The UK Government has published an updated version of the National Risk Register (NRR), which supersedes the previous version released in 2017. The NRR 2020 is the unclassified version of the National Security Risk Assessment (NSRA). The latest NRR provides information on the most significant risks that could occur in the next two years and which could have a wide range of impacts on the UK. The 140-page document also summarises what the government, devolved administrations and other partners are doing about them. It is intended to be useful to local emergency planners, resilience professionals and businesses, helping them to make decisions about which risks to plan for and what the consequences of these risks are likely to be. It also contains information and advice for the public.
The NRR 2020 remains based on a 5×5 matrix with likelihood and impact as the two assessing criteria. The Reasonable Worst-Case Scenario (RWCS) for each risk is determined by the government department owning that risk scenario, using extensive data, modelling and analysis.
The bulk of the 2020 register is devoted to risk summaries of various risk types. New risk summaries are included for serious and organised crime risk, disinformation and hostile-state activity. Assessments for pandemics and high-consequence infectious disease outbreaks do not include Covid-19 as, at the time of publication, it remains a live issue. However, a dedicated case study for Covid-19 to date is included independently of the assessments themselves.
An independent report on the government’s approach to risk assessment by the Centre for the Study of Existential Risk (CSER) at the University of Cambridge was published ahead of latest NRR. The authors identified several areas that could be improved and some appear to remain valid in the 2020 version. For instance, the likelihood criterion in the register is based on the RWCS ‘occurring in the next year’. This means that emerging risks that have a low probability of occurring in that timeframe may not be given the attention they possibly deserve – a lesson from Covid-19. Identifying high-uncertainty risks should be a feature of good horizon scanning. Furthermore, it is fair to ask what is ‘reasonable’ in the term RWCS and if the risk-owning government department is the rightful arbiter of reasonableness.
A fundamental question of the NRR 2020, and any risk register, is whether listing potential causes of danger in compartmentalised ways is more valuable than looking at potential consequences, especially where cascading effects often cut across risk categories. It may be valid to map out risks by type but it should be equally if not more important to consider the impacts which can often be common for multiple risks. The ‘indicative impact indicators’ given for five levels in the NRR matrix are helpful to a degree but again compartmentalised: the document does point out that they ‘should NOT be read as a set of criteria that needs to be met in order for an assessed risk to be classified at these levels’.
However, if we are to develop national resilience to a wide range of risks then it is perhaps necessary to spend more time looking generically at the preparedness levels, response/recovery measures, adaptation capacity, and resourcing to cater for complex, inter-related failures that may well occur concurrently and hence tick multiple boxes. The risks in the latest NRR are treated in isolation as if one risk may not elevate or initiate the likelihood of another. Clearly, this is untrue and dangerous to assume given the diversification of response mechanisms as well as the variety of networks at risk.
One way of measuring preparedness would, for example, be to measure indicators such as the number of hospitals/doctors/ICU beds, the number of police/military, the provision of snowploughs at airports/arterial roads, the training of civilian volunteers, etc. These would provide a better reflection of the ability to respond to a crisis in contrast to a recording of the level of risk (as indicated in the NRR) through, for instance, the number of ‘fatalities in the UK’, or ‘public perception’ or ‘lack of health and care services affecting a percentage of the population over time’. This is not to say a risk register is invalid, just that it doesn’t reflect the country’s ability to recover from disruption from whatever cause.
All this would require a different type of register – a National Resilience Register – but perhaps that would be a better measure of the real risk that the country faces.
