If a disaster happened in your community, how would it affect your organization? Does your organization possess both the internal and external capacity to withstand the risks related to the emergency?

As a Ready Rating member, you may have given some thought to these questions before. However, to create effective preparedness plans, organizations must ensure that they have not overlooked or underestimated potential risks. The best way to do so is to conduct a hazard vulnerability assessment (HVA).

An HVA helps stakeholders identify which hazards pose the most risk to an organization, the impact of each scenario, and the resources available to aid in its response and recovery.

Whether you are creating preparedness plans for the first time or updating existing documents, understanding the risks your organization may face — and your ability to withstand them — is key during an emergency. Not only will it allow you to prioritize your preparedness goals, but it will also enable you to develop more effective plans.

HAZARD, RISK AND VULNERABILITY Before beginning your assessment, let’s review the concepts that support HVAs: hazard, risk and vulnerability. The terms are related but distinct, and how they interact paints the overall picture of your organization’s disaster readiness.

  • Hazards are natural or human-caused events or conditions that may cause harm (including injury, illness and death), structural damage or loss of other assets.
  • Risk refers to the likelihood that a hazard will occur and harm people, organizations or infrastructure.
  • Vulnerability signifies the extent to which people or organizations may be negatively affected when exposed to a hazard; the capability to effectively avoid a hazard or respond to and recover from a disaster reduces vulnerability.,[i], [ii]

The relationship between these concepts will differ depending on various external and internal factors. For instance, a hazard that is unlikely to occur in your community poses little risk to your organization. Alternately, if your organization has failed to take precautionary steps to protect any of its assets, the effects of exposure to a hazard may be worsened.  

ASSESSING RISKS To begin your HVA, first determine which hazards make your organization vulnerable. You can reach out to your local emergency management agency and obtain its HVA, which may be available on its own or as part of your community’s Comprehensive Emergency Management Plan (CEMP). The document will help you understand known hazards in your community.

Whether using your local emergency management’s research or starting from scratch, you will need to brainstorm which hazards — both natural and human-caused — may pose a risk to your organization. [iii] As you create your list, consider the following:

  • What emergencies are common to your community and organization? Historical data and incident reports can give you clues.
  • Does your location impact your risk? Proximity to seismic faults, floodplains, hazardous storage sites or potential targets of terrorism can introduce risk to your organization.
  • Are the physical conditions of your facility or facilities hazardous? Emergencies may begin within the walls of your organization if dangerous supplies are improperly stored, exit routes are obstructed or construction of the building itself is poor.
  • What types of emergencies may be caused by human error? Unintentional acts by your employees caused by a lack of training, an instance of a memory lapse or fatigue can easily cause accidents.

As you think through these scenarios, keep in mind that many hazards can lead to secondary hazards. For instance, an earthquake might result in damaged water lines, which could then cause flooding, structural and water damage and prolonged interruptions to business operations. Consider consulting your colleagues, members of your emergency response planning committee or external stakeholders throughout this process, as they can provide additional information about risks to your organization and your community.

After developing a list of potential hazards, then determine the extent to which each could impact your organization. Human impact is the most critical factor; hazards that can cause significant injuries or loss of life should be prioritized over those that pose less of a threat to your employees and members of the public.

Next, consider the impact on your business. Certain hazards may be more likely to damage your organization’s physical assets or interrupt its operations than others. Also consider the potential for reputational damage. As a result of how your organization does (or does not) respond to an emergency or disaster, your organization’s relationships with its customers, stakeholders and community partners may be altered.

ASSESSING CAPABILITIES In the second step of the HVA process, turn your attention to your organization’s strengths. If your organization is able to mitigate or withstand a hazard, that hazard no longer poses a risk. However, if your organization lacks certain capabilities, it is considered vulnerable to a hazard, and preparedness activities should be diverted to that area.

To conduct this portion of the analysis, consider your organization’s internal and external capabilities. Internal capabilities include the plans and policies that affect its response to and recovery from emergencies and disasters, for example, evacuation plans, health and safety programs, employee manuals, facility closure policies, security procedures and insurance policies. Other pertinent factors include your organization’s personnel, equipment and facilities. Consider the following:

  • Have staff received basic first aid and CPR/AED training? Have they taken part in preparedness drills and exercises?
  • Is there sufficient equipment on hand, including safety supplies, to ensure continuity of operations?
  • Will your facility enhance safety during an emergency or disaster? Are evacuation routes clearly marked? Are the communications systems working?

To help you determine your organization’s capabilities, read the EAP Assessment page in the Resource Center.

External factors may also reduce your organization’s vulnerability to hazards. These can include emergency service providers in your community or in neighboring communities, your local emergency management agency and vendors that supply your organization’s products or services. Review any mutual aid agreements to identify community partners that may be able to assist you during and after an emergency or disaster. You can also establish new agreements, whether formally or informally, with other organizations. Consider reaching out to other businesses in your community, the National Weather Service or your local American Red Cross chapter to establish if and how you can assist each other when a disaster occurs.

PUTTING IT ALL TOGETHER By the end of the HVA, you should understand which hazards are most likely to affect your organization and the impact each would have on its operations. It is not feasible to prepare for every conceivable scenario. Instead, by assessing your organization’s vulnerabilities, you can consider each hazard to determine which would be most consequential. If your organization does not possess sufficient capabilities to effectively respond to those hazards, it is at risk. To easily measure hazards and complete your HVA, visit the Ready Rating Resource Center to download the Hazard Vulnerability Assessment Worksheet

[i] Federal Emergency Management Agency, IS-556: Damage Assessment for Public Works. https://emilms.fema.gov/is556/indexMenu.htm

[ii] United States Climate Resilience Toolkit, Glossary. https://toolkit.climate.gov/content/glossary

[iii] For examples of common hazards, see Ready.gov’s Risk Assessment: https://www.ready.gov/risk-assessment