Risk assessment without the risk? A controversy about security and risk in Norway

Abstract

Security and 'securing' is high on the public agenda. Questions are raised on where, to what degree and against what the government and others should introduce preventive security measures. This article investigates a controversy in Norway about the role of probability in risk assessment within security. The article asks how the question of the probability of incidents is problematized and addressed by actors involved. It discusses how the controversy can be interpreted and what it might tell us about security and risk. The article builds on an exploratory study of the reasoning of security professionals in relation to a standard on security risk assessment. It shows how the downplaying of probability is defended, but also how it creates dilemmas and is criticized. The argument against estimating probability is that it is often difficult or impossible. Probability is, however, also a moderating factor. Probability turns unlikely futures into lower risks than likely futures. Those arguing against the security risk standard point to the consequence of downplaying probability in risk estimates. A key finding is how risk assessment in areas of low tolerance for incidents introduces a discrepancy that is difficult to handle. On the one hand, security analysts are supposed to deal with threats as risks, implying scaling, comparison and level of acceptance. On the other hand, they are supposed to create security, implying the opposite of scaling and risk acceptance. Risk assessment becomes difficult if there is little appetite for taking risk. Michael Power's three ideal models of risk management logics are introduced in the discussion as heuristic tools of a sensitizing kind. The article concludes that risk research could benefit from engaging with security theory, to investigate how risk management might be shaped by security practises.

Analysis and Design of the Project Risk Management System Based on the Fuzzy Clustering Algorithm

“…e results of cluster analysis show that when the threshold λ changes from large to small, the classification results become more and more rough. In order to determine an optimal classification, the λ value should be selected reasonably [21]. ere are many methods for selecting the λ value, such as the expert experience method and the F-statistic method [22].…”

Standardising policy in a nonstandard way: a public/private standardisation process in Norway

“…The initiative resulted in a Norwegian standard on security-risk assessment (Standards Norway 2014). Third, after the standard had been published, a debate unfolded among security and risk professionals and public servants about the usefulness of the approach presented in the standard (Busmundrud et al 2015;Heyerdahl 2022aHeyerdahl , 2022b.…”

“…The policy in this analysis, the risk assessment approach, differs from traditional understandings of risk, where risk is presented as a combination of probability and consequence. In the risk approach investigated, risk is a combination of asset, threat, and vulnerability, without reference to probability (SN 5832;Heyerdahl 2022a). Key to the debate has been the role of probability in 1 By «government-like» we here simply refer to government being responsible for both the process and content of governmental policymaking.…”

Assessment of Economic Risks to Secure Development of Ukraine

“…As noted by some scientists (Heyerdahl, 2022;Petersen, 2012), the risk assessment theory and the security management concept are indeed tightly interrelated. The former involves perceiving threats as risks, classifying them and assessing the scale of their impact, as well as determining the risk perception capability.…”