Understanding and managing risks

1Threat, vulnerability and risk

A threat is anything that can cause harm (crime, fighting, explosive devices, disease, road accidents). Vulnerability is what exposes us to that threat (predictable schedules, a valuable vehicle, lack of communications). Capacities are what reduce exposure or impact (training, procedures, network of contacts).

This is often summarised as: risk = threat × vulnerability ÷ capacities. We can rarely act on the threat; we act mainly on our own vulnerabilities and capacities.

Important reminder: in most contexts, road accidents and health problems kill or injure more humanitarian workers than attacks do.

2Acceptance, protection, deterrence

• Acceptance: being accepted by communities, authorities and armed groups thanks to the quality of assistance, respect for humanitarian principles (humanity, neutrality, impartiality, independence), communication and everyone's behaviour. This is the core strategy of NGOs.
• Protection: reducing vulnerability through physical means and procedures (walls, guards, curfews, convoys, protective vests).
• Deterrence: posing a counter-threat (armed escort, sanctions). NGOs use it only as a last resort, as it can compromise neutrality and acceptance.

Most organisations combine all three, with a strong emphasis on acceptance.

3Security plan and procedures

Each area of operation has an up-to-date security plan: context and risk analysis, standard operating procedures (SOPs), contacts, medical and evacuation plans. Read it on arrival and sign it.

• Alert levels: each level indicates what is permitted (movements, times, areas).
• Hibernation: sheltering in place (office or residence) with reserves of water, food, fuel and communications for several days.
• Relocation: temporarily moving staff to a safer area within the country.
• Evacuation: moving staff out of the country. Keep a grab bag ready (documents, cash, medicines, charger).

4Movements and communications

• Every movement is authorised and tracked: route, times, passengers, radio or phone check-ins at set intervals.
• Avoid routine (vary times and routes), do not drive at night unless the rules say otherwise, seat belts fastened for everyone, limited speed.
• Vehicle in good condition, full tank, first aid kit, spare wheel, contact list.
• Redundant means of communication (phone, HF/VHF radio, satellite phone) and known radio call signs.
• Seek information from NGO security forums (for example INSO where it is present) and local colleagues, who know the context best.

5Conducting a security risk assessment: the complete method

The formula "risk = threat × vulnerability ÷ capacity" is a teaching starting point. In practice, a security risk assessment (Security Risk Assessment, SRA) is a structured, documented and regularly reviewed process that leads to decisions: which activities to maintain, under what conditions, with which measures and at what cost. The reference framework most widely used by NGOs is Operational Security Management in Violent Environments (Good Practice Review 8, Humanitarian Practice Network), supplemented by the guides of the Global Interagency Security Forum (GISF, formerly EISF) and, for the overall logic, by the ISO 31000 standard on risk management. United Nations agencies follow the Security Risk Management Manual of the Department of Safety and Security (UNDSS).

Step 1: scoping the assessment (half a day)

• Scope: a specific geographical area (a district, a town and its access roads), a programme or a one-off activity (a distribution, an exploratory mission). A "country-wide" assessment that is too broad does not allow decisions to be made.
• Lead: the country security manager or the area security focal point, under the authority of the head of mission or country director, who remains the risk owner and signs off the document.
• Participants: base manager, experienced drivers, logistician, at least one national staff member from each community present, programme managers. Drivers and guards are often the best informed about the real threats; leaving them out is a classic mistake.
• Review date: set from the outset (at least every six months, and whenever the context changes significantly).

Step 2: analysing the context (two to five days depending on access)

The context analysis answers four questions: who the actors are, what their interests are, how they perceive our organisation, and which dynamics may change over the next three to six months.

• Actor mapping: state authorities, security forces, non-state armed groups, customary and religious authorities, traders, local media, other humanitarian organisations. For each: interests, capacity to harm or to protect, attitude towards the organisation (favourable, neutral, hostile), existing channel of contact.
• Incident history: at least 12 months of data, drawn from internal reports, the NGO security forum (INSO where it operates), security coordination meetings (the UNDSS cell under Saving Lives Together) and the public Aid Worker Security Database (Humanitarian Outcomes) for regional trends.
• Seasonal and calendar factors: rainy season (roads cut off, isolation), lean season, transhumance, elections, religious holidays, salary payment periods (peak in robberies).
• Perception of the organisation: who knows us, for what, and with what image? Rumours are collected and treated as data, not as noise.

Step 3: identifying and describing threats

A threat is described precisely: perpetrator, modus operandi, usual target, place, time. "Crime" is not a usable threat; "armed robbery of 4x4 vehicles by groups of 3 to 5 men on the Kalanga-Biro road between 4 p.m. and 7 p.m., with no physical violence in 8 cases out of 10" is one. The following categories are usually distinguished:

• Targeted threats: the organisation or its staff are targeted as such (kidnap for ransom, retaliatory attack, written threats).
• Opportunistic criminal threats: staff are targeted for what they have (cash, vehicle, phone).
• Indirect or collateral threats: being in the wrong place at the wrong time (fighting, shelling, explosive devices, demonstrations).
• Non-intentional threats: road traffic accidents, illness, natural disasters, fires. In many contexts they account for the majority of staff deaths and serious injuries, yet they remain underestimated in analyses.
• Internal threats: fraud, internal theft, violence between colleagues, sexual harassment and exploitation, information leaks.

Step 4: assessing likelihood and impact

Each threat is rated on two scales from 1 to 5, with written definitions so that two assessors arrive at the same score.

The risk level is the product of the two scores (from 1 to 25). A common convention: 1 to 4 low, 5 to 9 medium, 10 to 16 high, 20 to 25 very high (or "extreme"). What matters is that the convention is written down, known and applied consistently from one assessment to the next.

Step 5: defining measures and calculating residual risk

For each risk rated medium or above, measures are defined that act either on likelihood (avoiding exposure, making the target less attractive, improving acceptance) or on impact (first aid, insurance, response procedures, medical plan). The risk is then reassessed with the measures in place: this is the residual risk. A measure that is not budgeted, not assigned to a person and not verifiable is not a measure: it does not reduce the score.

Step 6: deciding against the risk threshold

The residual risk is compared with the organisation's risk threshold, i.e. the maximum level of risk it is willing to expose its staff to. This threshold is not fixed: it depends on programme criticality. The United Nations uses a formal Programme Criticality Framework that ranks activities from PC1 (immediate life-saving or directly mandated activities) to PC4; only PC1 activities can justify a very high residual risk, and only through a decision at the highest level. NGOs apply the same logic in simpler forms: water distribution in the middle of a cholera epidemic may justify a high risk; a training workshop or a donor visit does not.

A risk assessment is not judged by the quality of the table but by the decision it produces: continue, adapt, suspend or withdraw. If the document leads to no decision and no budget line, it has served no purpose.

Step 7: disseminating, applying and reviewing

The conclusions are translated into the security plan, the standard operating procedures and the security levels. They are presented to all relevant staff, in a language they understand, during a briefing of at least one hour. A review is triggered automatically by the set review date, by a serious incident in the area, by a change in security level or by the start of a new activity.

6Full example: risk assessment for opening the Kalanga base

Fictional context: the NGO "Secours Solidaire International" is preparing to open a base in Kalanga, the main town of a fictional district in the north-east of a country in protracted conflict. The project plans food and non-food item distributions for 18,000 internally displaced persons, spread between the town and three sites at 25, 40 and 65 km. The team will consist of 2 international staff, 24 national staff, 4 vehicles and a warehouse. The head of mission requests an assessment before approval by headquarters.

Data collected

• Over the last 12 months, the NGO security forum recorded 41 incidents affecting humanitarian organisations in the district: 17 armed robberies of vehicles or goods on the roads, 9 burglaries of offices or warehouses, 6 serious road traffic accidents, 4 temporary arrests of national staff at checkpoints, 3 verbal threats linked to distribution targeting, 2 short-term abductions (release in less than 72 hours), and no deaths from acts of violence.
• Two armed groups alternately control the road to the most distant site (65 km); a third, essentially criminal group operates on the 40 km road between 3 p.m. and 7 p.m.
• Rumours collected by the assessment team accuse NGOs of favouring displaced people at the expense of the host population, which has received no assistance for a year.
• The rainy season (July to October) cuts off the 65 km road for about three weeks a year.
• The district hospital has an operating theatre; the nearest hospital able to manage a polytrauma patient is in the capital, 1 hour 40 minutes away by air. The humanitarian air service (UNHAS) serves Kalanga twice a week.

Risk register (extract)

Reasoning and decision

1. Town and sites at 25 and 40 km: all residual risks are medium at most. The head of mission approves the activities, provided the measures are budgeted and in place before the first distribution.
2. Site at 65 km: the residual risk of abduction remains high (10). The organisation's threshold requires approval by the regional director for any high risk, and only for life-saving activities. The team argues that 4,200 displaced people have received no food assistance for 5 months and show an estimated global acute malnutrition rate of 17%. The regional director approves for a three-month period, with monthly review, and asks for an alternative modality to be explored (mobile money transfers if the network allows, or a partnership with a local organisation that is already accepted, provided that the risk transfer is discussed openly and offset by security support).
3. Budget: the measures amount to USD 46,000 over 12 months (guarding, fencing, radio and satellite equipment, training, GPS tracking, insurance), i.e. 3.8% of a USD 1.2 million budget. This cost is built into the project budget as a direct cost, which most institutional donors accept when it is justified by the risk assessment.

What the example teaches

• The highest initial risk (malaria, 16) is not a risk of violence: this is often the case.
• Acceptance measures (inclusion of the host population) reduce risk as much as physical measures, at lower cost, but they involve programme teams, not just logistics.
• Relying exclusively on national staff for the most dangerous road is a risk transfer. It is acceptable only if national staff are genuinely less exposed (which must be demonstrated, not assumed), if they have given informed consent and if they benefit from the same protections (insurance, communications, post-incident support).

7Acceptance, protection and deterrence: implementing and measuring them

The three strategies form what GPR8 calls the "security triangle". The question for a manager is not which one to choose, but how to balance the mix according to the threats: acceptance is effective against threats from actors who have an interest in our presence; it has almost no effect against opportunistic crime, explosive devices or shelling, which call for protection.

Building acceptance: an active approach

Acceptance cannot be decreed and does not flow automatically from a good programme. Joint work by several international NGOs (notably Save the Children, CARE and Mercy Corps) on acceptance-based security management formalised a five-step approach:

1. Assess the actors: who can harm us, protect us or influence those who can?
2. Analyse perceptions: how each actor perceives our mandate, our funding, our staff, our targeting criteria.
3. Act on the factors of acceptance: quality and relevance of aid, humanitarian principles applied and visible, fair recruitment, transparent local procurement, staff conduct, complaints handling, regular communication.
4. Negotiate access with those who hold power, at an appropriate level of seniority and consistently across teams.
5. Measure and monitor acceptance over time.

Usable acceptance indicators

A quarterly reading, recorded and compared, shows the trend. A drop in acceptance often precedes targeted incidents by several weeks.

Protection: proportionate measures

Protective measures fall into four families: physical (fences, lighting, access control, safe room), procedural (curfew, key management, movement procedures, cash management), organisational (training, recruitment and vetting of guards, decision-making structure) and low profile (unmarked vehicles, no visibility in areas where the logo attracts the threat). The main risk of heavy protection is the "bunker" effect: a fortified base sends a message of mistrust, cuts the team off from the community and can reduce acceptance.

Deterrence and armed escorts

The IASC Non-Binding Guidelines on the Use of Armed Escorts for Humanitarian Convoys (2013) set out the general rule: humanitarian convoys do not use armed escorts, except as a last resort, when four criteria are met: the humanitarian need is life-saving, the relevant authorities are unable to provide a secure environment, there is no alternative, and the escort itself is credible and respects international humanitarian law. The decision is documented, time-limited and reviewed. For an NGO, an armed escort raises three practical problems: it associates the organisation with a party to the conflict, it may attract attacks rather than deter them, and it sets a precedent that is hard to undo. Other, less visible forms of deterrence exist: temporary suspension of activities after an attack, coordinated withdrawal by several organisations, diplomatic representations.

The right mix is decided threat by threat. For each line of the risk register, ask: who is the likely perpetrator, do they have an interest in our presence, and which strategy really acts on them?

8Movement and communications management: detailed procedures

Travel accounts for most of the exposure of staff: the majority of robberies, abductions, attacks and accidents affecting aid workers happen on the road, according to the annual analyses of the Aid Worker Security Database. A written movement management procedure, applied without exception and monitored, is the most cost-effective security measure.

The movement cycle

1. Request (the day before, by 4 p.m.): the requester completes a movement form: purpose, destination, main route and alternative route, departure and return times, passengers (including non-staff, who are in principle prohibited without authorisation), vehicle, driver, means of communication, planned check-in points.
2. Approval (by 6 p.m.): the security focal point checks the security level of the area, the information from the last 24 hours (security forum, contact network, other organisations), the weather and road conditions. They approve, amend or refuse the movement. Movements to a high-level area are approved by the base manager or the head of mission.
3. Pre-departure briefing (15 minutes): route, sensitive points, instructions at checkpoints, check-in times, conduct in the event of an incident, check of the vehicle list.
4. Tracking (during the movement): the radio operator or duty officer records each check-in in the movement log: time, position, situation. Check-ins take place at departure, at each defined waypoint, on arrival, on leaving the site and on return.
5. Closure and debrief: on arrival, the movement is closed in the log. Any observation (new checkpoint, unusual behaviour, deteriorated road) is passed on to the focal point the same day.

The missed check-in procedure

A missed check-in is the first warning of a possible incident. The procedure must be written with precise timeframes, known to the radio operator and displayed in the radio room. Example procedure for a check-in scheduled every 30 minutes:

Timeframes are shortened in high-risk areas and lengthened on roads known to have no coverage. The key point is that everyone knows in advance when the alert will be raised: a driver who knows that a missed check-in will trigger an alert after 20 minutes does not "skip" check-ins.

Communications: redundancy and discipline

• At least two independent means for any movement outside town: for example VHF or mobile phone plus satellite phone or HF. The satellite phone is charged, tested before departure and kept within reach, not in the boot.
• Actual range: VHF generally reaches 5 to 10 km in open terrain from vehicle to vehicle, more with a repeater; HF allows links over several hundred kilometres but requires a trained operator and set listening schedules.
• Call signs and phonetic alphabet: every person and every vehicle has a call sign; names, cash amounts or routes are never given in clear on a network that may be monitored.
• Duress codes: a simple code word, known to all, signals duress ("I am with guests") without alerting the perpetrators.
• Authorisations: the use of radios and satellite phones is subject to licensing in most countries; some prohibit or restrict them. The organisation must hold the necessary authorisations, otherwise the equipment may be seized and staff arrested.
• Monitoring: the radio room is staffed for the entire duration of movements and, in high-risk areas, 24 hours a day, with evening and morning radio checks for residences.

Road safety: the most underestimated threat

According to the World Health Organization, road traffic accidents are one of the leading causes of death in low- and middle-income countries, and a major cause of death and serious injury among humanitarian staff. The most effective measures are well known and inexpensive:

• Seat belts in all seats, including the rear, checked by the driver before departure (the driver has the authority to refuse to leave).
• A written maximum speed (for example 80 km/h on tarmac roads, 50 km/h on tracks, 30 km/h in villages), monitored by GPS tracking with a weekly report.
• No night driving outside town, except for an approved medical emergency.
• Limited driving time (for example 2 hours without a break, 8 to 10 hours a day) and mandatory rest.
• Driving tests on recruitment and annual driver training; no unauthorised person drives.
• Daily vehicle check against a written checklist (see the tools below) and maintenance according to the manufacturer's schedule.
• No phone use while driving, including by the vehicle team leader distracting the driver.

A driver who refuses to leave because a passenger will not wear a seat belt, or who refuses to exceed the set speed despite pressure from a manager in a hurry, is applying the organisation's policy. Management must back them publicly, otherwise the rule will disappear within a few weeks.

9Reusable tools: register, movement form and checklists

Risk register template

Movement form template

Daily vehicle checklist

• Fuel tank at least three-quarters full, spare jerrycan if the route requires it.
• Tyres (pressure, wear), spare wheel, jack and wheel brace.
• Brakes, headlights, indicators, windscreen wipers, horn.
• Oil and coolant.
• Complete first aid kit and trauma kit (tourniquet, pressure dressings, emergency blanket).
• In-date fire extinguisher, warning triangle, tow rope.
• Radio tested, satellite phone charged, contact list and paper map.
• Drinking water (at least 2 litres per person) and rations for an unplanned night on isolated roads.
• Vehicle documents and mission orders.

Checklist for a new staff member's arrival (first 48 hours)

1. Individual security briefing of at least one hour by the focal point, before any movement outside.
2. Reading and signing of the security plan and procedures.
3. Issue and testing of communication equipment; learning call signs and codes.
4. Site visit: residence, office, assembly point, safe room, location of the grab bag and PEP kit.
5. Recording of confidential personal data (emergency contacts, relevant medical information, proof-of-life questions).
6. Explanation of the current security level and the rules that follow from it.
7. Assignment of a buddy colleague for the first two weeks.

What donors, auditors and evaluators look at

• ECHO: in the Single Form, the risk and security section must show that the organisation has a security management framework, an action-specific risk analysis and budgeted measures. Justified security costs are eligible. ECHO has published a Generic Security Guide for Humanitarian Organisations and guidance on security within its partnership framework.
• BHA: the emergency application guidelines require a description of safety and security risk management, including for implementing partners.
• FCDO and United Nations agencies: verification of duty of care in partner due diligence assessments (risk management capacity, policies, insurance).
• Internal auditors: a movement log kept without gaps, signed briefing records, dated and reviewed risk assessments, incidents reported and analysed, budgeted measures actually put in place.

10Common mistakes and variations by context

Common mistakes

Sudden-onset and protracted crises

In the first weeks of a sudden-onset crisis (earthquake, mass influx of refugees, outbreak of fighting), a full assessment is impossible. A rapid assessment is carried out within 24 to 72 hours, focused on immediate threats (aftershocks, building collapses, crowds, looting, epidemics, roads), with conservative default measures (strict curfew, movements in pairs, two means of communication). The full assessment follows within 4 to 6 weeks. In a protracted crisis, the danger is the reverse: habit reduces vigilance, procedures become lax and the assessment is no longer reviewed. An annual audit of actual practice, compared with the written procedures, is then useful.

Camps and urban settings

In camps, the main threats stem from tensions between displaced people and staff (targeting, rations, recruitment), crowd movements during distributions and the possible presence of armed elements. Measures focus on how distributions are organised (separate queues, exit points, presence of committees), complaints mechanisms and coordination with camp management. In urban settings, crime, demonstrations, kidnapping for ransom and traffic dominate; routes and timings must be varied, a low profile is often preferable to visibility, and the security of staff residences scattered across the city becomes a major issue.

Remote management

When international or senior staff can no longer access an area, remote management transfers part of the risk to local national staff or partners. Good practice consists of acknowledging this transfer explicitly, carrying out a risk assessment specific to the staff who remain, giving those staff real authority to suspend an activity, strengthening communications and monitoring, and providing third-party monitoring mechanisms that do not expose teams any further.

Local partners with limited capacity

The Grand Bargain (2016) and the localisation commitments have increased the share of aid delivered by local organisations. These organisations are often better accepted, but less well equipped and less well insured. GISF and InterAction recommendations on partnership and security risk management stress three points: discuss risks and how they are shared openly from the partnership negotiation stage, genuinely fund the partner's security costs (equipment, training, insurance, indirect costs), and respect the partner's own analysis rather than imposing procedures designed for an international NGO.

High insecurity

In contexts of very high insecurity (active armed conflict, terrorism, frequent kidnapping of foreigners), low-profile measures often take precedence over visibility; movements are reduced to the strict minimum, international travel is limited, hibernation and relocation planning becomes a priority, and access decisions are taken at a senior level. Coordination with other actors (security forum, Saving Lives Together) becomes essential to prevent one organisation from taking on alone a risk that will expose the others.

11Interview questions and key references

Security focal point, country security manager and base manager positions almost always involve a technical interview and sometimes a written exercise (risk analysis based on a scenario, drafting a procedure). Here are frequent questions and what a strong answer contains.

1. "How do you conduct a risk assessment for a new area?"

It describes a process: scoping, context and actor analysis, collection of at least 12 months of incident data, precise description of threats, defined likelihood and impact scales, budgeted and assigned measures, residual risk, decision against the risk threshold and programme criticality, dissemination and review. It mentions the participation of national staff and drivers.

2. "How do you measure acceptance?"

It cites concrete indicators (volunteered information, access, complaints and rumours, participation of leaders), regular data collection and trend analysis. It acknowledges that acceptance varies between actors and can be strong with one community and non-existent with an armed group.

3. "A programme manager wants to go ahead with a distribution despite a serious incident on the road the day before. What do you do?"

It answers neither "we cancel" nor "we go": it gathers information on the incident, reassesses the risk, looks at alternatives (48-hour postponement, another route, another modality, a local partner), applies the threshold and the written decision-making chain, and documents the decision. It points out that the programme manager cannot, alone, decide to accept a risk above the threshold.

4. "What is your view on armed escorts?"

It cites the IASC Non-Binding Guidelines on armed escorts (last resort, cumulative criteria), explains the risks to neutrality and acceptance, and offers alternatives. It acknowledges that some agencies and some contexts do use them, with documented decisions.

5. "How do you manage the security of a local partner under remote management?"

It speaks of risk sharing rather than risk transfer, assessment of the partner's capacity, funding of security costs, the right to suspend, joint training and support in the event of an incident, including insurance and psychosocial support.

6. "What was the leading cause of staff deaths in your last posting and what did you do about it?"

A strong answer is honest and backed by figures; it often cites road traffic accidents or health, and describes concrete measures (seat belts, speed, night driving, GPS tracking, driver training) with their measured effect.

Key references

• Operational Security Management in Violent Environments, Good Practice Review 8 (revised edition): Humanitarian Practice Network, ODI.
• Security Risk Management: a basic guide for smaller NGOs, Security to go: a risk management toolkit for humanitarian aid agencies and thematic guides: Global Interagency Security Forum (GISF, formerly EISF).
• Security Risk Management Manual and Programme Criticality Framework: United Nations Security Management System (UNDSS).
• Saving Lives Together: framework for security collaboration between the United Nations, NGOs and international organisations.
• IASC Non-Binding Guidelines on the Use of Armed Escorts for Humanitarian Convoys (2013): Inter-Agency Standing Committee.
• Generic Security Guide for Humanitarian Organisations: ECHO, European Commission.
• ISO 31000 standard (risk management) and ISO 31030 standard (travel risk management).
• Annual Aid Worker Security Report and Aid Worker Security Database: Humanitarian Outcomes.
• Core Humanitarian Standard on Quality and Accountability (CHS), Commitment 8 on staff support.