Risk & Vulnerability Assessment
for Food and Agriculture
Shaun Kennedy
Director, National Center for Food Protection and Defense
Assistant Professor, Veterinary Population Medicine
University of Minnesota
Go Global: Emerging Threats in the Food and Feed Chain
Delhi
11 – 11 - 2008
CODEX Risk Management Definition
“The process, distinct from risk assessment, of
weighing policy alternatives, in consultation with
all interested parties, considering risk
assessment and other factors relevant for the
health protection of consumers and for the
promotion of fair trade practices, and, if needed,
selecting appropriate prevention and control
options.”
FAO/WHO Risk Evaluation Process
• Identification of a food safety problem
• Establishment of a risk profile
• Ranking of the hazard for risk assessment and
risk management priority
• Establishment of risk assessment policy for
conduct of risk assessment
• Commissioning of risk assessment
• Consideration of risk assessment result
Risk Assessment
• An analytical process to provide
information regarding undesirable events
• The process of quantification of the
probabilities and expected consequences
for identified risks
Food Safety Risk Assessment:
Preventing System Failure
Exposure Likelihood
Low
Medium
High
Severe
Impact
Moderate
Mild
Food Safety
HACCP Domain
Vulnerability Assessment
• Systematic approach used to analyze the
effectiveness of the overall (current or
proposed) security system
Food Defense Vulnerability Assessment:
Preventing Successful System Attack
Exposure Likelihood
Low
Severe
Impact
Moderate
Mild
Defense
Domain
Medium
High
Disgruntled insider
Criminal
Protestors
Subversives
Terrorists
Increasing ease of access
•
•
•
•
•
Increasing sophistication
Types of Aggressors
Current Tools:
Operational Risk Management
• NASA/DoD engineering approach to
reduce risk of failure of complex systems
• Risk a function of severity & probability
• Very effective at reducing risk within an
operation or system
• Results not readily comparable across
operations or systems
http://safetycente
r.navy.mil/orm/de
fault.htm
ORM Process
• Identify the hazards
• Assess potential consequences
• Determine which risks to manage with which
interventions
• Implement the interventions
• Assess the success of the interventions and
modify as necessary
ORM for Food Defense
• Utilized by U.S. Food and Drug Administration
(FDA) in early assessments
• Severity evaluated only in public health
consequences terms in FDA efforts
– Doesn’t have to be limited to public health
• Probability difficult to define given that there is
no normal probability distribution
ORM - Identify the Hazards
•
•
•
•
•
What could be added to contaminate the food?
Where could it be added?
How much could be added?
Where could the supply chain be disrupted?
How could it be disrupted?
ORM - Assess Potential Consequences
• How many people would likely eat the product?
• What is the projected morbitity/mortality?
• How much would the supply chain disruption
cost the country
• What is the total economic impact?
• How likely could an aggressor succeed?
ORM - Severity
• Public health consequences on a four point scale
–
–
–
–
Low
Medium
High
Very high
• If numerical measures available, one order of
magnitude per level typically used
ORM - Probability
• Likelihood estimated on a five point scale
–
–
–
–
–
Very low (unlikely)
Low (seldom)
Medium (occasionally)
High (regularly)
Very high (frequently)
• Requires translation into probability if someone
has intent and means
ORM Ranking Grid
Probability
Very
High
S
e
v
e
ri
t
y
High
Medium
Low
Very High
High
Medium
Low
RISK LEVELS
Very Low
Determine Risks/Interventions
• Which risks are severe enough that they must
be managed?
• What interventions are likely to reduce the risk?
• What is the cost of the intervention?
• Does the intervention just shift the risk or does
it reduce the risk?
Implement/Assess The Intervention
• How hard was it to put in place?
• How much has it reduced the risk?
• Is the overall system/facility risk now
acceptable?
• Repeat – Repeat – Repeat
Current Tools – CARVER+Shock
• CARVER+Shock
– Department of Defense approach for targeting
assets for greatest impact
– Within an operation or system, used to
identify the nodes of greatest concern
– Results not readily comparable across
operations or systems
– Currently used by FDA & USDA
CARVER+Shock
•
•
•
•
•
•
•
CRITICALITY: public health & economic impact
ACCESSABILITY: target physical access
RECUPERABILITY: overall system resiliency
VULNERABILITY: attack feasibility
EFFECT: direct loss from attack
RECOGNIZABILITY: ease of target identification
SHOCK: psychological implications of the attack
Criticality Criteria
Scale
Loss of over 10,000 lives OR loss of more than $100 billion
9 – 10
Loss of life is between 1,000 – 10,000 OR loss between $10 billion and 7 – 8
$100 billion
Loss of life between 100 and 1000 OR loss between $1 and $10 billion
5–6
Loss of life less than 100 OR loss less than $1 billion
3–4
No loss of life OR loss less than $100 million
1–2
Accessibility Criteria
Scale
Easily Accessible - Limited physical or human barriers or observation. Attacker 9 – 10
has relatively unlimited access to the target. Attack can be carried out using
medium or large volumes of contaminant without undue concern of detection.
Accessible - Human observation and physical barriers limited. Attacker has access 7 – 8
to the target for an hour or less. Attack can be carried out with moderate to
large volumes of contaminant, but requires the use of stealth.
Partially Accessible - Under constant possible human observation. Some physical 5 – 6
barriers may be present. Contaminant must be disguised, and time limitations
are significant.
Hardly Accessible - Human observation and physical barriers with an established 3 – 4
means of detection. Access generally restricted to operators or authorized
persons. Contaminant must be disguised and time limitations are extreme.
Not Accessible - Physical barriers, alarms, and human observation. Defined 1 – 2
means of intervention in place. Attacker can access target for less than 5
minutes with all equipment carried in pockets.
Recuperability Criteria
Scale
> 1 year
9
6 months to 1 year
7–8
3-6 months
5–6
1-3 months
3–4
< 1 month
1–2
–
10
Effect Criteria
Scale
Greater than 50% of the system’s production impacted
9
25-50% of the system’s production impacted
7–8
10-25% of the system’s production impacted
5–6
1-10% of the system’s production impacted
3–4
Less than 1% of system’s production impacted
1–2
–
10
Scale
Recognizability Criteria
Target is clearly recognizable - requires little or no training 9 – 10
for recognition
Target is easily recognizable - requires only a small amount 7 – 8
of training for recognition
Target is difficult to recognize or might be confused with 5 – 6
other targets or target components - requires some
training for recognition
Target is difficult to recognize. It is easily confused with 3 – 4
other targets or components - requires extensive training
for recognition
Target cannot be recognized under any conditions, except 1 – 2
by experts.
Shock (Historical, cultural, religious or symbolic importance and:)
Scale
Major importance. Loss of over 10,000 lives. Major impact on sensitive 9-10
subpopulations, e.g., children or elderly. Economic impact >$100
billion.
High importance. Loss of between 1,000 and 10,000 lives. Significant
impact on sensitive subpopulations, e.g., children or elderly.
Economic impact between $10 and $100 billion.
7-8
Moderate importance. Loss of between 100 and 1,000 lives. Moderate
impact on sensitive subpopulations, e.g., children or elderly.
Economic impact between $1 and $10 billion.
5-6
Little importance. Loss of less than 100 lives. Small impact on
3-4
sensitive subpopulations, e.g., children or elderly. Economic impact
between $100 million and $1 billion.
No importance. Loss of life less than 10. No impact on sensitive
subpopulations, e.g., children or elderly. National economic impact
<$100 million.
1-2
Product:
Target Complex: Filler Sure Tank
Target Node:
FACTOR
CRITICALI
TY
ACCESSIBI
LITY
RECUPERA
BILITY
VULNERAB
ILITY
EFFECT
RECOGNIZ
ABILITY
SHOCK
OVERALL
RANK
SCOR
E
JUSTIFICATION
Vulnerability Assessment
Considerations
• Hoax or threat inclusion shifts relative
economic vulnerability/risk results
– Time to definitively refute a hoax or threat
without existing interventions too long for
some scenarios
– Certain food & agriculture systems are more
susceptible to the negative consequences of
potential public/stakeholder reaction to a
hoax or threat
“Defending the safety
of the food system
through research and education”