To determine likelihood you ask how probable it is that a threat event will occur. Most practitioners find that agreeing upon likelihood is usually more difficult than determining impact. While you may be able to visualise clearly the result of an event, assigning a likelihood value requires many assumptions. As you can imagine, a good assessment of likelihood also depends greatly on the quality of your information (historical, pattern and change analysis are all important here).
Ultimately, however, potential perpetrators of bad acts think and act on their own terms and reasons, or even whims. Predicting the likelihood of other’s actions can never be 100% accurate. As in the case of impact, it is useful to have standardized terminology for assessing likelihood. Below are the five likelihood descriptors and their definitions. The likelihood descriptors still leave room for subjectivity, which is not necessarily bad if it leads to discussion of differing information and perspectives. Use of these descriptors will also help in providing a common language to facilitate the process of clarifying risk.
Considering likelihood, it is very important to define the target group of your analysis carefully and correctly. In other words, it is likely that the event will happen to whom? Normally, the answer will be to your office and staff, or possibly to your office and staff plus immediate partners. For example, imagine that you work near a conflict area and are considering the possibility of being exposed to shelling. The likelihood of it occurring in the near future may be almost certain, but this does not mean it will directly affect you or your staff.
The question you should ask is “what is the likelihood of this event (shelling) happening to my staff?” As mentioned, the target group may be expanded to include partner agencies. Remember that the wider your group, the less exact your results will be. This is because different groups may have significantly different vulnerability profiles, and considering them together will only tell you an average likelihood, which may not be particularly descriptive of any one group. Note that for this reason we do not recommend including your beneficiary population in the analysis group of your staff risk analysis. This is not because we value the lives of the people we are seeking to help less than those of our staff; indeed in later chapters we will discuss how SRA techniques may be used as tools to analyse their needs as well. The simple fact is that affected populations usually present a significantly different vulnerability profile from organisational staff, and mixing the two together in your analysis will not yield useful results for either. As with impact, consider likelihood in light of all preventive and mitigating measures currently in place. For example, if you maintain regular contact with officials and carefully avoid areas designated as unsafe, this will probably reduce the likelihood of staff being exposed to shelling, and should be reflected in your likelihood analysis.
Using the descriptors for likelihood from the previous table, match the short descriptions of possible threats with the best descriptor. The situation is that you are part of a small field office in a rural area with very limited medical facilities or other immediate assistance providers. For each possible scenario, make any assumptions that are needed to make your decision about the relative likelihood of each event. Write in the impact descriptor you feel best reflects each one.
This was probably a much harder exercise to complete than the previous one concerning impact.
The likelihood of such threat events actually happening obviously depends on where you are, what time of year it is, local political events, and the general situation. Your threat pattern analyses provide one way to undertake this part of risk analysis. This is true for all types of threats. For example, if you work in the Caribbean Sea region, you might say the likelihood of a dangerous hurricane is likely in August, but unlikely in January. The patterns of hurricane formation in this region are clearly understood.
There may be similar patterns for other non-natural threats as well. Do guerillas become active in the spring to make new incursions into government-held areas? Has the pattern been that theft (and violence) rises at the end of winter as the population consumes the end of their annual food stocks? Are you more likely to be taken hostage in Japan or Somalia? In every instance, the local situation dictates the answer, and this analysis must be made with those who are well-informed and familiar with the day-to-day realities and threat patterns in the local areas concerned. There is no one right answer to this kind of exercise without providing the detailed specifics of the security context—it all depends on the underlying threat assessment.