6.1 Risk Analysis Strategies, Principles & Data Interpretation

Risk Analysis Strategies, Principles, and Data Interpretation

By the time Domain 1 Task 5 begins, the team already holds an asset list, a threat and hazard picture, a vulnerability survey, and a stack of notes. Risk analysis is the step that turns that stack into decisions: what is inherent, what is residual after treatment, and which treatment is honest. Independent OpenExamPrep teaching for published PSP Domain 1 tasks is that analysis is not a second walkthrough and not a catalog of cameras. It is a disciplined read of evidence against a short set of risk-management principles.

Exam focus: Rate the pairing, not the building. Separate inherent from residual. Let logs and observation test stories before a matrix cell moves.

Three Analysis Strategies You Will Actually Use

Physical security teams rarely get a clean laboratory. You still have to choose a strategy that matches the quality of the data you collected in Task 4.

Qualitative matrices

A qualitative matrix—commonly 3×3 or 5×5—plots likelihood against consequence using ordinal labels such as low, medium, and high. Color bands help leadership see concentration. Use a matrix when you must rank many loss events in one picture and when dollar history is thin. The matrix does not create facts. It displays a judgment you still have to defend with a named threat or hazard, a named vulnerability, and a named consequence.

The professional trap is scoring the site as one cell. A campus is not a loss event. Score pairings: the pharmacy after hours, the dock at shift change, the generator room in a flood. A second trap is moving a cell because a vice president wants a red square for budget theater. If the evidence did not change, the cell should not change.

Semi-quantitative scoring

Semi-quantitative work assigns numbers—often 1–5 for likelihood and 1–5 for consequence, sometimes with a detectability or existing-control factor—and multiplies or adds them into a rank. Those numbers remain ordinal. A 20 outranks an 8. It is not twenty dollars of expected loss and it is not a calibrated probability. Chapter 2 already treated workshop scores as ranking tools, not currency. Task 5 uses the product only to order treatment conversations. After the rank, write residual risk in words, or in dollars where incident history and asset values actually support dollars.

If two events both score 16, do not pretend the arithmetic settled which one to treat first. Read the how. A 16 that kills people outranks a 16 that steals landscaping equipment, even when the spreadsheet is blind to that distinction.

Scenario workshops

A scenario workshop walks a small cross-functional group through a timed story: if this adversary or this hazard meets this weakness, what happens in the first hour, the first day, and the first week? Workshops catch sequences a matrix cell hides. A flood that also kills the video system that would have documented looting is one event, not two unrelated rows. Keep the room small, time-boxed, and tied to assets you already valued. Facilities, operations, IT, EHS, and a security lead belong there. A vendor who needs to sell a platform does not belong in the scoring chair.

Do not let the loudest story set the score. The night supervisor’s single frightening encounter is a lead for verification, not an automatic “critical” rating for the whole perimeter.

Risk-Management Principles: Identify, Analyze, Evaluate, Treat, Monitor

Physical security risk work follows a cycle that enterprise risk programs also use, even when the forms differ.

1. Identify — assets, threats and hazards, vulnerabilities, and existing measures. Tasks 1–4 already did this labor. Analysis that re-identifies “the facility” as one blob has gone backward.
2. Analyze — estimate likelihood and consequence for each credible pairing. Separate inherent risk from residual risk. State assumptions (hours of operation, whether a camera is actually watched, whether a generator has fuel).
3. Evaluate — compare analyzed risk to the organization’s risk appetite and to a legal and life-safety floor. Appetite is a leadership choice. The floor is not. You do not evaluate a blocked exit into “accepted residual.”
4. Treat — avoid, mitigate, transfer, or accept, with a named owner and a due date. Treatment without an owner is a wish.
5. Monitor — incidents, tests, occupancy changes, new neighbors, failed maintenance, and bypassed procedures. Monitor is not a courtesy close-out paragraph. It is the feed that sends you back to analyze.

Skipping evaluate produces “we should buy everything on the integrator’s list.” Skipping monitor produces a report that was true on Tuesday and false after a remodel moved the dock office.

Inherent Risk Versus Residual Risk

Inherent risk is the risk of a loss-event pairing before you credit the countermeasures you are counting on, or the risk if those measures fail as designed. Residual risk is what remains after selected treatments are in place and operating. Exam items punish mixing the two.

If you rate a pharmacy as “low” solely because a camera exists, you have already jumped to residual—and you may be wrong even there, because a camera that nobody watches does not detect. State inherent first: high-value stock, public corridor, night hours, single-leaf door, key in an unlocked desk. Then state residual after lock hardware, alarm, dual-control procedure, and a watched or alarmed camera path.

Residual assumes as-operated, not as-specified. A maglock on a drawing that staff wedge open every delivery does not reduce residual risk. A central-station contract that expired last quarter does not reduce residual risk. Write the bypass in the analysis; do not hide it inside a green cell.

Four Treatments, Used on Purpose

• Avoid — do not start, or stop, the activity that creates the pairing. Do not store bulk lithium cells in a basement flood zone. Do not put a public clinic waiting room on the same leaf as a cash vault door. Avoidance is a business decision with a security input, not a locksmith trick.
• Mitigate — reduce likelihood, consequence, or both with structural, electronic, procedural, or personnel measures. Mitigation is the usual PSP recommendation. It is not the only honest one.
• Transfer — insurance, indemnity, landlord duties, or shared operations. Read exclusions. Transfer rarely moves life-safety duty off the occupancy. A policy that pays for stolen laptops does not treat a blocked exit.
• Accept — residual sits inside appetite, an accountable owner signs, and monitoring continues. Acceptance without a name is neglect dressed as a meeting minute.

Treatments can stack. You may mitigate a dock and still transfer a slice of cargo theft through insurance. You may accept a low-value landscaping-shed pairing while you refuse to accept an inherent life-safety pairing.

Interpreting Survey Data Without Drowning in Anecdotes

Task 4 collection gives you interviews, photographs, incident logs, crime statistics, drawings, and direct observation. Anecdotes are leads, not ratings. Three night-shift stories about a “creepy guy at the fence” send you to the logs, the lighting, and the fence line. If three years of incident data show zero fence events and the fabric and lighting are intact, you do not inflate residual to “critical” so a camera package will pass a budget committee. If the logs are empty because nobody records events, the empty log is itself a vulnerability in the monitoring step.

Practical rules that keep analysis honest:

• Weight contemporaneous records and what you saw on the walk higher than remembered stories, then still verify a vivid story that might reveal an unlogged tailgate.
• National or citywide crime rankings do not set a cell for this dock. They may support a workshop conversation about likelihood; they do not replace site history.
• When qualitative rank and a dollar estimate disagree, write why. Do not average them in a hidden cell.
• One photograph of an unlocked IT closet is evidence. Twenty photographs of the same closet are not twenty times the risk.
• After-hours observation often contradicts daytime interviews. If the attendant “always” staffs the dock, watch a shift change.

The output of 6.1 is not a purchase order. It is a ranked set of pairings, each with inherent and residual language, a treatment posture, and a paper trail that a later auditor or an exam item can follow. The next section writes those pairings as loss-event profiles. The diagram below is the cycle you are scoring against, not a slogan for the report cover.