I believe in prevention and mitigation (and remaining risk). In my humble opinion your statement is too general. There are security events that occur frequently. As soon as data is available, risk assessment works and preventive measures are reasonable. On the other hand, risk assessment does not work for the crisis that has never happened before.

While the names may change, I would argue that most crises have happened before.

Leadership is recognized not bestowed.   One good way to identify who should be leading a crisis response is to have tabletop exercise with all appropriate staff available.    During a crisis, followers seek out leaders they place their confidence in.  I have seen this over and over again.  It works.

-- Bob 

Great point Ingo - I'm certainly referring to unexpected crises. Once a crisis has been experienced many times it ceases to be a crisis and becomes an emergency because we learn and become better at reducing its impact. Yes Bob, most have happened before but that sadly does not result in organizations and governments taking the necessary steps required to be adequately prepared. This thread is not about leadership, but about the manner in which one prepares for risk.

We investigate risk management processes on a society level. The work aims at resilience of critical infrastracture, e.g. security, increasing availability of services, identification of single points of failure, inter-dependency of various services etc. The goal is risk management processes against the unexpected. The one question that cannot be answered is cost-efficiency, as the probability or frequency of the unknown event is... eh... unknown.

Having spent most of my adult life performing risk analysis for the military, I've encountered a number of ways to deal with hazards and risks in crises situations, as well as post-disaster recovery. Over the years, the process of risk management under high-tempo and high-stress situations has been structured to train leaders. It's called operational risk management (ORM). Of course, there's no magic template for performing ORM in crises situations, but preparation and training are the keys. In a crisis, unless your analytical tools are already developed and computerized for rapid answers, decisions must be made based on available information - because failure to act can result in greater risks and consequences (risk-risk situations).

ORM consists of the following basic steps for multiple levels of risk:

Identify Hazards

Assess Hazards

Make Risk Decisions

Implement Controls

Supervise

These are the Four Principles of ORM (note the 3rd principle, a systems approach):

Accept risk when the Benefit>Risk.

Accept no unnecessary risk.

Anticipate and manage risks by planning.

Make risk decisions at the right level.

http://www.public.navy.mil/airfor/nalo/Documents/SAFETY/OPNAVINST%203500.39C%20OPERATIONAL%20RISK%20MANEGEMENT.pdf

Thx Paul. We must plan knowing that our plans will not stand but it is the process that strengthens us. Just read a good article by Greg Shaw on the hazards RM process in JC Pine's book on Natural Hazards Analysis. How does it compare to your ORM process?

Shaw’s HRM process looks like a hybrid of ORM and the Risk Management Framework developed by the Presidential/Congressional Commission in 1997 (see similarity of attached diagram to Shaw’s). The severity and probability measures of risk appear as a common theme among them all. The challenge with crisis management is TIME and LEVEL of involvement. Anticipation (scenario building, brainstorming, etc.) and planning are essential but the best laid plans… That’s why ORM breaks down the process into three levels: In-depth, deliberate, and time critical. These levels correspond with strategy, tactics, and mission execution. It’s like flying an aircraft: You can plan, train, and rehearse for every emergency inflight scenario, but there will always be a situation that you did not anticipate. Hopefully, in these situations, training and experience will permit rapid problem assessment and innovative solutions. But it all starts from the strategic level with planning.