THE RISK ASSESSMENT

We touched upon this in our article dedicated to shock management.

Analyzing means, first and foremost, observing and understanding.

Every facility has its own specific characteristics: its location, its operations, its human environment, its infrastructure, its equipment, and its operational constraints. These factors determine the nature of the risks to which it may be exposed, as well as their probability of occurrence and the severity of their potential consequences.

This analysis must also take into account changes in the surrounding environment. The establishment of a facility, the development of a neighborhood, the emergence of new activities, or shifts in economic and social dynamics can significantly alter the nature and hierarchy of risks.

A risk initially regarded as secondary can thus become a top priority, without the facility itself having necessarily undergone any change.

Consider the example of a hotel where a secondary road provides access for emergency services. If nearby construction work renders this road impassable, the conditions assumed during the initial evaluation have changed, even if the hotel itself has undertaken no work. Such a shift should prompt a review of the relevant findings and, if necessary, a targeted update.

A risk assessment cannot, therefore, be regarded as a definitive, static document. It must be reviewed regularly, as well as updated whenever significant changes or new developments warrant it.

Arbitrating then means turning this analysis into actionable decisions.

Once risks have been identified and prioritized, the organization’s actual capacity to face them must be examined. This step involves evaluating its human, technical, and organizational vulnerabilities, and then determining the measures that can mitigate them.

Some measures can be implemented immediately. Others will require investment, structural modifications, training, or a restructuring of existing procedures.

Yet, no organization possesses unlimited resources.

The auditor must therefore formulate clear, prioritized recommendations accompanied, as far as possible, by an implementation schedule. Essential measures must be distinguished from desirable improvements and supplementary arrangements that relate more to an extra margin of comfort—what others might call the « width of the umbrella ».

This prioritization enables decision-makers to make informed choices, without losing sight of regulatory obligations and core requirements for safeguarding individuals.

Assuming responsibility, finally, means acknowledging the scope of the decisions made.

A risk assessment should never end with the mere handover of a report destined to sit in an archive. It must foster a genuine dialogue between the auditor and organizational leadership.

The auditor stakes their professional liability on the rigor of their analysis, the relevance of their recommendations, and the transparency of their conclusions. Decision-makers, for their part, must be able to assess the proposed measures, understand their implications, and take ownership of the trade-offs made.

These decisions must be understood, documented, and revisited whenever circumstances demand it.

For an accepted residual risk must never become a forgotten risk.

When a shock occurs, the mere presence of damage does not, on its own, prove that prior decisions were inappropriate. Their relevance must also be judged against the information available, the resources that could be deployed, applicable obligations, and the environment as it was understood when those decisions were made.

Provided, however, that this analysis was conducted with due diligence, that decisions were made on an informed basis, and that risks were subject to appropriate monitoring.

The objective of a risk assessment is not to promise the absence of accidents, but to enable an organization to prepare, decide, and substantiate its choices.

There is also an often-overlooked dimension to risk assessment: the clarification of responsibilities.

In submitting their findings, the auditor does not merely deliver a technical analysis. They bring to leadership’s attention the identified risks, their priority levels, and the recommended measures to control them.

They thereby assume professional accountability for the conclusions they articulate, while decision-makers must shoulder responsibility for the choices made on the basis of that information.

This distinction takes on critical importance when an incident occurs.

A decision may have been entirely justified at the time it was made, even if subsequent circumstances demonstrate that a risk deemed secondary ultimately materialized.

The critical point is to be able to demonstrate that this risk had been identified, that the trade-offs were based on rigorous analysis, and that decisions were reached knowingly, then reevaluated when changes in the situation called for it.

For when faced with a shock that could escalate into a crisis, the question will not merely be what happened. It will also be understanding what had been anticipated, what decisions had been made, and what foundations supported them.

A risk assessment must imperatively prepare a facility to organize its defense against the most pressing and perceptible hazards. Once completed, this audit can no longer be ignored—doing so in a crisis would be an aggravating, if not damning, circumstance.

What the Auditor Must Deliver

The auditor must provide a reasoned analysis, prioritized risks, and recommendations precise enough to enable decision-making. They must explain the rationale behind their findings, the conditions on which they depend, and the limitations of their assessment. Decision-makers must be able to distinguish indispensable measures from complementary improvements, and understand the consequences of partial or deferred implementation.

Recommending a maximalist setup without considering the organization’s financial and operational capacities risks discouraging the client from taking any action at all. The auditor must put forward priorities and a realistic implementation roadmap, clarifying what each step contributes to overall protection and what residual risks remain.

The client can thus establish an investment schedule and progressively enhance the protection of their facility, owning the trade-offs made along the way. However, this phased approach must never lead to portraying an essential measure as a deferrable option. Certain safeguards must be implemented concurrently to achieve their intended effect; the auditor must make these interdependencies explicit.

What the Client Must Understand

The client must understand the risks to which their organization is exposed, the suggested priorities, and the consequences of their trade-offs. A favorable conclusion remains contingent upon the conditions that made it possible: it does not constitute a permanent guarantee. Accepting a risk, postponing a measure, or discarding a recommendation is a deliberate decision that they must own. They must also understand what changes would warrant a reevaluation of the assessment and ensure this knowledge is passed on to their successors.

Consider, for instance, a jewelry store whose project is deemed viable subject to specific security measures. If the owner adopts only a small fraction of them, they cannot assume that the initial conclusion still applies without reservation to their business. It falls upon them to evaluate the ramifications of these discrepancies and take ownership of the choices made. The classification of a « viable project » cannot be separated from the conditions attached to it.

The delivery of the report must therefore be accompanied by a discussion to ensure that the findings and their implications have been fully grasped.

An owned decision is not necessarily a flawless one. But an explained, documented, and consistent decision will always be far more defensible than an improvised one whose origin no one can justify.