Analysing and monitoring risks

1The Protection Analytical Framework (PAF)

The Protection Analytical Framework (PAF), developed under the auspices of the Global Protection Cluster, organises analysis into four pillars:

• Context: crisis dynamics, actors, institutions, laws, social and cultural norms, hazards.
• Current threats to the population: which violations, committed by whom, how, against whom, where and since when.
• Threat effects on the population: physical, psychological, material and legal consequences, and coping strategies, including negative ones (child labour, early marriage, forced return).
• Existing capacities to address threats: those of individuals and communities, institutions and authorities, and humanitarian and development actors.

The PAF does not prescribe a data collection tool: it helps to ask the right questions, to cross-check sources (secondary data, monitoring, interviews, sector reports) and to arrive at precisely formulated priority risks that guide the response and advocacy.

2Protection monitoring

Protection monitoring is the systematic and regular collection, verification and analysis of information over an extended period, in order to identify violations and risks, track trends and guide the response. It combines several methods:

• Key informant interviews and focus group discussions separated by age, gender and diversity.
• Direct observation (checkpoints, sites, markets, services).
• Household surveys, at regular intervals and with a defined sample.
• Incident monitoring, reserved for trained teams and backed by a referral pathway.

A good monitoring system starts from decision questions: what do we need to know in order to act? It collects the minimum necessary, publishes regular analyses (often monthly) and translates into action: referrals, interventions, advocacy. Monitoring that accumulates data without producing a response puts the people interviewed at risk with no benefit to them.

3Sensitive data and the do no harm principle

Protection information can expose people to reprisals. The basic rules, drawn from the protection information management (PIM) principles and the ICRC Professional Standards:

• Defined purpose and collection limited to what is necessary.
• Informed consent: the person knows why they are being interviewed, what will happen to the information and that they can refuse without losing assistance.
• Confidentiality and security: no names in reports, encrypted storage, restricted access, data sharing agreements.
• No investigation of GBV incidents by non-specialised teams: refer to services, do not document the incident.

Beware of re-identification: in a small village, "a 30-year-old woman with a disability arrested at the northern checkpoint" is enough to recognise the person. Aggregated data on very small numbers must be grouped or suppressed.

4Internal displacement and the Guiding Principles

According to the Guiding Principles on Internal Displacement (1998, 30 principles), internally displaced persons (IDPs) are those who have been forced to flee their place of habitual residence, in particular as a result of conflict, violence, human rights violations or disasters, without crossing an internationally recognised State border. They remain citizens who enjoy all the rights of their country. More than 80 million people were living in internal displacement at the end of 2024 according to IDMC.

The Principles cover protection from arbitrary displacement, protection during displacement (life, freedom of movement, documents, family unity, property) and durable solutions. The IASC Framework on Durable Solutions (2010) sets out three options, return, local integration and settlement elsewhere in the country, and eight criteria, including safety and security, an adequate standard of living, access to livelihoods, restoration of housing, land and property and access to documentation. A return is only durable if it is voluntary, safe and dignified, and based on reliable information.

5Designing a protection monitoring system step by step

Most protection monitoring systems that fail do so because of their design, not their data collection: questionnaires that are too long, no decision questions, no referral pathway, analyses published too late to be of use. The method below follows the logic of the Protection Information Management (PIM) principles: start from the purpose, then design the methods, tools, data protection and analytical products.

Step 1: set the purpose and the decision questions (2 to 3 weeks before start-up)

A two-page concept note is drafted that answers five questions: which decisions should the monitoring inform (targeting, advocacy, programme adjustment); who are the users (organisation, cluster, HCT, donors); which protection risks are monitored; in which area and for which population; which products are expected and how often. A good decision question is phrased like this: “Are movement restrictions at checkpoints increasing, for whom and where, so that advocacy and legal aid can be prioritised?”

Step 2: choose the methods

Step 3: build the tools

• Analysis plan before the questionnaire: each question is linked to an indicator, a disaggregation (sex, age, disability, displacement status, location) and a product. Any question that does not appear in an analysis table is deleted.
• Length: a household questionnaire does not exceed 30 to 40 minutes; a key informant interview, 45 minutes.
• Disability: use the Washington Group Short Set of Questions, recommended by the IASC Guidelines on the Inclusion of Persons with Disabilities (2019), rather than the question “Is there a person with a disability in the household?”, which greatly underestimates prevalence (WHO estimates that around 16% of the world's population has a disability).
• Testing: pre-test with 10 to 20 interviews in a similar area, translation and back-translation of sensitive terms.

Step 4: organise the team and training

For an area of 100,000 inhabitants, a common set-up includes a monitoring manager, an information management officer, four to six mixed-sex pairs of monitors and one supervisor for every three pairs. Initial training lasts at least five days: protection principles, interviewing techniques, consent, psychological first aid, how to respond to a disclosure of GBV or child abuse, referral based on the service mapping, security, data protection, use of the tools. A one-day refresher takes place every three months, and a weekly debriefing makes it possible to deal with difficult situations and the emotional burden on teams.

Step 5: define the referral pathway and the alert protocol

Before the first field visit, each monitor has the up-to-date service mapping, referral forms and the numbers of the GBV and child protection focal points. An alert protocol specifies what must be reported within 24 hours (imminent threat to life, unaccompanied child, collective eviction, population movement) and to whom.

Step 6: analyse and disseminate

Quality indicator for a monitoring system: the proportion of recommendations from the previous analysis that led to documented action. If it remains low, the problem is not the data collection but the link between analysis and decision-making.

Budget benchmarks

Protection monitoring covering an area of 100,000 inhabitants typically costs between 25,000 and 45,000 reference currency units per month, depending on local salaries, logistics and security. The main cost items are staff (60 to 70%), transport, data collection equipment and its security, training and psychosocial support for staff. Under-budgeting information management and supervision is the most common mistake.

6Applying the PAF and the standardised list of protection risks

The PAF provides the structure; the Global Protection Cluster's standardised list of protection risks provides a common vocabulary, used in Humanitarian Needs Overviews and Response Plans. Using it makes it possible to compare analyses across areas and countries, and to engage with the inter-sectoral analysis conducted under the Joint Intersectoral Analysis Framework (JIAF).

The fifteen standardised protection risks

1. Abduction, kidnapping, enforced disappearance, arbitrary or unlawful arrest and/or detention.
2. Attacks on civilians and other unlawful killings, and attacks on civilian objects.
3. Child and forced family separation.
4. Child, early or forced marriage.
5. Discrimination and stigmatisation, denial of resources, opportunities, services and/or humanitarian access.
6. Disinformation and denial of access to information.
7. Forced recruitment and association of children in armed forces and groups.
8. Gender-based violence.
9. Impediments and/or restrictions to access to legal identity, remedies and justice.
10. Presence of mines and other explosive ordnance.
11. Psychological/emotional abuse or inflicted distress.
12. Theft, extortion, forced eviction or destruction of personal property.
13. Torture or cruel, inhuman, degrading treatment or punishment.
14. Trafficking in persons, forced labour or slavery-like practices.
15. Unlawful impediments or restrictions to freedom of movement, siege and forced displacement.

The list does not replace contextualised analysis: it classifies risks that are then described precisely (perpetrator, behaviour, exposed population, location). It may be revised by the GPC: refer to the version currently in force.

Implementing the PAF: a five-stage method

1. Build the secondary data matrix: a table in which each row is a piece of information (source, date, area, population, PAF pillar, risk concerned, reliability). A review of 40 to 80 documents is common for a national analysis.
2. Identify the gaps by pillar and by area: the “capacities” pillar and data on persons with disabilities, older people and minorities are often the least documented.
3. Collect to fill those gaps only.
4. Analyse in a workshop: half a day to a full day with analysts from several organisations, pillar by pillar, followed by formulating the risks and estimating severity.
5. Write up: an analysis of 6 to 12 pages at national level; a 2-page brief per area; a one-page summary for senior leaders.

Tool: analysis grid by pillar

Estimating severity

The JIAF uses a five-level severity scale (from “minimal” to “catastrophic”) for inter-sectoral analysis. The Protection Cluster provides indicators that feed into this scale (for example, the proportion of households reporting movement restrictions or lack of documents). Two principles: protection indicators must be interpreted together with qualitative analysis, because incidents are structurally under-reported; an area may be classified as high severity on the basis of converging qualitative information even if quantitative data are lacking, provided this is justified.

The quality of a protection analysis is measured by three things: the precision with which risks are formulated, transparency about sources and limitations, and how actionable the recommendations are (who must do what, by when).

Triangulation and confidence levels

For each finding, indicate the confidence level: high (several independent sources, including direct observation or service data), medium (two consistent sources or a single reliable source), low (rumours, a single unverified source). Low-confidence findings are presented as hypotheses to be verified, never as facts in an advocacy document.

7Full example: quarterly monitoring in Upper Liraka province

This fictional case follows a full quarterly cycle, from sampling to dissemination, for a consortium of two NGOs (one international, one national) conducting protection monitoring on behalf of the sub-national cluster.

Context and set-up

Upper Liraka province has 38 accessible locations and 6 that can only be reached remotely. It hosts around 72,000 IDPs and 140,000 members of host communities. The set-up: 5 pairs of monitors, 2 supervisors, an information management officer, a coordinator. The decision questions selected for the quarter:

• Are movement restrictions and arrests at checkpoints increasing, and whom do they affect?
• What proportion of displaced households lack identity documents or birth certificates, and what are the obstacles?
• Which negative coping strategies are developing, in particular child labour and early marriage?
• What are IDPs' movement intentions over the next three months?

Sample and data collection

Key findings (extracts from the dashboard)

Analysis based on the PAF (drafted extract)

Current threats. Informants in 11 of 38 locations, together with observation of checkpoints, indicate that security forces are holding displaced men aged 16 to 40 without identity cards at checkpoints on the northern route, in connection with military operations launched the previous month. Several consistent sources report that payments are demanded for release. Confidence level: high for the trend, medium for the scale.

Effects. Men are limiting their movements, which reduces income; children, particularly boys aged 10 to 14, are taking over odd jobs in town (27% of households). Focus group discussions with adolescent girls mention increased pressure to marry on two sites, low-confidence information to be verified by the Child Protection AoR.

Capacities. The court of first instance has agreed in principle to mobile court hearings if transport and registry fees are covered. The legal clinic can only follow up 40 cases per month against an estimated demand of several hundred.

Recommendations (format used)

What the analysis does not contain

No names, no village of fewer than 500 inhabitants cited individually, no data on GBV incidents drawn from monitoring, no sub-location data on arrests (risk of identifying families). The results for the six locations monitored remotely are grouped together and flagged as indicative.

The cycle produced 37 individual referrals, an alert to the Humanitarian Coordinator, a targeted funding request and a verification by an AoR. It is this link between data collection, response and advocacy that justifies asking people for their time.

8Data protection tools for monitoring

The principles were set out earlier; this section provides the operational tools that teams must have in hand before the first interview.

Informed consent script (template to adapt)

1. Introduction: name of the organisation, role of the interviewer.
2. Purpose: “We are trying to understand the difficulties and risks faced by families in this area in order to improve assistance and raise them with the authorities, without ever mentioning your name.”
3. What will be done with the information: aggregation, no names in reports, who has access.
4. Voluntary participation: “You may refuse to answer, skip certain questions or stop at any time. This does not change the assistance you receive in any way.”
5. No compensation: no assistance is promised in exchange for the interview.
6. Limits of confidentiality: in the event of imminent danger to life, the interviewer will explain what they must do and will seek the person's agreement.
7. The person's questions, then oral consent obtained and recorded by the interviewer (tick box and time stamp, without signature if a signature creates a risk).

For children, the consent of parents or guardians and the child's assent are required, and interviewing children is the responsibility of staff specifically trained for it. The Minimum Standards for Child Protection in Humanitarian Action (2019 edition) provide the framework.

Data sensitivity classification

Field data security checklist

• Data collection devices protected by passcode, encrypted, with remote wipe capability.
• Synchronisation to the server on the same day and deletion of data from the device.
• No paper forms with names kept in vehicles; if paper is essential, codes instead of names, with the key kept separately at the office.
• No photographs of people, identity documents or sensitive locations taken with personal phones.
• Written procedure in case of a search by an armed actor: do not show the data, present a locked device, inform senior management immediately.
• Retention period set for each category of data and documented destruction procedure.

Small-number and re-identification rules

A common practice is not to publish any table cell below 5 (or 10 for highly sensitive data) and to group categories or areas accordingly. The combination of variables is also checked: location, sex, age group and disability cross-tabulated may be enough to identify a person even without any cell below the threshold. Geolocated point maps are prohibited for incidents; maps by administrative area are used instead.

Data protection impact assessment

Before launching a new system, an impact assessment is conducted: description of data flows, purposes, legitimate basis for processing, risks to individuals (access by a party to the conflict, leaks, re-identification, misuse), mitigation measures, residual risk and decision. The ICRC and Brussels Privacy Hub Handbook on Data Protection in Humanitarian Action provides a template. For European Commission partners, compliance with the General Data Protection Regulation is added to contractual obligations.

9Internal displacement: profiling, intentions and durable solutions in practice

The Guiding Principles and the IASC Framework on Durable Solutions set the standards; implementing them requires data on displaced populations, their intentions and conditions in areas of return or integration. The UN Secretary-General's Action Agenda on Internal Displacement (2022) reinforced the expectation that solutions be government-led and integrated into development planning.

Tools for understanding displaced populations

Conducting an intentions survey in line with standards

1. Inform before asking: information sessions on actual conditions in areas of origin (security, services, condition of houses, contamination), based on recent assessments. An intention expressed without reliable information is not an informed choice.
2. Distinguish intention, preference and plan: “Would you like to return one day?” (preference); “Are you planning to return within the next three months?” (intention); “Have you already made arrangements?” (plan).
3. Ask about conditions: under what conditions would the person return, integrate locally or settle elsewhere?
4. Disaggregate: intentions often differ according to the sex of the head of household, age, ownership of property in the area of origin and ethnic or geographic origin.
5. Protect the results: never pass named lists of households “ready to return” to the authorities or donors; share only aggregated data.
6. Repeat every three to six months, and immediately after a major event (peace agreement, announcement of a site closure).

The eight durable solutions criteria

The Inter-Agency Durable Solutions Indicator Library and the International Recommendations on IDP Statistics (IRIS, adopted by the UN Statistical Commission in 2020) make it possible to measure progress towards solutions by comparing IDPs with the non-displaced population.

When a site closure or organised returns are announced

• Recall the standards in writing (Principles 15 and 28, the Kampala Convention where applicable) and propose a technical dialogue rather than a confrontation.
• Request a realistic timeline, complete information and a genuine choice between return, local integration and settlement elsewhere.
• Organise, where possible, voluntary “go-and-see” visits to areas of origin.
• Monitor movements and conditions after return, and maintain assistance for those who stay.
• Do not take part in the logistical organisation of returns that are not voluntary; raise the issue with the Humanitarian Coordinator.

A durable solution is achieved when there is no longer any specific assistance need linked to displacement, not when displacement physically ends. A return to a destroyed village, without documents or access to land, moves the vulnerability elsewhere without resolving it.

10Common mistakes, contextual variations, interview questions and references

Common mistakes in analysis and monitoring

What donors and auditors check

• The existence of a concept note and an analysis plan linking data collection and decisions.
• Evidence that monitoring triggers responses: number of referrals, follow-up to alerts, recommendations acted upon.
• Data protection protocols, the impact assessment and data-sharing agreements.
• Coordination with the cluster to avoid duplication (several organisations interviewing the same households).
• Disaggregation by sex, age and disability and the actual use of these data.

Contextual variations

• Sudden-onset emergency: replace the household survey with rapid assessments (key informants, observation) and flow monitoring at arrival points; priority to separated children and people with specific needs.
• Protracted crisis: comparable time series, panels of locations followed over time, attention to slow-moving trends (documentation, HLP, coping strategies).
• Urban settings: sampling is more difficult (dispersed, unregistered populations); use of network-based methods, neighbourhood organisations and municipal services.
• Restricted access: remote monitoring limited to non-sensitive questions, protected focal point networks, satellite imagery for destruction; triangulation mandatory.
• Local partners: often best placed for data collection, but also the most exposed; share security tools, insurance and psychosocial support, not just the data collection workload.

Interview questions

Key references

• Global Protection Cluster, Protection Analytical Framework and its introduction note; GPC resources on protection monitoring and the list of standardised protection risks.
• PIM Initiative (Protection Information Management), Principles for Protection Information Management and the PIM conceptual framework.
• IASC, Operational Guidance on Data Responsibility in Humanitarian Action, 2023.
• ICRC and Brussels Privacy Hub, Handbook on Data Protection in Humanitarian Action.
• Alliance for Child Protection in Humanitarian Action, Minimum Standards for Child Protection in Humanitarian Action, 2019 edition.
• IASC, Guidelines on the Inclusion of Persons with Disabilities in Humanitarian Action, 2019; Washington Group on Disability Statistics, Short Set of Questions.
• IASC, Framework on Durable Solutions for Internally Displaced Persons, 2010.
• Expert Group on Refugee and Internally Displaced Persons Statistics, International Recommendations on Internally Displaced Persons Statistics (IRIS), 2020.
• United Nations, Secretary-General's Action Agenda on Internal Displacement, 2022.
• JIPS, methodological resources on profiling displacement situations.
• Joint Intersectoral Analysis Framework (JIAF), current version.