S

Definition(s)

---

Subjective Probability

Interpretation or estimate of probability as a personal judgment or ―degree of belief‖ about how likely a particular event is to occur, based on the state of knowledge and available evidence Sample Usage: Analysts use their knowledge of terrorist strategies, objectives, and capabilities in combination with evidence from operations to estimate a subjective probability of 10 percent for an attack to occur within the next five years. Annotation:

1. Like all probabilities, subjective probability is conventionally expressed on a scale from zero to one where zero indicates the event is impossible and one indicates the event has or certainly will occur.
2. Within the subjective probability interpretation, it is possible to estimate probabilities of events (using experts or models) that have not previously occurred or that have only rarely occurred, such as acts of terrorism. However, because subjective probabilities incorporate historical or trial data when available, the subjective probability will approximate the frequentist probability as data becomes more plentiful.
3. Subjective probability is currently one of the most common uses of probability among statisticians and the risk analysis community.
4. Bayesian probability is colloquially used as a synonym for subjective probability. In statistical usage, Bayesian probabilistic inference is an approach to statistical inference that employs Bayes’ theorem to revise prior information using evidence.

Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Subject Matter Expert ω:

Individual with in-depth knowledge in a specific area or field. Sample Usage: A subject matter expert was consulted to inform team members on improvised nuclear devices. Annotation: Structured techniques for the elicitation of expert judgment are key tools for risk assessment. Subject matter experts are also used to supplement empirical data when needed, or to provide input on specialized subject areas for the purposes of designing and executing risk assessments. Frequently abbreviated as SME. Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Strategic Risk

Risk that affects an entity’s vital interests or execution of chosen strategy, whether imposed by external threats or arising from flawed or poorly implemented strategy. Sample Usage: An analysis of the organization's strategic risk considered threats to carrying out its essential mission functions. Annotation:

1. Managing strategic risk is associated with the ability to recognize future trends, challenges, and threats and match these with appropriate operational concepts, capabilities, competencies, and capacity.
2. Strategic risk can arise from three basic sources. First, strategic risk can arise from the actions of adversaries, from natural hazards or from non-adversarial human actions, such as accidents. These can be thought of as imposed risks. Second, strategic risk can be created by the unintended consequences of the strategies we adopt in response to imposed risks. These can be thought of as self-imposed risks. Finally, strategic risk can arise from obstacles to successful implementation of an adopted strategy. These obstacles can be either imposed (e.g., the actions of an adaptive adversary to counter a security measure or to exploit an unintended vulnerability created by a security measure) or self-imposed (e.g., failure to adequately resource, or to prematurely abandon, a strategy or course of action that would otherwise be beneficial.

Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Strategic Foresight

Range of activities associated with longer range planning and alternative futures analysis. Sample Usage: The organization’s strategic foresight initiative called for horizon scanning and analysis of the long-term implications of security policies. Annotation: Strategic foresight can be applied to activities such as scenario development, critical thinking and brainstorming about long-term trends, Delphi sessions, workshops, trend analysis and gaming (or "war-gaming"). Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Simulation

Model that behaves or operates like a given process, concept, or system when provided a set of controlled inputs Sample Usage: The scientists designed a simulation to see how weather affected the plume of smoke. Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Social Amplification of Risk

Distortion of the seriousness of a risk caused by public concern about the risk and/or about an activity contributing to the risk. Sample Usage: Social amplification of risk can result in public concern with an otherwise insignificant risk. Annotation:

1. Describes the phenomenon by which hazards interact with psychological, social, institutional, and cultural processes in ways that may amplify or attenuate the public's perceived level of risk.
2. The social amplification of risk phenomenon is the subject of a field of study that seeks to systematically link the technical assessment of risk with sociological perspectives of risk perception and risk-related behavior.

Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Semi-quantitative Risk Assessment Methodology

Set of methods, principles, or rules to assess risk that uses bins, scales, or representative numbers whose values and meanings are not maintained in other contexts Sample Usage: By giving the "low risk, "medium risk," and "high risk" categories corresponding numerical values, the assessor used a semi-quantitative risk assessment methodology. Annotation: While numbers may be used in a semi-quantitative methodology, the values are not applicable outside of the methodology, and numerical results from one methodology cannot be compared with those from other methodologies. Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Secondary Consequence

Effect that is not a direct consequence of an event, incident, or occurrence, but is caused by a direct consequence, subsequent cascading effects, and/or related decisions. Sample Usage: The secondary consequence of a terrorist threat on a subway could be the decreased use of public transportation over time. Annotation:

1. Examples of indirect consequences can include the enactment of new laws, policies, and risk mitigation strategies or investments, contagion health effects, supply-chain economic consequences, reductions in property values, stock market effects, and long-term cleanup efforts,
2. Accounting for indirect consequences in risk assessments is important because they may have greater and longer-lasting effects than the direct consequences.
3. Indirect consequences are also sometimes referred to as ripple, multiplier, general equilibrium, macroeconomic, secondary, and tertiary effects.
4. The distinction between direct and indirect consequences is not always clear but what matters in risk analysis is a) capturing the likely effects – be they designated as direct or indirect – that should be part of the analysis, b) clearly defining what is contained as part of direct consequences and what is part of indirect consequences, and c) being consistent across the entire analysis. Such consistency and clarity is important for comparability across scenarios and risk analyses.
5. Induced consequences are occasionally estimated separately from indirect consequences but should be contained within indirect estimates.

Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance

Definition(s)

---

Scenario (risk)

Hypothetical situation comprised of a hazard, an entity impacted by that hazard, and associated conditions including consequences when appropriate. Sample Usage: The team designed a scenario involving a terrorist attack at a plant to help assess the risk of certain types of terrorist attacks. Annotation: A scenario can be created and used for the purposes of training, exercise, analysis, or modeling as well as for other purposes. A scenario that has occurred or is occurring is an incident. Source: DHS Risk Lexicon, U.S. Department of Homeland Security, 2010 Edition. September 2010 Regulatory Guidance