University of Sheffield engineer leads review of UK National Security Risk Assessment

21st April 2023

A new review into the UK’s National Security Risk Assessment - an outline and assessment of the most significant risks facing the country - has been published after being led by a researcher from the University of Sheffield.

• University of Sheffield researcher has led a review into the UK’s National Security Risk Assessment - an outline and assessment the most significant risks facing the country
• New report sets out the lessons learned from an engineering perspective from the last assessment in 2019, outlines principles for good practice and a joined-up approach to risk assessment to enhance resilience
• Engineers are trained to examine complex systems, assess risks and their propagation, and construct systems for safety and resilience
• Review examined a range of practices from industries such as nuclear and chemical and explored a breadth of risks close to engineering, from cyber threats to flooding

Professor Joan Cordiner, Professor of Process Engineering at the University, has led the Royal Academy of Engineering’s review of the UK 2019 National Security Risk Assessment (NSRA) methodology. The review sets out the lessons learned from an engineering perspective on the UK’s central risk assessment. 

The report has been published ahead of a national test of the UK Emergency Alerts service this weekend (Sunday 23 April 2023).

The NSRA outlines and assesses the most significant risks facing the country and informs plans to mitigate those risks. In 2021, the Cabinet Office’s Civil Contingencies Secretariat commissioned the Academy to review the methodology behind the 2019 NSRA. Today’s (21 April 2023) report Building resilience: lessons from the Academy’s review of the National Security Risk Assessment methodology summarises the findings, which fed into the National Resilience Framework published at the end of 2022.

Engineers are trained to examine complex systems, assess risks and their propagation, and construct systems for safety and resilience. Building upon the Royal Academy of Engineering’s previous work on risk and resilience and the cross-sector experience of its Fellows, such as Sheffield academic Professor Cordiner, the review examined a range of practices from industries such as nuclear and chemical and explored a breadth of risks close to engineering, from cyber threats to flooding. 

Through case studies and interviews with major private and public sector risk owners, the review drew out lessons relevant to risk owners of all types and focused on techniques for scenario design, exploring interdependencies, and building organisational resilience. 

Seven principles for good practice were identified to help organisations employ a joined-up approach to risk assessment that strengthens resilience in practice, helping to build toward the government’s goal of “making resilience a national endeavour, so that as a country we are prepared for the next crisis, whatever it might be.” The seven principles are:

• Ensure a joined-up approach
• Encourage participation and communicate clearly
• Focus on impact
• Explore the interdependencies
• Consider a range of scenarios
• Embed new data and metrics
• Review based on need

The review also made some practical recommendations based on the limitations of the 2019 methodology, 12 of which were intended for immediate implementation and are referenced in the National Resilience Framework. A further recommendation presented a more radical, alternative ‘blank page’ approach.

Professor Joan Cordiner, from the University of Sheffield’s Department of Chemical and Biological Engineering, said: “This review has been an opportunity to learn from a diverse range of industry sectors, academia, and government. We are pleased that the review is referenced in the National Resilience Framework and I encourage all those with a stake or responsibility in risk management to reflect upon the extent to which the principles for good practice are incorporated in their risk assessments, and to act upon them.

“Implementing the lessons learned will not necessarily be easy, as risk, resilience, and organisational culture are closely intertwined. But with the lived experience of the Covid-19 pandemic, now is the time to foster a resilience-oriented culture that drives action to make the UK a safer, more prepared nation for everyone.”