Vulnerability assessment: training module
A training module on vulnerability: what makes a programme, a site or a person exposed before an incident tests it, and how to identify that exposure in advance.
Download the training module (PDF, English)Risk, threat and vulnerability
The module separates three terms that are commonly used interchangeably, and the separation is what makes the training useful.
| Term | Meaning | Who controls it |
|---|---|---|
| Threat | A person or group with the intent and the capacity to cause harm | Largely outside the organisation's control |
| Vulnerability | What makes the organisation, its staff or its assets susceptible to that threat | Mostly within the organisation's control |
| Risk | The combination of the two, with the consequence | The subject of the decision |
The practical consequence is that an organisation cannot usually change the threat, and can almost always change the vulnerability. Training that concentrates on the threat produces staff who can describe the danger and have no idea what to do about it.
Where vulnerability comes from
- Predictability. The same vehicle, the same route, the same time, the same staff, every day. Predictability converts an opportunity into a plan.
- Visibility. Marked vehicles, uniforms, a compound that is known to hold valuables, and staff who are identifiable as foreign or as affiliated with a particular organisation.
- Accessibility. Where the organisation can be reached, and who can reach it. A residence on an unlit road with no gate is a different proposition from one inside a guarded compound.
- Isolation. Distance from help, absence of a communications link, and the time it would take for anyone to notice that something had happened.
- Capability gaps. Equipment that is present and does not work, training delivered once and not refreshed, and procedures that nobody has rehearsed.
- Profile. Characteristics of individual staff that change how they are perceived, which the module treats as a vulnerability to be assessed per person rather than an organisational constant.
- Dependency. Reliance on a single driver, a single route, a single partner or a single communications provider, any of which can be removed at short notice.
How the module is taught
The module is built around a case, worked through in groups. Participants are given a programme and a context, and asked to identify the vulnerabilities rather than the threats, then to rank them by how easily the organisation could reduce them. The point of the exercise is that the highest-ranked items are usually cheap and unglamorous: a change to a movement pattern, a second communications route, a decision about who travels together, and a rule that someone has to enforce.
The training finishes with an action list that each participant takes back to their own programme, with a date attached. Modules that end with a discussion produce a good afternoon; modules that end with an action list produce a change.
Related
Practical guidance and research on the security of humanitarian staff, for the organisations that send them.