors to the potential impacts on vulnerable people and communities the risks may have, should they occur. These individual risk assessments then go through a process of challenge, such as the series of challenge workshops held for SRA 2023.

We acknowledge there is always room for improvement. Having produced three iterations of the SRA, the short life working group (as referenced earlier) will include examining alternatives to the approach the Scottish Government takes to assessing civil contingencies risks.

Our improvement work will also explore how the Scottish Government work to understand longer term trends that might affect Scotland over a 10-to-20-year timeframe can be incorporated into civil contingencies risk assessment, as detailed further in our response to Recommendation Nine.

To assist us with our improvements, we have hosted a UK Research and Innovation policy fellowship undertaking a critical appraisal of how risk assessment information is used in informing civil contingencies activities across the Scottish Government. Initial findings will be available in early 2025.

We have also already sought independent advice regarding pandemic risks. In August 2021, we established the Standing Committee on Pandemic Preparedness (SCoPP) as an independent advisory group to advise us on the future risks from pandemics. SCoPP published its interim report in 2022 and its final report in November 2024, which recommended actions to identify and secure the effective use of data for pandemics, including consideration of integration with UK data initiatives. The Scottish Government has accepted the SCoPP recommendations in principle and is working with partners to deliver those.

We aim to complete our review and implementation of improvements in incremental stages with overall completion by the end of 2025.

We acknowledge the importance of robust risk management and accept the recommendation to enhance planning through the development of multiple risk scenarios. We, as an Executive, are engaged with the programme of work that is ongoing to improve catastrophic risk planning.

Following publication of the “Building Resilience Together” Framework, development of a comprehensive NI Civil Contingencies Risk Register commenced. This was led by TEO, and numerous workshops were conducted with key stakeholders to assess the risks. As a result, since the Covid-19 pandemic, the Executive has shifted from reliance on the National Security Risk Assessment (NSRA) to creating a bespoke risk register that addresses challenges unique to Northern Ireland, such as supply chain vulnerabilities and capability gaps. A NI Civil Contingencies Risk Register (NICCRR) was approved by CCG(NI) at its meeting in June 2022. The NICCRR is now in place and continues to evolve as further risks are identified or when there are changes to the current risks, mitigations or capabilities.

Furthermore, the 2023 NICCRR was developed through extensive engagement with Cabinet Office, emergency management groups and first responders, and aligns with UK-wide methodologies while focusing on NI-specific risks.

In February 2024, the Executive was briefed on the development of the NICCRR. The Risk Register follows a methodology which allocates an impact and likelihood assessment to 44 identified risks. Lead Government Departments have been identified for these risks.

Review of our approach to risk management in NI continues. In March 2025, we will launch Stage 4 of the review to map additional risk scenarios and explore the scale of impacts from worst- to least-case scenarios to enable better prioritisation. This will continue alongside advice that will issue to the NICS Board and NI Executive on oversight arrangements and a review of the civil contingencies structure in NI in 2025.

Work is also underway to produce public facing material to assist individuals and communities understand risks and prepare and respond to crises.

This work reflects our commitment to continuous improvement in risk management and preparedness.

The government agrees with the need to continually improve its approach to risk assessment as the basis for the entire system of preparedness and resilience.

The government’s principal framework for risk assessment is the National Security Risk Assessment (NSRA). The NSRA is a classified assessment of the most significant risks to the UK over the medium term (next two to five years). It is used as a tool for planning by government departments and Local Resilience Forums. The Inquiry recognised that significant changes have been made to the NSRA following the pandemic, including in response to an external review by the Royal Academy of Engineering in 2021. Most significantly, the NSRA has moved to a dynamic assessment process, with risks updated several times a year in response to changes to the risk landscape or new evidence. The government also published the most transparent public-facing version of the NSRA, the National Risk Register (NRR), in August 2023. The NRR provided more information from the NSRA than ever before, containing information for risk practitioners, academics, and private and voluntary sector organisations who might benefit from this information but who do not have access to the classified NSRA. This information provided by the government enables them to assess how the risks might affect their organisations and interests, and to carry out resilience planning.

The government agrees that risk assessment and planning should not be based in isolation on a single reasonable worst-case scenario. Cabinet Office guidance mandates departments to generate multiple and varied scenarios when assessing the impact of risks. Where different manifestations of risks may require significantly different planning or response requirements, these are presented separately in the NSRA. To go further, the government will reference variations and additional scenarios more prominently in future updates to the NSRA, considering where these could be tested through national exercises. The government believes that a plausible yet challenging reasonable worst-case scenario is the appropriate benchmark for developing generic response capabilities, which can be deployed for any type or number of risks, although departments consider many variations of scenarios at the planning stage.

The UK government continues to work closely with the devolved governments to collectively strengthen approaches to risk assessment across the UK. All NSRA data is shared across the four nations, and devolved governments are involved in methodology reviews.

The NSRA is supported by more detailed risk assessments produced by government departments and agencies, which cover the range of each kind of risk in more granular detail. For example, the UKHSA Health Security Risk Assessment (HSRA) is using an adapted version of the NSRA methodology to explore a greater variety of health hazards, with multiple different planning assumptions, including mitigated scenarios.

The government agrees that it is important to consider prevention and mitigation of an emergency as part of risk assessment. It will make changes to the NSRA over the course of 2025 to present the assumptions that underpin risk assessments more explicitly and consistently in future versions by strengthening departmental guidance and factoring this into the scenarios.

The government recognises that multiple risks can compound and/or cascade, amplifying their individual and collective impacts. In 2023, the Cabinet Office included an analysis of linked risks in the NSRA. These are risks that may cause or increase the likelihood of another, or risks that would have significantly greater impacts if they manifested concurrently. The government is developing a “digital NSRA” platform to visualise how risks interconnect. This is already in use by ministers and senior officials to support planning and preparation for civil contingencies, and will be rolled out more widely to departments over the course of 2025 and 2026.

The government agrees that assessing the impact of risks on vulnerable groups is critical to improving the resilience of the whole of society. The NSRA methodology includes a specific impact category on vulnerable people. The Cabinet Office issued new guidance to departments in October 2024 to improve consideration of the disproportionate impacts risks may have on different groups across a full spectrum of vulnerability. In 2025 the Cabinet Office will also work with the NSRA expert group on vulnerable people to consider further ways to improve the quality of assessment in this area.

The government has also strengthened its approach to the assessment of long-term risks. The government has established a new process for identifying and assessing more continuous and enduring challenges - chronic risks - that erode elements of our economy, society, way of life and/or national security, in recognition of their different planning, preparation and response requirements compared to acute risks in the NSRA. Examples include antimicrobial resistance, climate change and serious and organised crime. This complements the government’s assessments of acute risks identified and assessed through the NSRA and NRR. This work has been developed in consultation with government departments, Chief Scientific Advisors, external academics and experts. A number of key chronic risks have been identified and assessed and this work will support the government to enhance a shared view of the longer-term challenges facing the UK. This classified assessment has now been shared across government, helping departments to consider interactions between acute and chronic risks, to be updated as new evidence emerges. A public-facing version will be published soon.

The government agrees that risk assessment must be connected to strategy and planning. It will implement, by 2026, the further recommendation from the Royal Academy of Engineering’s 2021 NSRA methodology report to pilot an alternative approach to risk assessment that considers preparedness for risks, rather than on the likelihood of risks occurring.

The Scottish Government has completed its review and is well underway with developing the next iteration of the Scottish Risk Assessment (SRA), scheduled for late 2027. The updated SRA will contain all risks relevant to Scotland in a single document, moving away from using both the UK Government’s National Security Risk Assessment and the SRA as a supplementary document.

In line with the Chair’s recommendation, Scottish Government officials have set up a Scottish Risk Assessment Group (SRAG), comprising of responders, subject matter experts, and policy officials, to review risks and adapt them for Scotland where required. The SRAG will consider how specific risks can make people vulnerable, assisting planners in improving their approach to vulnerability in emergency planning. This approach will ensure that risk assessment is tailored to the Scottish context and takes into account additional risks which are specific to Scotland.

This recommendation, alongside work already undertaken, was considered as part of the Scottish Government’s response to the Inquiry’s Module 2 Report (Recommendations 8), published 17 March 2026.

The Scottish Government wrote to the inquiry chair on 18 May 2026 to confirm that this recommendation has been delivered and closed.

Status: CLOSED Introduction We remain committed to robust risk management and, as an Executive, we are actively engaged in the ongoing programme of work to enhance catastrophic risk planning. Progress update Risk identification, assessment and mapping remain at the core of NI civil contingencies risk management strategy in recognition of the importance of the Anticipate and Prepare stages of emergency planning. Progress has been made to review the risk landscape and communicate the key findings. In September 2025, the Civil Contingencies Risk Register underwent a dynamic review where relevant risks were presented to cross-government expert panels to conduct a critical analysis of the Reasonable Worst Case Scenario and risk scores. These assurance reviews resulted in amendments to the Risk Register which were presented to the Lead Government Departments for consideration and ultimately accepted. A summary paper was presented to the Civil Contingencies Group (NI) (CCG (NI)) in November 2025 and a proposal to initiate a Northern Ireland Catastrophic Impact Programme (CIP) Task and Finish Group to scrutinise the highest scoring or ‘whole-system’ risks was accepted by CCG (NI). Whilst the majority of risk assessment activities operate at an official level, we recognise the importance of transparency and effective public communication. The Northern Ireland specific results of the 2025 UK Public Survey of Risk Perception, Resilience and Preparedness were analysed from the UK Public Survey of Risk Perception, Resilience and Preparedness 2025. To address initial findings and assist the NI public, a new ‘Be Ready for emergencies’ page was added to the NI Direct Home screen. Executive departments proactively engage in the Reasonable Worst-Case Scenario (RWCS) Exercises led by TEO that have helped inform a review of the NI Civil Contingency Risk Register.

We continue to work closely with the UK and devolved governments to collectively strengthen approaches to risk assessment across the UK and support developments in risk methodologies. This includes liaising with the UK government on its development of the classified UK National Security Risk Assessment to ensure a consistent approach to risk assessment across the UK.

We continue to work with organisations in Wales, via the Wales Resilience Partnership, to share best practice in relation to assessing the impacts of risks on people with vulnerabilities and specific needs. A part of the work programme is to explore pan-Wales approaches to consistently integrate the assessment of the impact of risks on vulnerable people and those with specific needs into local and national risk methodologies. To support this work programme, we are drawing on developments at the UK-level regarding improvements to risk assessment.

Working through our partnership arrangements, we are looking at ways to use data and information to help partners identify vulnerable and at-risk groups to ensure more specific and tailored support can be prioritised during any incident to those people who may need it the most.

A dedicated team within the Welsh Government is working to enhance the JIGSO data platform. JIGSO, which is hosted on DataMapWales, is currently used during emergency responses and to support planning for emergencies. Whilst most of the data is openly published for everyone to use, JIGSO enables restricted and secure access for the sharing of more sensitive data using the Priority Services Register from Dwr Cymru. This enables the secure sharing of data about ‘at risk’ properties with the resilience community and emergency services across Wales to prioritise resources to those that need it most. The improvements to JIGSO will enable faster and more comprehensive data access for responders, supporting effective multi-agency coordination during emergencies. We are working with utility companies to expand the data available on vulnerable people, including more detailed information about the reasons households may be classed as vulnerable. We are also engaging with local resilience forums to promote JIGSO, to train users, and ensure the system meets the needs of first responders.

The National Security Risk Assessment (NSRA) is the UK government’s assessment of the most significant risks to the UK. Since publishing the Resilience Action plan in July 2025, we have completed steps to further strengthen our approach to risk assessment, especially in relation to improving understanding the potential impact on vulnerable people. This includes the development of new guidance for lead government departments to strengthen their assessment of the disproportionate impact of risks on vulnerable people, the commencement of the NSRA methodology review and securing experts to establish the final two NSRA Expert Advisory Programme panels.

The government has begun a review of the NSRA methodology. This will examine how risk variations and additional scenarios can be referenced more prominently. We expect the methodology review to conclude in spring/summer 2026 with the updated methodology implemented in 2027. The NSRA will remain the primary basis for prioritisation of preparedness work, informing the planning of large-scale exercises under the National Exercising Programme.

The NSRA Expert Advisory Programme is a key mechanism to challenge the assumptions that underpin risk assessments. These groups meet regularly to review risks during the NSRA update cycles and will be meeting again in the coming months. Further detail on the NSRA Expert Advisory Programme can be found under recommendation 9.

The Risk and Insight Navigator (RaIN) contains the digital version of the NSRA which visualises risk information and allows interconnections to be analysed. Development of RaIN is ongoing, with work underway to onboard risk-owning lead government departments during the first half of 2026. This will enable NSRA data collection and processing to be done via RaIN.

The Cabinet Office has worked with the Government Office for Science’s (GO-Science) Social and Behavioural Science for Emergencies working group to improve the identification and assessment of disproportionate impacts of emergencies to Vulnerable People in the NSRA. This guidance was issued to lead government departments in November 2025. Work is underway to review the NSRA methodology to deliver a more effective assessment of vulnerability during crises making it more accessible to policy-makers and operational leaders undertaking planning and preparedness activities. We expect this work to conclude in summer 2026, with changes implemented in 2027. The updated assessment on vulnerability will inform the indicators for those risks on the Risk Vulnerability Tool. The Risk Vulnerability Tool allows for rapid UK-wide analysis and understanding of disproportionate impacts of societal vulnerabilities, before and during crises.

Work with the Royal Academy of Engineering on the pilot of an alternative approach to risk assessment is ongoing, and we are on track to deliver this in 2026. The Royal Academy of Engineering has now established a working group, which had its first meeting in October 2025, and is working with Cabinet Office and government departments to look at a number of risks by way of case studies.

Implementation update for recommendation 3 - better approach to risk assessment (updated June 2025)

11. The National Security Risk Assessment (NSRA) is the UK government’s single, authoritative articulation of the most serious acute risks facing the UK and its interests overseas. In recent years, to keep pace with the rapidly changing global risk landscape, extensive reforms have been made to the NSRA. However, the scale of the challenges means we must go further. The Resilience Action Plan sets out how we plan to expand our approach, to: understand drivers and risk interdependencies; increase sharing of our risk data to help policymakers understand and plan for different scenarios; and refocus our assessments on the underlying factors that make some people vulnerable to emergencies. This represents a further fundamental step change in our approach to risk assessment.

12. The Cabinet Office published an updated version of the National Risk Register (NRR), the public-facing version of the NSRA, in January 2025. For the first time, the NRR aligns with our new dynamic assessment model, enabling more frequent risk evaluations to better respond to our rapidly changing security landscape.

13. Risks are identified for inclusion in the NSRA by consulting a wide range of experts from across UK government departments, the devolved governments, the government scientific community and outside of government.

14. Updates on specific commitments made in the government response include:

a. In late 2025, the government will begin a review of the NSRA methodology. This will examine how risk variations and additional scenarios can be referenced more prominently – over and above the guidance already issued to departments. In the dynamic NSRA model, if there is a change to a risk, for example if the impact increases substantially following a risk update, it will be identified as a priority area for exercising through the National Exercising Programme.

b. To more explicitly challenge the assumptions that underpin risk assessments, the government has established the NSRA Expert Advisory Programme. During the latest cycle of updates to the NSRA earlier this year, expert groups provided insights and recommendations across key impact dimensions, including human welfare, behavioural science, security, and essential services. Building on this, economics experts and vulnerable people experts have been secured to provide constructive challenge for risks in the next NSRA cycle, which launched in June 2025.

c. Development of the Risk and Insight Navigator (RaIN) continues in the Cabinet Office. This contains the digital version of the NSRA which visualises risk information and allows interconnections to be analysed. RaIN is currently available to Cabinet Office teams and testing is underway to rollout access to risk owning departments across government. RaIN will improve the efficiency and transparency of the NSRA production process with risk owners updating risks via the platform and having up to date risk information that is easy to engage with.

d. The government has enhanced the assessment of societal vulnerabilities within the NSRA and the public-facing National Risk Register, by creating a specific, independent Vulnerable People panel as one of the NSRA Expert Panels and developing a Risk Vulnerability Tool, allowing for rapid UK-wide analysis and understanding of disproportionate impacts of societal vulnerabilities, before and during crises. The UK government will build on this by commissioning the Government Office for Science’s Social and Behavioural Science for Emergencies group to develop new guidance for lead government departments by autumn 2025, that will support departments to strengthen their assessment of societal vulnerabilities. The government will also review the NSRA methodology to take a more holistic approach to the assessment of societal vulnerability and aligning with the Risk Vulnerability tool, to ensure that emergency planning and response decisions are informed by accurate comprehensive data sources. The Cabinet Office has recently published guidance to support Local Resilience Forums to develop plans for identifying and supporting individuals who may be vulnerable in an emergency, to ensure their needs are systematically considered throughout a crisis.

e. The UK government has published the first ever public analysis of chronic risks in the UK, alongside the Resilience Action Plan this summer. This analysis aims to build understanding amongst risk practitioners, businesses, academics and policymakers of the most critical medium to long term challenges facing the nation, to support their planning and preparations. The 26 chronic risks identified by the UK government cover seven themes, spanning Security, Technology and Cybersecurity, Geopolitical, Environmental, Societal, Biosecurity and Economic issues.

f. Work has commenced with the Royal Academy of Engineering to develop a pilot of an alternative approach to risk assessment, where we consider our capabilities to respond to a broader range of risk scenarios, alongside their impact. A group of academics and industry experts is being established to advise on the methodology for this pilot.