Risk Registers, Huh! What Are They Good For?

Spread the love

From Climate Scepticism


Absolutely nothing

The hype

Earlier this week the Deputy Prime Minister and Secretary of State, Oliver Dowden, honoured the good folk of Hartlepool with his presence, doing one of those hardhat interviews that are symbolic of a hands-on, no-nonsense approach to governing the country. On this occasion he was there to promote the activities of energy supplier SSE Able Seaton, who are in charge of the construction of what is destined to be the world’s largest offshore windfarm, due for location on Dogger Bank. When completed, the farm will comprise 277 wind turbines, each of which will be 260m in height, so we are not talking about a trivial investment here. Indeed, given the cost of the undertaking, and the extent to which transition to intermittent wind technology runs the risk of destabilising electricity supply, one would hope that the government has a very good reason for supporting and promoting the project. Publicly providing the necessary endorsement was, of course, what the hard-helmeted Dowden was in Hartlepool to do. And what better way to do it than to use the occasion to announce the publication of the latest incarnation of the National Risk Register, and to draw attention to what it has to say regarding climate change and energy security. Speaking to camera, he said:

“Well the first duty of government is to keep people safe, and in my whole experience as a minister during the pandemic, the more information you give people, you give businesses, the better prepared we can be, and this National Risk Register is giving more information than ever before about the risks facing this country, whether it’s from cyber, whether it’s from energy resilience, which is why I am here today, where we are building the world’s largest offshore wind factory facility, or whether it’s in relation to pandemics.”

So there you have it. Windfarms are necessary to keep people safe, in much the same way that the government did during the pandemic by keeping us all so well-informed. As for the detail, well it must all be in the register.

Reporting upon that detail, it is clear the Guardian had received the memo, as they ran with:

Disruption to energy supplies after Russia’s invasion of Ukraine, and another pandemic, are two of the most significant risks to the UK shown in an updated government register that declassifies some threats for the first time.”

Similarly, the BBC, never one to miss an opportunity to put climate change front and centre, ran with:

“A future pandemic and extreme weather caused by climate change are among the key risks facing the UK, according to a new government register.”

Whilst others had a different take. For example, there was this:

“UK calls artificial intelligence a ‘chronic risk’ to its national security.”

And this:

“Likelihood of another pandemic and assassination of public figure revealed in national risk register.”

Or this from the Daily Mirror:

“Nuclear attack and internet blackout warning as 89 biggest threats facing UK revealed.”

I could go on, but the point already made is this: If the purpose of having a national risk register was to ensure that we would all be on the same page regarding our priorities of concern (particularly on Dowden’s page in which climate change and energy resilience seem to top the list) then it has already failed miserably. All that appears to have resulted is an orgy of cherry-picking that merely reflects the prior concerns of the journalists involved. But should we just all agree upon ‘future pandemic’, combined with whatever can be used to justify Net Zero, and leave it at that? Is that actually what the register says? Well, if you care to know the answer to these questions, then I invite you to read on.

The Register

Before I get down to detail, there are one or two general comments that I simply must get off my chest.

When first reading the register I found it very difficult to shake off the suspicion that the whole thing was just a massive PR exercise designed to reassure everyone that the government was fully in control. Dowden himself did much to raise this suspicion by saying in a press release:

“This is the most comprehensive risk assessment we’ve ever published, so that government and our partners can put robust plans in place and be ready for anything.”

Really? Ready for anything? Like they were ready for Covid-19? And has Dowden never heard of black swans?

Meanwhile, the register’s preamble is full of rhetoric designed to bolster confidence. For example:

“By focusing on our collective resilience, we can help the nation be more safe, more secure – and in turn, more prosperous. This National Risk Register plays a vital role in that process, allowing us to build towards an even brighter future.”

What? Even brighter? I’m an aging diabetic watching Europe slip towards World War III. So it’s going to get even brighter than that?

And as for the rigour of the process:

“This edition of the NRR is based directly on the NSRA – an internal, classified risk assessment that is used within government and by local resilience forums and their equivalents in Scotland and Northern Ireland. The NSRA is produced using a rigorous and well-tested methodology, based on international best practice. It draws on input and challenge from hundreds of experts from UK Government departments, devolved administrations, the government scientific community, intelligence and security agencies, and independent experts. The process is evidence led with 25,000 pieces of data used in the latest full assessment, finalised in autumn 2022.”

Rigorous and well-tested, eh? International best practice, eh? Hundreds of experts, eh? Evidence led, eh? Well you don’t need to say any more. You had me at ‘used within government’.

But if I may be allowed to get technical for a moment, the thing that struck me most was the register’s pseudo-quantification of the risks. The register uses a standard 5×5 risk matrix to classify the risks in terms of impact and likelihood. So far, so good – such matrices are just a two dimensional list used to prioritize risks for attention. However, they then tart up the matrix by applying a logarithmic scale and plotting the risks as points with error bars, thereby making the matrix look superficially like a graph. It all seems to be part of a ploy, used to give a false impression of scientific rigour. Well, I’ll be taken in just as soon as you can explain to me how subjective terms such as ‘limited’, ‘moderate’ and ‘significant’ can be allocated logarithmically.

But what of the detail? That, after all, is where the devil is supposed to lie. Let’s start by looking at the risks with the highest plausible impacts. In order of likelihood, the following were all deemed to be potentially ‘catastrophic’ to the UK:

1st Pandemic

=2nd A large-scale Chemical, Biological, Radiological and Nuclear (CBRN) terrorist attack

=2nd Complete failure of the National Electricity Transmission System (NETS)

=4th Civil nuclear accident

=4th Radiation release from overseas nuclear site

Whilst there is no explicit mention of natural disaster in the above list, it should be noted that an extreme weather event is posited as a possible cause of a complete NETS failure.

Of those risks that are deemed the most likely to materialise, the only ones considered to entail potentially even ‘moderate’ impact upon the UK are:

  • Terrorist attacks in venues and public spaces
  • Technological failure at a UK critical financial market infrastructure
  • Disaster response in the Overseas Territories
  • Attack on a UK ally or partner outside NATO or a mutual security agreement requiring international assistance

But what about the prospect of gas supplies being cut off? After all, isn’t that the biggest risk of all? Did Dowden suffer a visit to Hartlepool for nothing?

Well, it is difficult to say. Such a possibility features in the register only as part of a scenario in which there is an attack against a NATO ally or UK deployed forces, which meets the Article 5 threshold. This risk is described in the body of the register but it does not feature in the risk matrix. And if it isn’t in the matrix, we have no evaluation to work with. I suspect this omission may be for security reasons, but it is strange that the Guardian didn’t notice it.

Meanwhile, what about the BBC’s obsession: wildfires, heatwaves, storms, flooding and drought? Well, apart from the rather fanciful prospect of a storm knocking out the whole of the NETS, there is nothing in the register to get too excited about. Whilst heatwaves and major flooding are thought to be potentially ‘significant’, that is no more so than the potential impact of a cold weather event. Furthermore, severe cold weather events are judged to be significantly more likely to occur. Certainly, nothing in the weather event category comes close to earning the ‘catastrophic’ label.

The Unregistered

Earlier I suggested that the problem with risk registers is that, by their very nature, they can’t deal with the black swans that in reality dominate the risk profile. Consequently, it is perhaps instructive to dwell for a while upon the risks that do not appear to have made it onto the National Risk Register.

First, despite what the Daily Mirror thinks, there is no entry to deal with the possibility of a strategic nuclear attack upon the UK. Instead, there is an entry covering conventional attack, which carries a footnote that alludes to an unincluded, classified assessment of nuclear attack. The risk I referred to earlier regarding the triggering of Article 5 talks of disruption to gas supplies, and yet fails to consider the possibility of nuclear escalation. Presumably that is because there is nothing in nuclear escalation that could possibly help the Net Zero cause. There is certainly no mention of the catastrophic impact that any conflict may have on Dowden’s beloved Dogger Bank windfarm. So much for energy resilience.

Accidental nuclear escalation between other countries is included but the register seems only concerned with the impact this may have on British Nationals overseas, together with any indirect consequences for the UK. Finally, there is mention of nuclear fallout within the UK, but this is as a result of terrorist activity or a nuclear power accident.

Then there are all those missing entries associated with the Net Zero project. Nothing, for example, regarding blackouts during prolonged spells of becalmed weather. Nothing regarding the economic and societal fallout from a severe restriction on future transportation and travel. Nothing regarding the likely failure to meet the Net Zero target simply because of the sheer impracticality of it all. Nothing regarding the environmental risks associated with ramping up battery production to the levels required. Nothing regarding the political, economic and social instabilities that such a transition may entail. Nothing regarding the severe national security risks associated with becoming dependent upon a technology industry almost entirely dominated by China. And nothing regarding the almost total failure to deal with the climate risks that the UK’s Net Zero transition is intended to address — unless the ‘developing’ countries play their part. If Net Zero related actions get a mention, they are only identified as risk management measures, they are never considered to be risks in themselves. This is another reason why the National Risk Register comes across as being little more than a government PR exercise.

But let us not get too overwrought about any of this. Anybody who has ever been involved in creating risks registers for their organisation could tell you how fruitless the exercise generally seems to be. The risk that materialises and causes the most damage is almost invariably one not to have been registered. Those who should be taking note of the contents of the register never seem to do so. And the primary source of corporate risk is never external but always seems to have its genesis in the misdemeanours of the boardroom. Dowden put his finger on it when he said that the primary duty of a government is to keep its people safe.

And with that in mind I have to say that the greatest risk to the citizens of the UK has to be the UK government.


Please note that this article inaccurately implies that the risk of an attack on gas supply is not featured in the NRR risk matrix. This implication follows from the fact that the only military conflict scenario that suggests such an attack is the triggering of Article 5, and the risk of Article 5 being triggered is not featured in the matrix. Whilst this is true, the article should have recognised that the risk of disruption to the gas infrastructure is also described as a ‘Geographic Risk’ and, as such, is covered in the risk matrix under the generic ‘Conventional attacks on infrastructure’. No such attacks are deemed to be potentially ‘catastrophic’ and none are deemed to carry the highest likelihood.