At the time of writing this, the UK Government has just released the 2023 edition of the National Risk Register (NRR, HM Government 2023). This document was first published in 2008 and has been updated (somewhat irregularly) at roughly two-year intervals. The new version presents 89 major hazards and threats that could potentially disrupt life in the United Kingdom and possibly cause casualties and damage.
Over the years this document has acquired momentum based on a solid commitment to persist with it and create periodic revisions. It is the public face of the National Security Risk Assessment (NRSA), a document (and a process) that has various security classifications and is generally not available to citizens and organisations. The current version of the NRR draws more on the NRSA than did previous versions. In this, the UK Government is honouring its promise to promote greater transparency in risk assessment.
The first edition of the NRR was a pioneering document that has been emulated by a variety of other countries. It makes sense to enunciate the major risks that a country faces so that all citizens can be clear about what needs to be tackled in terms of threats to safety and security in the future. The 2023 NRR is clear and concise. It explains its own rationale and presents the 89 'risks' one by one.
Although the NRR is certainly a valuable--and many would say necessary--document, it has some drawbacks.
(a) As noted by the House of Lords Select Committee on Risk Assessment and Risk Planning (House of Lords 2021), the NRR is not very "user-friendly" and is not well-known. One hopes that the latest version will reach a wider audience of citizens and organisations that did the previous editions.
(b) In terms of its methodology, the NRR discusses vulnerability but does not accept the premise (Hewitt 1983) that it is the major component of risk. Hence, the risk register largely discusses hazards and threats, not risks sensu stricto.
(c) The register uses a two-year assessment period for malicious risks and a five-year period for others, but many risks that threaten the UK will be evolving over a longer period. It therefore does not consider how risks are likely to evolve in the future. This is particularly important for those hazards associated with climate change. The register is thus not well connected to the foresight programme run by the UK's Government’s own Office for Science.
(d) The NRR does not consider risks as ensembles, despite the fact that they frequently materialise in groups. For instance, the NRR presents widespread infrastructure failure as a risk, but if it were to occur, it would probably be the result of another hazard or threat such as a major storm or a successful cyber attack. This is a simple example: others are more complex, but the intricacies do need to be confronted.
(e) The risks are prioritised by giving most weight to those associated with hostile activity. In reality, it is at least equally likely that the major burden the UK will have to bear will involve natural hazards such as storms, heatwaves, wildfire or cold and snow. In the new version of the NRR natural hazards are given shorter descriptions and less prominence than that attributed to hostile risks.
(f) As a result of the previous two points, it is difficult to turn the risks, as they are described, into planning scenarios. This is a pity as it could be the NRR’s greatest source of utility.
The UK National Risk Register is allied to a number of other documents. One of these is the National Resilience Framework (HM Government 2022). This document has the merit of setting goals and targets for the achievement of resilience in Britain. However, it has serious weaknesses. For example, it makes no mention of gender, ethnic minorities and people with disabilities. That is most unfortunate because it is here that the efforts to create resilience need to be concentrated.
The 2023 National Risk Register has made some progress in responding to criticisms of the previous versions, but it could have made much more. As risk is largely a function of vulnerability, this fact needed to be acknowledged, rather than concentrating entirely on hazards and threats. There is no geographical dimension, which avoids the question of what size events are likely to be and whether certain parts of the country, and certain groups of citizens, would be most at risk.
The scenarios of risks described in the register are mostly described in 100-200 words. They are restricted to the "plausible worst-case" (which is usually a highly debatable concept). One great paradox here is that the worst effects may not necessarily come out of the worst impact. More reflection is needed.
The United Kingdom does not have a proper civil protection system. What it does have is fragmentary, confusing, overcomplicated and in places amateurish. This is a great pity as there is no shortage of expertise in the country. As I said in the witness box of the UK Covid Inquiry earlier this year, given the question "within the limits of what a government can, and should, achieve, does the UK Government keep citizens safe?", my answer is "no".
References
Hewitt, K. (ed.) 1983. Interpretations of Calamity from the Viewpoint of Human Ecology. Unwin-Hyman, London: 304 pp.
HM Government 2022. The UK Government Resilience Framework, December 2022. UK Government, London, 79 pp.
HM Government 2023.
National Risk Register 2023 Edition. UK Government, London, 191 pp.
House of Lords
2021. Preparing for Extreme Risks: Building a Resilient Society. Report of
Session 2021-22. HL Paper no. 110. Select Committee on Risk Assessment and
Risk Planning, House of Lords, London, 127 pp.
