Risk Assessment for Active Shooter/ Hostile Event Response Program
By Mark R. Richards, PE, Nortech Systems
​​

​​There’s been an alarming number of shootings and hostile events in recent years. From a bombing in Boston to shootings in Orlando and Las Vegas, incidents are becoming deadlier and deadlier. As a result, the National Fire Protection Association (NFPA) was asked to create a standard to help mitigate the loss of life and impact to a community from an active shooter/ hostile event. In quick response, NFPA created its largest technical committee to fast track the Standard for an Active Shooter/ Hostile Event Response (ASHER) Program (NFPA 3000 (PS)). This provisional standard (a standard that was completed quickly and approved with the understanding that it will be updated in the next two years) empowers communities to plan, respond, and recover from events in a unified, coordinated manner.

NFPA 3000 (PS) details how a multidisciplinary team can create an ASHER program to safeguard facilities, campuses, and communities. Such a program must be based on the results of a risk assessment. A risk assessment is used for resource allocation. It identifies threats and determines the probability and consequence of hostile events. Areas with the highest probability and consequence are at maximum risk and should be the focal point of an ASHER program.

A risk assessment includes the following four steps:

  1. Threat identification,
  2. Risk probability assessment,
  3. Risk consequence assessment, and
  4. Risk probability and consequence matrix.

The first step in a risk assessment is to identify at-risk locations. Hostile events do not occur in only one type of venue. Examples of target or at-risk locations include assemblies (cinemas, clubs, concerts, protests/ demonstrations, sporting events, etc.), educational facilities, military installations, places of commerce, and religious buildings. It’s hard to determine which location has the greatest risk without performing a thorough assessment. Areas with large numbers of people, national or public significance, or a history of violence can all be potential targets. Thus, it’s important to evaluate an entire community.

The second step in a risk assessment is to determine the likelihood of an incident occurring at a location. Targets are assigned a risk probability rating of one (low) through four (very high). The rating is affected by the following attributes:

  1. Occupant demographics,
  2. Building construction,
  3. Building location, and
  4. Building security.

The third step in a risk assessment is to analyze the consequences of an incident under worst-case conditions. Hostile events have economical, functional, psychological, and human impacts that affect the risk consequence rating. Unlike most natural disasters, the psychological impact of hostile events has a lingering affect, causing additional hardship. Impacts are evaluated for the following types of incidents:

  1. Active shooter,
  2. Hostile assailant (handheld weapons),
  3. Improvised explosive device (IED),
  4. Vehicle born attack, and
  5. Fire as a weapon.

The fourth and last step is to create a matrix by plotting the risk probability and consequence ratings. The matrix ranks potential targets in one of four quadrants. The quadrants are labeled low/isolated risk, moderate risk, high/special risk, and maximum risk. Target locations inside a quadrant are also important to differentiate levels of risk. Once targets are plotted in the matrix, their risk probability assessment can be revisited to determine possible improvements (i.e. accessibility, security, preparedness, etc.). Risk probability and consequence matrix results should be incorporated into an ASHER program.

In conclusion, community preparedness is important to mitigate the loss of life and impact from a hostile event. NFPA 3000 (PS) is a provisional standard that details how a multidisciplinary team can create an ASHER program. Such a program is used by a community to better prepare for an active shooter/ hostile event. An ASHER program must be based on the results of a risk assessment, which is used for resource allocation. Communities have finite resources. It’s important for an ASHER program to focus resources on targets of elevated risk, as determined by the risk assessment.



​​