A security audit identifies vulnerabilities that could allow an intrusion, unauthorised movement or a malicious act to take place within or around a site.

Risk assessment involves identifying situations that could destabilise a site, interrupt its operations, or endanger the people within it.

It is not limited to malicious acts. It also considers accidents, medical emergencies, environmental conditions, the site’s isolation and any other reasonably foreseeable situation that could affect its operation.

Risk Always Depends on Context

Consider building an exceptionally high-end hotel on an isolated island. The concentration of particularly exposed guests may attract certain forms of criminal activity. However, the distance from the mainland also raises other questions: how would the site respond to a serious medical emergency, evacuate someone or rapidly obtain additional resources?

Risk therefore lies not only in the event itself. It also depends on the environment, the site’s activities, the people present and its ability to deliver an appropriate response within the time available.

A relatively common situation can become critical when a site is isolated, difficult to access or inadequately prepared.

Risk Is Not Simply a Number

Matrices and coefficients may help to present certain conclusions. However, they cannot replace observation, experience or an understanding of the context.

Assigning a score to a risk is not enough to determine what to do. The analysis must consider the possibility of an event occurring, the severity of its consequences and, above all, the site’s ability to respond.

Mathematical precision must never conceal the absence of an operational response.

Assessing Before Building or Making Changes

Risk assessment should ideally begin during a project’s design stage. It allows constraints to be identified early enough to adapt the location, architecture, available resources and future organisation of the site.

Once a risk is known, it becomes possible to anticipate it and prepare appropriate responses. Where the necessary measures would be unrealistic, disproportionate or insufficient, the assessment can also provide an informed opinion on the project’s feasibility.

The objective is not to produce an alarming list of scenarios. It enables decision-makers to understand the dangers to which their project or establishment may be exposed and to make informed decisions accordingly.

At SDS, risk assessment is not a theoretical exercise based on a universal formula. It is grounded in the reality of the site, its environment, its activities and its response capabilities.

Depending on the site and its geographical environment, a risk assessment may require between three and ten days in the field, followed by at least an equivalent period of analysis and report writing.