Hazard Identification, Threat Assessment, and Risk Analysis
Risk equation
Risk analysis combines probability (likelihood) and consequence (impact), often expressed as Risk = Threat × Vulnerability × Consequence. The Hazard Vulnerability Analysis (HVA) is the standard hospital tool, scoring hazards on probability, human impact, property impact, business impact, and preparedness. Candidates should know the HVA is qualitative/semi-quantitative, updated annually, and drives mitigation and planning priorities.
Hazard categories
Classify hazards: natural (hurricane, earthquake, flood, pandemic), technological (chemical release, utility failure, cyberattack), and human-caused/adversarial (active shooter, terrorism). Know that risk perception is biased (dread factor, recency), and that formal analysis corrects for this.
Threat vs. vulnerability vs. risk
A common trap is conflating terms: a threat is a potential source of harm; a vulnerability is a weakness that increases susceptibility; risk is the combination of likelihood and consequence given the vulnerability. Reducing vulnerability (e.g., backup generators, hardening) reduces risk even when the threat is unchanged.
Tools
Know the difference between HVA, THIRA (Threat and Hazard Identification and Risk Assessment, used for community capability targets), and a gap analysis. THIRA defines capability targets; the HVA prioritizes within a facility.
Rule of thumb: You cannot eliminate a threat, but you can reduce vulnerability-so most preparedness actions target vulnerability and consequence.
Worked example: A hospital in a floodplain scores high probability and high consequence. Raising generators above flood level reduces vulnerability and therefore risk, even though the flood threat is unchanged.