Seven steps to Conducting a Vulnerability Analysis
Source of information Accounting-financial-tax.com (2010)
Step 1: List the potential emergencies
In the first column of the chart, list all the potential risks (storms or otherwise) that could affect your organization and/or the urban forest. Be sure to consider risks that could occur within your community. You should include your risk control committee, if you have one, in the process to help ensure all possible risks are brought to light.
As you consider the different risks think in terms of the potential areas of risk:
1. Human error
What are the potential employee error-driven risks your organization is exposed to?
- Are your employees trained to respond to storms?
- Are your employees trained to work safely?
- Do they know what to do in an emergency?
- Do your employees have annual drills?
- Are your employees certified arborists
- Do your employees have experience in storm response?
2. What kinds of risk does your organization face that are uniquely business risks?
- Loss of key person
- Worker injury and death
- Lack of training and/or the right type of training
3. What types of risks have your community, your facility, and other facilities faced in the past?
- Severe weather
- Ice Storms
- Wind Storms
- Power outages
- Storm surge
4. What can happen as a result of your geographic location?
- Proximity to flood plains, seismic faults, and dams
- Proximity to the coast
- Proximity to areas with known weather events
5. What could happen if you experience a process or system failure?
Consider the potential risks as a result of:
- Telecommunications failure
- Computer system failure
- Power failure
- Emergency notification system failure
Step 2: Estimate the probability of the Risks
In the probability column of the chart rate the likelihood of the occurrence of each risk by using a 1 to 5—with one as the lowest probability and 5 as the highest. Rely on your own experience and that of others in your organization.
Step 3: Assess the potential human impact
What is the possibility of death or injury? Use the same rating of 1 to 5.
Step 4: Assess the potential property impact
Consider the potential for urban forestry losses and damage. Use the same rating of 1 to 5. Consider the potential risks in terms of:
- Loss of benefits of urban forest (environmental for example)
- Loss of green infrastructure
- Cost to estimate damage to urban forest
- Cost to prune
- Cost to remove trees
- Cost to replace trees
Step 5: Assess the potential business impact
Consider the potential loss due to the potential risks. Use the same rating of 1 to 5.
- Business interruption
- Employees who can’t report to work
- Interruption of critical services
- Interruption of contractual services
Step 6: Assess Internal and External Resources
Assess your organization’s resources and your ability to respond to situations. Use the same rating of 1 to 5. Consider each potential risk from beginning to end and evaluate each resource that you need to respond. For each risk, ask these questions:
- Do we have the needed resources and capabilities to respond?
- Will our external resources be able to respond to us in adverse times as quickly as we may need them, or will they have priority areas to serve?
If the answers are yes, move on to the next assessment. If they answers are NO, identify what you can do to correct the problem. For example you may need to:
- Develop additional risk management procedures
- Conduct additional training
- Acquire additional equipment
- Establish contracts or mutual aid agreements
- Establish agreements with specialized contractors
Step 7: Add the Columns
Total the score you’ve rated for each potential risk. The lower your score, the better. Risks with a high score should be given a high priority in your organization and addressed immediately.
How to Resolve your Risks
There are four basic strategies when selecting your risk management tools:
Shift the risk. This is one way of dealing with risk is to shift it to someone else. For example when you draft contracts with subcontractors that require them to carry liability insurance, you shift the risk to your subcontractors and their insurance companies.
Avoid the risk. Identify and correct hazardous situation, where possible. For example acquire a backup communications strategy, establish agreements and contracts, etc.
Reduce the risk. For example train the employees to respond to storms, train in incident command system, conduct annual drills, ensure equipment is prepped before a storm season, and provide training to reduce injuries that result in lost productivity or unnecessary accidents, etc.
Assume the risk. Will your organization need to bear the financial burden of a risk? This course of action should be taken only after a careful assessment of the risk, along with a detailed cost/benefit study.