Security risk assessment: how it’s done
A security risk assessment answers five questions in order: what we protect (assets), from what (threats), where we are exposed (vulnerabilities), how serious each scenario is (likelihood × impact on a qualitative matrix) and what we do about it (controls across people, procedures and technology). It ends with the residual risk leadership accepts, a review cycle and a deliverable anyone can audit.
Updated: 6 min readSources: 1
Where does a security risk assessment start?
With scope and assets: which site, which hours, and exactly what needs protecting — people, facilities, goods, information, operations. Without that list, the assessment rates threats with no target.
First you fix the scope: which buildings, perimeters, shifts and operations the assessment covers. Then you list the assets — anything whose loss, damage or interruption would hurt the organisation.
- People: staff, visitors, customers, contractors.
- Facilities and equipment: buildings, gates, machinery, vehicles.
- Goods and stock: whatever is stored or moved.
- Information: documents, camera footage, access logs.
- Operations: the processes that, if they stop, stop the business.
The international reference for risk management is ISO 31000:2018, which gives principles and guidelines for identifying, analysing, evaluating, treating, monitoring and communicating risk. The method below follows the same logic.
What is the difference between a threat and a vulnerability?
A threat is what could happen (theft, intrusion, vandalism, aggression). A vulnerability is the gap that lets it happen (an uncontrolled door, a camera blind spot, a shift with no patrol).
The distinction matters in practice: you rarely control threats, but you do control vulnerabilities. So the assessment records them separately, then links them into scenarios: “threat X exploits vulnerability Y and hits asset Z”.
- Sources for threats: the site’s own incident history, shift reports, conversations with staff and neighbours, the nature of the business.
- Sources for vulnerabilities: an on-site survey by day and by night, checking access points, camera coverage, lighting, keys and shift procedures.
- Testing: a scenario is tried in practice — for example, how fast the shift reacts to a door left open.
Survey the site at night too. Many vulnerabilities — lighting, patrol gaps, contractor access — only show when the site is empty.
How do you score a security risk without money figures?
With a qualitative matrix: each scenario gets a likelihood score of 1–5 and an impact score of 1–5, both defined in words, and the product places it as low, medium, high or critical.
A qualitative matrix needs no amounts. It needs definitions agreed in advance, so two people give the same scenario the same score.
- Likelihood: 1 rare (never happened, no indication) · 2 unlikely · 3 possible (has happened at a similar site) · 4 likely (has happened here) · 5 almost certain (happens repeatedly).
- Impact: 1 negligible · 2 minor (local disruption) · 3 significant (one operation stops for hours) · 4 serious (injury, disruption for days, legal exposure) · 5 critical (danger to life or to business continuity).
- Impact categories: people’s safety, continuity of operations, assets, information, legal and regulatory exposure, reputation. The worst one counts.
Example: a warehouse loading door with no control at night, two incidents in the past year. Likelihood 4, impact 4 (shipments disrupted, goods lost), score 16: a high risk that goes to the top of the action list.
Which controls reduce a security risk?
Three kinds that work together: people (guards, supervisors, training), procedures (post orders, key control, escalation) and technology (cameras, access control, alarms). A control from one kind alone rarely suffices.
- People: a static post or a patrol, supervision, training for the specific scenario. How many is a question of hours of cover — see how many security guards do I need.
- Procedures: written post orders, key control, visitor and contractor checks, escalation rules.
- Technology: cameras, access control, alarms, lighting, patrol checkpoints. Cameras come with data-protection rules — see CCTV and GDPR.
Each control is tied to the scenario it reduces and says what it changes: the likelihood (a controlled door), the impact (faster detection) or both. A control that changes no score does not belong in the assessment. For when a system is enough and when a person is needed, see security guard or security system.
What is residual risk, and how often should the assessment be reviewed?
Residual risk is the score left after controls are in place; leadership accepts it explicitly. Review the assessment at least once a year, and straight after a serious incident or a change to the site.
No control brings risk to zero. So every scenario carries two scores: before and after controls. The second is the residual risk, and someone with authority must sign that they accept it — otherwise nothing has actually been decided.
- Scheduled review: at least once a year.
- Triggered review: after a serious incident, a change in the site’s use or layout, a new shift pattern or a new activity.
- Continuous input: shift and incident reports show whether the likelihood scores were right.
What should a security risk assessment report contain?
Scope and method, the asset list, scenarios scored before and after controls, a prioritised action plan with an owner and a deadline, the residual risk that is accepted, and a review date.
- A one-page summary for leadership: the critical and high risks.
- Scope, survey dates and scoring method (the matrix definitions).
- Assets, threats and vulnerabilities, with photos and points on a site plan.
- The risk register: each scenario with its score before, its controls, its score after.
- The action plan: what, who, by when, and what proves it is done.
- Residual risk, who accepts it, and the next review date.
OVIT’s security consulting runs in four phases: scope definition; an on-site inspection of the perimeter, access points, sensor coverage and personnel compliance; a deliverable with a prioritised risk register and vendor-neutral technical specifications; and oversight of implementation.
At a glance
- Start with what you protect: people, facilities, goods, information, operations.
- A threat is what could happen; a vulnerability is the gap that allows it — and that is what you control.
- Score likelihood × impact on a 1–5 qualitative matrix with definitions agreed in advance, no money figures.
- Every control combines people, procedures and technology, and must change a score.
- Leadership accepts residual risk explicitly; review the assessment at least once a year.
Frequently asked questions
What is the difference between a threat and a vulnerability?
A threat is what could happen, such as theft or intrusion. A vulnerability is the gap that lets it happen, such as an uncontrolled door or a camera blind spot. Vulnerabilities are what you can control.
Do you need money figures to score a security risk?
No. A 1–5 likelihood × impact matrix, with each score defined in words and impact categories such as people’s safety and continuity of operations, is enough to rank risks.
How often should a security risk assessment be updated?
At least once a year, and immediately after a serious incident or a significant change to the site, its use or its shifts.
Sources
Every legal or pay point in this guide was checked against the official sources below.
Want us to look at your site?
Talk to the OVIT operations team — a real person answers.