7.4 Risk Assessment & the Response Decision
Key Takeaways
- BST teaches a four-step risk assessment: identify the hazard or threat, assess the risk, control or respond, then review and record.
- Risk is the combination of how likely harm is and how severe it would be — a low-likelihood, catastrophic hazard can outrank a frequent nuisance.
- Controls are applied in order of effectiveness: eliminate, substitute or engineer out the hazard first, then administrative controls, then personal protective equipment, and only then a physical response.
- Force sits at the far end of the control hierarchy, is assessed against the same four steps, and is lawful only where Criminal Code ss.34-35 or a lawful s.494 arrest justify it.
- The fourth step is the one guards skip: reassess as the situation changes, and record the assessment so the decision can be defended later.
7.4 Risk Assessment & the Response Decision
Why this matters for the BST exam: One of the three published outcomes in the Basic Security Procedures unit is to "explain the four basic steps for risk assessment, including safely applying force, when conducting an incident response." Exam items on this outcome test whether you assess before you act, and whether you understand that force is a control measure of last resort inside a risk assessment — not a separate decision made on instinct.
The Four Steps
| Step | Question you answer | On a security post |
|---|---|---|
| 1. Identify | What could cause harm here? | A propped fire door, an unlit stairwell, a hostile subject, a spill, a blocked exit |
| 2. Assess | How likely is harm, and how bad would it be? | One aggressive person vs. a crowd; a wet floor vs. a live electrical hazard |
| 3. Control / respond | What is the most effective control I can actually apply? | Remove the hazard, barrier it, warn, call for help, withdraw — and only at the far end, use force |
| 4. Review | Did the control work, and has anything changed? | Reassess continuously, then record the assessment and the outcome |
This is the same cycle WorkSafeBC applies to any workplace hazard, which is why it appears in both the security-procedures and health-and-safety parts of BST.
Step 1 — Identify
Hazards fall into predictable families, and knowing the families is faster than trying to spot everything fresh:
- People — aggressive or impaired persons, crowds, unauthorised entrants, lone-worker exposure.
- Environment — poor lighting, ice, wet floors, blocked or locked egress, unguarded edges, weather.
- Energy and equipment — electrical, machinery, vehicles, compressed gas, heat.
- Structure and site — confined spaces, construction, unstable stock, unsecured openings.
- Process — cash handling, shift change, deliveries, alarm response, lock-up.
Identification is not a one-off. You identify at the start of shift on the walk-round, again at every new location, and again the moment anything changes.
Step 2 — Assess
Risk is likelihood × severity. A simple mental matrix is enough:
| Low severity | High severity | |
|---|---|---|
| Low likelihood | Monitor | Plan and prepare |
| High likelihood | Fix on the spot | Stop, withdraw, escalate |
Two assessment errors show up in complaints and on the exam:
- Familiarity discount. The stairwell light has been out for three weeks, so it stops registering as a hazard.
- Severity blindness. A rare hazard with a catastrophic outcome — a blocked fire exit in an occupied venue — gets ranked below the daily nuisance you keep tripping over.
Assess your own capacity honestly at this step: are you alone, is police response twenty minutes away, is your radio working, is there a camera? Those facts change the risk, not just the response.
Step 3 — Control or Respond
Apply controls in order of effectiveness, not in order of convenience:
- Eliminate — remove the hazard. Unprop and re-lock the door; move the pallet blocking the exit.
- Substitute or engineer — change the conditions. Turn on the lights; put a barrier and a cone around the spill; open the gate remotely instead of approaching a hostile driver.
- Administrative — change behaviour and procedure. Reroute the patrol, call a second officer, request police, warn occupants, evacuate.
- Personal protective equipment — high-visibility vest, gloves, footwear. PPE protects only you, and only partly, which is why it sits low.
- Physical intervention, including force — the last resort, and only where the law justifies it.
A guard who reaches step 5 without having genuinely tried steps 1 to 4 has both a safety problem and a legal problem, because the reasonableness of any force is judged partly on what alternatives were available.
Where Force Fits
"Safely applying force" appears inside this outcome for a reason: force is a control measure, and it is assessed with the same four steps.
- Identify — what specifically is the threat? A shove, a weapon, an escape attempt?
- Assess — likelihood and severity of harm to you, the subject, and bystanders if you act; and if you do not.
- Control — is there any lower control still available? Distance, a barrier, verbal direction, withdrawal, waiting for police?
- Review — the moment resistance stops, the justification stops. Force must be de-escalated continuously, and Code of Conduct s.14(h) prohibits unnecessary force.
The legal gate sits on top of the risk assessment, not instead of it: force is lawful only where it is justified under Criminal Code ss.34–35 (defence of person or property) or is reasonable force used in a lawful s.494 arrest. A risk assessment can tell you force would be effective; only the Criminal Code can tell you it is lawful.
Property is never the justification for accepting serious risk to a person — including your own. A shoplifter running toward traffic is a report to write, not a tackle to make.
Step 4 — Review and Record
The step guards skip. Reviewing means two things:
- Reassess during the incident. Conditions change; a second subject arrives, a weapon appears, the crowd grows. The assessment you made ninety seconds ago is stale.
- Record afterwards. Write down the hazard you identified, the assessment you made, the control you chose, and why you rejected the alternatives. This is what turns "I felt it was necessary" into a defensible account, and it is the entry that protects you in a complaint, a civil claim, or a Registrar investigation.
Worked Scenario
On a night patrol of a Richmond warehouse you find the personnel door forced. You are alone, your radio works, the interior is dark, and police are fifteen minutes out.
Identify: forced entry, possible person inside, darkness, lone worker. Assess: likelihood of an occupant is real; severity if you meet them alone in the dark is high; you have no backup and no interior view. Control: eliminate is not available — you cannot make the building safe from inside. Engineer: illuminate from outside, use the vehicle as cover. Administrative: call police, notify the monitoring station, hold a position covering the door, log vehicle plates in the lot. PPE is irrelevant. Force is not on the table at all, because there is no threat to your person to defend against. Review: update police as anything changes, and record the whole sequence at the end.
Entering alone would fail at step 2 and step 3 simultaneously, and no report afterward would rescue it.
Key Takeaway
Identify, assess, control, review — every time, in that order. Work down the hierarchy of controls before you consider physical intervention, treat force as a controlled measure that must also clear a separate legal test, and write the assessment down. On the exam, the option that acts before assessing, or that treats property as worth a physical risk, is always wrong.
What are the four basic steps of the risk assessment BST teaches for incident response?
Where does the use of force sit within the hierarchy of controls applied during an incident response?
A guard finds a fire exit blocked by stacked pallets in an occupied venue but ranks it below a recurring wet-floor complaint because nobody has ever been hurt by the pallets. Which assessment error is this?