Step 1
Threat
Improvised explosive attack against a fixed target in a capital-city district with a history of complex attacks.
Security management · Risk assessment
Security risk assessment, from threat to residual risk
A risk assessment is only useful when the reasoning is visible. This shows the chain a security manager works through, the levels at which it is applied, and how the result is recorded so leadership can accept or reject the residual risk.
Illustrative analytical example — demonstrates method, not operational guidance for a specific organisation.
The assessment chain
Step 2
Vulnerability
Office sits on an arterial road with limited stand-off, a single approach and predictable staff arrival timings.
Step 3
Exposure
Twenty-two national and international staff present between 08:00 and 17:00, with visitor traffic on set days.
Step 4
Impact
Potential fatalities and serious injury, structural damage, programme suspension and prolonged staff-care obligations.
Step 5
Mitigation
Stand-off improvement, blast film, access control and search, arrival-time variation, safe room, drill rhythm, casualty plan.
Step 6
Residual risk
Reduced but not eliminated. Held at a level the organisation has formally accepted, with a named owner and quarterly review.
Applied at five levels
| Level | What it covers | What it decides |
|---|---|---|
| Country | National threat environment, governance, conflict dynamics, legal and regulatory exposure. | Board risk appetite, country-entry decisions, insurance and donor assurance. |
| Regional | Sub-national conflict geography, armed-group influence, access and administrative control. | Programme footprint decisions and regional movement policy. |
| City | Urban threat pattern, district exposure, incident clustering, guarding and residence standards. | Office and residence siting, curfews, movement approval levels. |
| Operational area | Site, compound, distribution point or field base and its immediate surroundings. | Site security standards, staffing posture, community engagement. |
| Route / corridor | Road segment, checkpoints, hostile-act history, road condition and communications coverage. | Journey approval, timing, convoy rules and abort criteria. |
Risk matrix
Register entries plotted by likelihood and impact. Reference numbers correspond to the register below.
| Insignificant | Minor | Moderate | Major | Severe | |
|---|---|---|---|---|---|
| Almost certain | MODERATE risk. — | SUBSTANTIAL risk. — | SEVERE risk. — | CRITICAL risk. — | CRITICAL risk. — |
| Likely | LOW risk. — | MODERATE risk. R-05 R-06 | SUBSTANTIAL risk. R-04 | SEVERE risk. R-07 | CRITICAL risk. — |
| Possible | LOW risk. — | MODERATE risk. — | MODERATE risk. R-09 | SUBSTANTIAL risk. R-02 R-08 | SEVERE risk. R-01 |
| Unlikely | LOW risk. — | LOW risk. — | MODERATE risk. R-10 | MODERATE risk. — | SUBSTANTIAL risk. R-03 |
| Rare | LOW risk. — | LOW risk. — | LOW risk. — | LOW risk. — | MODERATE risk. — |
- LOW
- MODERATE
- SUBSTANTIAL
- SEVERE
- CRITICAL
Illustrative risk register
| Ref | Risk | Category | L | I | Rating | Primary controls | Owner |
|---|---|---|---|---|---|---|---|
| R-01 | Complex or explosive attack affecting a fixed site | Armed conflict / terrorism | 3 | 5 | SEVERE | Site hardening, access control, safe room, drills, casualty plan | Country Director |
| R-02 | Roadside attack or crossfire on an inter-city corridor | Armed conflict | 3 | 4 | SUBSTANTIAL | Journey approval, timing windows, comms checks, abort criteria | Security Manager |
| R-03 | Detention or abduction of staff by an armed group | Abduction | 2 | 5 | SUBSTANTIAL | Vetting of movement, low-profile posture, crisis-management plan | Regional Director |
| R-04 | Programme interruption from access denial at checkpoints | Access | 4 | 3 | SUBSTANTIAL | Access negotiation, documentation discipline, alternate routing | Programme Manager |
| R-05 | Civil unrest affecting urban movement and offices | Civil unrest | 4 | 2 | MODERATE | Movement pause thresholds, remote-working plan, stock buffer | Security Manager |
| R-06 | Criminal theft or armed robbery against staff or assets | Criminality | 4 | 2 | MODERATE | Cash-handling rules, guarding standard, residence standards | Operations Manager |
| R-07 | Road traffic collision during field movement | Safety | 4 | 4 | SEVERE | Driver standards, vehicle checks, speed policy, night-travel ban | Fleet Manager |
| R-08 | Medical emergency in a location with limited care | Duty of care | 3 | 4 | SUBSTANTIAL | Medical screening, first-aid cover, referral pathway, insurance | HR Manager |
| R-09 | Flooding cuts supply and staff-movement routes | Natural hazard | 3 | 3 | MODERATE | Seasonal pre-positioning, route alternatives, contingency stock | Logistics Manager |
| R-10 | Loss of communications during field deployment | Communications | 2 | 3 | MODERATE | Redundant comms, check-in schedule, no-contact procedure | Security Manager |
Applied assessments
Somalia — country, regional and city assessments
The method above applied to Somalia at three levels. Each assessment states a threat level in UK terminology, the drivers behind it, the risks that shape decisions with likelihood and impact rated, the mitigation for each, and the assumptions, confidence and public sources the judgement rests on.
Country assessmentSEVEREAn attack is highly likely.
Somalia — country assessment
Armed opposition capability, contested territorial control and a security transition in progress. For civilian organisations the practical risk is concentrated in movement, in the predictability of routines, and in the standard of the sites they occupy.
Risk drivers
- Sustained capability to mount explosive and complex attacks in urban centres, directed mainly at government and security targets.
- Contested control on inter-city corridors, with informal checkpoints and taxation reported by transporters.
- A security transition that produces short-lived gaps in control in districts adjoining main routes.
- Clan and political competition that can turn local disputes into armed confrontation at short notice.
- Climatic shocks — drought and flooding — that displace people and reshape access without any change in the threat picture.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| SO-01 | Staff caught in the effects of an explosive attack on a nearby government, security or hotel target | 4 | 5 | CRITICAL | Site selection with stand-off; avoid venues used by officials; keep exposure at high-profile locations short; safe-room standard and drills. |
| SO-02 | Ambush or IED against vehicle movement on an arterial or inter-city route | 3 | 5 | SEVERE | Route risk assessment per journey; varied timing and routing; day-of-travel road check; written abort criteria held by the vehicle commander. |
| SO-03 | Detention, extortion or delay at an informal checkpoint | 4 | 3 | SUBSTANTIAL | Checkpoint mapping with transporters; documented no-payment position; scripted responses; single point of contact for negotiation; report every event. |
| SO-04 | Abduction of staff for ransom or leverage | 2 | 5 | SUBSTANTIAL | Reduce pattern predictability; restrict advance disclosure of movement; vetted drivers and vehicles; crisis-management plan rehearsed with named roles. |
| SO-05 | Programme suspension through loss of access following a security or political event | 4 | 3 | SUBSTANTIAL | Partner-led contingency delivery; remote monitoring capability; pre-agreed suspension and resumption criteria. |
| SO-06 | Crime against staff and premises, including armed robbery and theft | 4 | 2 | MODERATE | Access control and guarding standards specified in contract; cash-handling limits and rules; residence security survey. |
| SO-07 | Aid diversion or association with an armed actor damaging acceptance | 3 | 4 | SUBSTANTIAL | Partner vetting and due diligence; distribution monitoring; community feedback channels; clear public position on independence. |
| SO-08 | Medical emergency without timely access to adequate care | 3 | 4 | SUBSTANTIAL | Medical capability mapped before deployment; first-aid trained staff on movement; documented referral and evacuation arrangement with a named provider. |
Assumptions
- · No fundamental change in armed-opposition capability or intent during the assessment period.
- · Security-force transition continues broadly on its stated course rather than collapsing or accelerating sharply.
- · Organisation maintains a low-profile posture and does not adopt armed protection.
Confidence
Moderate — the pattern is consistently reported in open sources, but district-level verification is limited and route conditions change faster than reporting confirms.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment
Regional assessmentSEVEREAn attack is highly likely.
South-Central Somalia (Banadir, Lower Shabelle, Bay)
The highest concentration of both programme activity and armed-opposition capability. Urban proximity risk and corridor risk sit alongside each other, and the two require different controls.
Risk drivers
- Attack capability concentrated in and around Mogadishu and along the Afgooye and Baidoa corridors.
- Frequent changes in control of route segments outside main towns.
- Displacement into urban settlements, increasing programme presence in dense, hard-to-secure locations.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| SC-01 | Proximity exposure in Mogadishu to attacks on government and security targets | 4 | 5 | CRITICAL | Stand-off and access control at sites; venue vetting; short exposure at high-profile locations. |
| SC-02 | Checkpoint extortion, delay or detention on the Afgooye and Baidoa corridors | 4 | 3 | SUBSTANTIAL | Checkpoint mapping refreshed with transporters and partners; documented no-payment position; scripted responses; every interaction reported. |
| SC-03 | Loss of a corridor segment mid-journey, leaving staff between safe locations | 3 | 4 | SUBSTANTIAL | Fallback location named for every leg; communications check schedule; authority to hold or return delegated to the vehicle commander. |
| SC-04 | Distribution disruption or crowd incident at a site in a dense settlement | 3 | 3 | MODERATE | Site layout and queue management planned with the community; separate entry and exit; abort criteria agreed before the activity. |
| SC-05 | Local armed dispute affecting a programme location | 3 | 3 | MODERATE | Community engagement and early-warning contact; suspension threshold agreed in advance; no armed presence at sites. |
Assumptions
- · Programme delivery continues to rely on road movement rather than air for most inter-district activity.
- · Community acceptance remains the primary protection at programme sites.
Confidence
Moderate — corridor conditions are described consistently by transporters and partners but are rarely independently verified.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment
Regional assessmentSUBSTANTIALAn attack is likely.
Puntland & Somaliland
A materially different picture from South-Central: more predictable administration and lower attack tempo, with risk concentrated around contested boundaries, coastal areas and periods of political tension.
Risk drivers
- Disputed administrative boundaries, including around Sool and Sanaag, where tension can escalate quickly.
- Armed-group activity reported in the Golis mountain areas of Puntland.
- Political and electoral competition that periodically produces unrest in urban centres.
- Coastal and maritime exposure, including reporting on piracy and irregular movement.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| PS-01 | Escalation of a boundary dispute affecting movement or programme presence | 3 | 4 | SUBSTANTIAL | Avoid contested boundary areas without a specific assessment; monitor local political reporting; suspension criteria agreed in advance. |
| PS-02 | Unrest around political events in Garowe, Hargeisa or Bosaso | 3 | 3 | MODERATE | Event calendar maintained; movement curtailment during announced events; staff briefed on avoidance rather than observation. |
| PS-03 | Armed incident in the Golis and adjacent rural areas | 2 | 5 | SUBSTANTIAL | No routine movement into affected areas; specific authorisation and escort arrangements only where unavoidable and lawful. |
| PS-04 | Road traffic accident on long inter-city routes | 4 | 4 | SEVERE | Journey management with rest schedule; daylight-only travel; vehicle standards and driver assessment; medical plan for the route. |
| PS-05 | Crime against staff and premises in urban centres | 3 | 2 | MODERATE | Residence and office security survey; access control; cash-handling rules. |
Assumptions
- · Administrations continue to permit programme presence and movement on current terms.
- · No sustained escalation of boundary disputes into open conflict during the assessment period.
Confidence
Moderate — political reporting is reasonably accessible; rural areas are far less well covered.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment
City assessmentSEVEREAn attack is highly likely.
Mogadishu
Proximity risk dominates. Where an organisation sits, how it moves and how predictable it is matter more than any single procedure.
Risk drivers
- Attacks on government precincts, security facilities and hotels used by officials.
- Airport road and arterial route exposure during routine transfers.
- Dense urban environment where stand-off is difficult to achieve.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| MG-01 | Attack on a nearby target affecting an office, residence or venue in use | 4 | 5 | CRITICAL | Site survey with stand-off, blast-mitigation glazing where feasible, vehicle screening at the gate, safe room and quarterly drills. |
| MG-02 | IED or small-arms incident during an airport or arterial transfer | 3 | 5 | SEVERE | Varied timing and routing; day-of-travel route check; minimum-occupancy rules; abort criteria held in the vehicle. |
| MG-03 | Inherited risk from a meeting venue with weak access control | 4 | 4 | SEVERE | Venue vetting before use; preference for own premises; exposure kept short; no repeat pattern at the same venue and time. |
| MG-04 | Crime, including armed robbery, against staff off duty | 3 | 3 | MODERATE | Off-duty movement rules; approved locations only; residence security standards; curfew aligned to assessment. |
| MG-05 | Delay or detention at a checkpoint inside the city | 3 | 2 | MODERATE | Documentation carried and current; scripted responses; report every interaction to build the pattern. |
Assumptions
- · Organisation maintains civilian, unarmed posture and does not co-locate with security or government facilities.
- · Airport transfers remain the most frequent movement requirement.
Confidence
Moderate to high on the pattern of attack in Banadir; moderate on route-specific conditions.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment
City assessmentSUBSTANTIALAn attack is likely.
Kismayo
Comparatively contained inside the town, with the significant exposure on approach routes and at the boundary of controlled areas.
Risk drivers
- Armed opposition presence in the surrounding hinterland.
- Regional political competition affecting local security arrangements.
- Limited road access, concentrating movement into few predictable routes.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| KS-01 | Incident on the approach route or at the edge of controlled area | 3 | 5 | SEVERE | Air movement preferred for staff rotation; overland only with specific assessment and stated abort criteria. |
| KS-02 | Political friction affecting programme access or permissions | 3 | 3 | MODERATE | Relationship management with authorities; documentation current; suspension and resumption criteria pre-agreed. |
| KS-03 | Crime and opportunistic theft against premises | 3 | 2 | MODERATE | Access control, guarding standards in contract, asset and cash controls. |
| KS-04 | Medical emergency with limited local capability | 3 | 4 | SUBSTANTIAL | Capability mapped in advance; referral and air-transfer arrangement documented with a named provider. |
Assumptions
- · Air access remains available for routine rotation.
- · Local authorities continue to permit programme presence.
Confidence
Moderate — reporting from Kismayo and Lower Juba is thinner than for Banadir.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment
City assessmentSEVEREAn attack is highly likely.
Baidoa
A major displacement hub with substantial programme presence, reached mainly along a corridor where control changes.
Risk drivers
- Corridor exposure between Mogadishu and Baidoa, including checkpoints and reported taxation.
- Large displacement settlements with dense, hard-to-secure programme sites.
- Armed opposition presence in surrounding districts.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| BD-01 | Attack or ambush on the corridor during overland movement | 3 | 5 | SEVERE | Air movement as default; overland only on specific assessment, in daylight, with fallback locations named and abort criteria written. |
| BD-02 | Checkpoint extortion or detention en route | 4 | 3 | SUBSTANTIAL | Checkpoint mapping refreshed with transporters; no-payment position documented; single negotiation point of contact. |
| BD-03 | Crowd or security incident at a distribution site in a settlement | 3 | 3 | MODERATE | Site layout planned with community leaders; separate entry and exit; agreed abort criteria; no armed presence. |
| BD-04 | Targeting of staff perceived as associated with authorities | 2 | 5 | SUBSTANTIAL | Visible independence; no co-location with security actors; community engagement maintained separately from authorities. |
Assumptions
- · Air access to Baidoa continues.
- · Community acceptance remains the primary protection at settlement sites.
Confidence
Moderate — corridor conditions are reported consistently but change quickly.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment
City assessmentMODERATEAn attack is possible, but not likely.
Hargeisa & Garowe
The most stable urban environments in the assessment, where routine risk is crime, road traffic and periodic political unrest rather than armed attack.
Risk drivers
- Functioning municipal administration and policing.
- Political and electoral events that periodically produce unrest.
- Long inter-city routes with significant road traffic risk.
Risk register and mitigation
| Ref | Risk | L | I | Rating | Mitigation |
|---|---|---|---|---|---|
| HG-01 | Road traffic accident on inter-city movement | 4 | 4 | SEVERE | Journey management, daylight-only travel, rest schedule, vehicle standards, driver assessment, medical plan by route. |
| HG-02 | Unrest around a political or electoral event | 3 | 3 | MODERATE | Event calendar; movement curtailment; avoidance briefing; office closure criteria. |
| HG-03 | Crime against staff or premises | 3 | 2 | MODERATE | Security survey, access control, cash-handling rules, off-duty guidance. |
| HG-04 | Complacency producing weak procedure adherence | 4 | 2 | MODERATE | Same reporting and journey discipline as higher-risk locations; periodic assurance check. |
Assumptions
- · No sustained escalation of boundary disputes affecting the urban centres during the assessment period.
Confidence
Moderate to high — urban reporting is reasonably accessible and consistent.
Sources
- · ACLED conflict event data
- · UN OCHA Somalia situation reporting
- · Insecurity Insight aid-security reporting
- · Somali national and regional media monitoring
- · INGO ADVISORY analyst assessment