Security Risk Assessment Fundamentals
Identify assets, threats and vulnerabilities, rate risk with a simple Likelihood × Impact method, and decide on proportionate controls.
Why it matters
Security budgets and guard hours are limited. A structured risk assessment shows where controls genuinely reduce harm, and gives managers a defensible record of why decisions were made.
Who it's for: New security officers, supervisors, facility managers and anyone preparing a site risk register.
Learning objectives — by the end you can:
- Distinguish an asset, a threat and a vulnerability using site examples.
- Calculate an illustrative risk score using Likelihood × Impact on a 1–5 scale.
- Record existing controls, additional controls, an owner, a due date and residual risk.
- Explain why organisations may use different approved rating methods.
Key terms
- Asset
- Anything of value to protect: people, information, property, reputation, operations.
- Threat
- A source of potential harm, e.g. theft, intrusion, sabotage, workplace violence.
- Vulnerability
- A weakness a threat could exploit, e.g. an unlit fence line or shared access cards.
- Likelihood
- How probable it is that the risk event occurs in the review period.
- Impact
- The severity of consequences if it does occur.
- Residual risk
- The risk remaining after additional controls are in place.
Lesson notes
The assessment process
- 1Define scope: site, area, time period and who is involved.
- 2List critical assets and why they matter.
- 3Identify credible threats for each asset using incident history, local context and intelligence from lawful sources.
- 4Identify vulnerabilities and record existing controls honestly — what actually happens, not what the SOP says.
- 5Rate likelihood and impact, calculate initial risk.
- 6Select additional controls, assign an owner and due date.
- 7Re-rate to get residual risk and decide whether it is acceptable to management.
- 8Review after incidents, site changes, or at least annually.
Illustrative 5 × 5 risk matrix (teaching example)
Risk Score = Likelihood (1–5) × Impact (1–5), giving 1–25. The bands below are illustrative only. Your organisation may use different scales, bands or qualitative methods — always follow the approved method.
| Score | Band | Typical response |
|---|---|---|
| 1–4 | Low | Manage through routine procedures; monitor. |
| 5–9 | Medium | Additional controls planned with an owner and date. |
| 10–16 | High | Senior management attention; controls prioritised. |
| 20–25 | Very high | Immediate action; consider stopping the activity. |
Illustrative bands — not a universal or mandatory standard.
Choosing controls: defence in depth
Combine layers so a single failure does not expose the asset: Deter (signage, lighting), Detect (alarms, CCTV, patrols), Delay (fences, locks), Respond (trained response, escalation) and Recover (business continuity). Prefer controls that address the vulnerability itself over controls that only record what happened.
Video lesson
Video to be added
A verified video from an official or reputable channel has not yet been selected for this topic. The text lesson above covers the full content.
Search YouTube for related videosPractical story: The warehouse that kept losing copper cable
Fictional teaching example
Situation. A logistics warehouse recorded three thefts of copper cable from its rear yard in two months. Management proposed adding four new CCTV cameras.
Known facts
- All thefts occurred between 01:00 and 04:00.
- The rear fence had a gap behind a parked container.
- Existing cameras recorded the thefts but nobody was monitoring at night.
- Cable was stored 5 m from the fence.
Decisions
- The supervisor completed a risk assessment instead of buying cameras immediately.
- Likelihood rated 4 (recurring), impact rated 3 (loss and outage) — initial score 12, High.
- Controls chosen: repair the fence, relocate cable to a locked cage, add an alarm zone linked to the control room.
Outcome. No further thefts were recorded in the next six months. Residual risk re-rated to 2 × 3 = 6, Medium.
Lessons
- Recording a crime is not the same as preventing it.
- Fixing the vulnerability (fence, storage) often costs less than adding technology.
- Re-rate risk after controls to show management the benefit.
Worked example
Worked example: risk register entry
| Field | Entry |
|---|---|
| Asset | Server room (IT operations) |
| Threat | Unauthorised entry |
| Vulnerability | Door propped open during deliveries |
| Existing controls | Card reader; no door-held-open alarm |
| Likelihood × Impact | 3 × 4 = 12 (High) |
| Additional controls | Door-held alarm to control room; delivery escort procedure |
| Owner / due date | Facilities manager / 30 days |
| Residual risk | 2 × 4 = 8 (Medium) |
Practice exercise
Choose one area you know (an office reception, a car park, a store room). Complete one risk register line using the fields in the worked example.
Security risk register template (CSV)Quiz
Sign in to save quiz results.
References
- StandardISO 31000 Risk management — Guidelines (overview page)
- Official guidanceProtectUK — Risk assessment guidance
- Official guidanceCISA — Security planning resources
Verify current editions and applicability. Standards are copyrighted; consult licensed copies for exact requirements.
Report an issue with this contentRelated topics
Surveillance & Technology
CCTV Planning, Operation and Privacy
Plan cameras around a clear purpose, the right image detail, lighting and privacy — then keep the system maintained and recordings properly controlled.
Access Control
Access Control and Visitor Management
Control who goes where and when — using credentials, zones, visitor processes and regular access reviews.
Threat Awareness
Suspicious Activity: Objective Observation and Reporting
Notice behaviour — not appearance — describe it objectively and report it quickly through the right channel.