Calculating Risk

Updated Jan 2023: simplified the explanation of risk and made the article clearer.

One of the aspects we need to constantly assess is risk. Risk is present on everything and it can vary depending from something very innocuous to something catastrophic. As a commuter and traveler, learning to assess risk is something that has to become second nature - and no, you don’t need to be a Tier 1 operator or an experienced mountaineer to do it.

Risk is the probability of something happening coupled with how serious it would be if it happens. In general terms, a risk is composed of two variables: threats and vulnerabilities (or weaknesses). For example, if there is the threat of a crime in a specific city and you as a commuter wear flashy clothing, shiny jewelry, and walk with an air of being the boss, then you are a target and thus vulnerable to the threat of crime. So, in this case the risk is high because the commuter is vulnerable.

As an urban commuter (and as part of the philosophy) being aware of what’s going around you is a must, and that includes constantly making risk decisions. We do those anyway, every day, we are just not aware of them. Small risk assessments dictate how we react to things and how we decide on and select specific things. It’s what has kept us and our ancestors safe. Assessing risk is part of being human, and it’s common sense, but people are so often wrapped up in their own thoughts and their digital devices that they don’t take the time to listen to their guts or to actually make a conscious calculation of risk.

For a risk to be relevant, either the threat or vulnerability need to be true. Think about it as an equation: risk = threat x vulnerability. If you make the threat or the vulnerability zero, or lessen their effect, then the risk becomes lower and in some cases ceases to exist.

With the risk assessments then, always try to think of what threats are present in the city or location, whether you are vulnerable to them, and how you will mitigate them. Focus on either canceling the threat, or making sure you are not vulnerable to them.

There are a few things we can do to help with this:

• Gather information. A key aspect of mitigating risk is knowing it is there in the first place. The more you know about something, the more you can assess the risks involved, and the more you can prepare mitigating controls. Always understand the environment as much as possible.
• Lower complexity. When the situation is very complex (like a fire in a train station and a stampede of commuters trying to get out) the equation might not work because there are too many moving parts and too many possible outcomes. Always try to remove complexity as much as possible. Remember, minimize complexity and simplify personal security.
• Be smart. If you gather information and lower complexity then you can make a decision. If you still think the activity is worth doing in spite of the risk, it’s ok, but be smart and give yourself an out. Visualize the things that can go wrong and have a plan for them. Think about how you’d react if the risk becomes a reality.

However, in some cases you can’t remove the threat, the prevalence of crime in a location for example, or the vulnerability, looking different when traveling to another country. In those cases you need to really focus on building different layers of protection that can help you push the threats away from you.

If the threat is present, then can you mitigate it by not being there? What can you proactively do to prevent it from happening, or at least affecting you? If it does happen, what can you do to minimize the effects? Same with vulnerabilities. If you are vulnerable, then what are the results of that weakness being attacked? What can you do to put a protective layer around you to make the vulnerability less of an issue? How would you remove the vulnerability, and how would you know it is there in the first place?

Understand that in some cases you are the issue, and that by being in a place, or acting a certain way, you are becoming part of the risk equation. Risk assessments, then, really need to happen constantly.

Ultimately you have to make a decision. Ask yourself the following questions:

• What can go wrong?
• What are you going to do about it?
• Is it worth it?

The last point being mostly relevant for situations where risk can result in significant harm (or death) or other high impact results.

If all of this is a "yes" in your mind, because you can mitigate the risk or you are willing to accept it, then you go execute and commit fully to whatever was you were trying to asess. However, keep in mind that no matter how good you are at assessing risk, something will always go wrong. Mr. Murphy is always present. Your success and wellbeing will depend on how you respond, and this is dependent on the muscle memory you have developed through mental drills and exercises (yes, including actually walking an exit route and practicing emergency activities).

Build the ability to assess risk, and be on constant watch. It doesn’t take a lot to do this and the benefits are great. Remember to always look around, assess the situation, and make a decision based on the information you just gathered.

Be safe.