An Investigator’s Introduction to Risk Management

This workshop aims to introduce participants to basic principles of risk assessment and risk management, which they can apply to their professional and personal contexts. It provide a working process and guidance on how to conduct a risk assessment and use this assessment as a tool for making decisions at an individual and/or team level.

Learning Activities

Opening (15 minutes)

Instructions for trainer

• Grab attention if needed by posing a question or commenting on a relevant topic, image, etc.

• Introduce yourself and the goals of the workshop.

• Optional: Introduce the source of the workshop material (Tactical Tech.)

• Mention as a “disclaimer” that risk is context specific and constantly evolving: participants are experts in their own environment and ultimately responsible for their own risks. If they have a particularly high level of risk, they should seek further training and professional advice.

• Inform participants of the workshop agenda.

• Suggest ground rules for the workshop, including but not limited to respect, confidentiality and equality principles. Ask participants whether they would like to modify your suggestions or add other rules. Ensure that everybody understands and agrees with the rules.

Instructions

• Facilitate a quick round of introductions by asking participants to answer a couple of questions about themselves, their work and their main expectation from the workshop. Mapping expectations at this point will allow you to make final adjustments on how to deliver the content but also to make clear what will not be addressed, and why.

• To connect the topic, you can also ask participants to share specific situations (of their own or read elsewhere) when things have gone wrong in unexpected or funny ways, and how they dealt with it. Participants may not feel comfortable sharing real-life examples so this can be optional. Mention that they should avoid sharing any private information and they can step out of the exercise if they are uncomfortable with the question.

• Alternatively, you can pick an icebreaker exercise that encourages participants to get creative by drawing answers or ideas on an online whiteboard or, if off-line, stand up and perform some tasks. Check the Icebreakers section in the Facilitator’s Guide for inspiration.

Risk Assessment (1 hour and 25 minutes)

Instructions

Make a short presentation focusing on essential points:

• Defining risk - Risk is the answer to three questions:

  • What can happen?
  • How likely is it?
  • What would the consequences be? → By answering these simple questions, we can start assessing our risk levels.

• “What can happen?” - Risk scenarios: By defining an ideal scenario (“everything goes as planned”) and all the potential scenarios that deviate from it (“something goes wrong”), we can map our objectives and identify a range of events that could prevent us from succeeding.

• Optional - Describe an example of an investigation / research / field trip relevant to participants’ context and environment:

  • Present its main objectives and define a "success scenario".
  • Break the investigation / research / field trip down into small, practical and manageable steps, in chronological order (“First, we must... Then... Finally… ”, etc.).
  • For each step, describe one or two risk scenarios that could prevent success.

RESOURCES:

• For inspiration, you can see examples from the Exposing the Invisible guide "Away From Your Screen, Out in the Field"

Tools/Material

• Risk management templates (Word files)
• NOTE: The presented templates are only examples of how to organise a risk assessment, trainer/participants can feel free to adapt or modify them as they see fit.
• This is an individual exercise, which does not require break-out rooms.

Instructions

[5 minutes]

• Ask participants to individually imagine a potential investigation. Alternatively, provide an example investigation, keeping it narrow and manageable (e.g. collect water samples to test levels of pesticide use in an area).

[15 minutes]

• Ask participants to individually fill-in the first table of the risk management template as follows:

  • Write down the investigation’s main objective(s) at the top of a page (e.g. collect 30 water samples using a specific protocol and ship them to a lab for testing).

  • Fill-in a table that includes the following sections: a. Type of activities to be performed – in chronological order (e.g. transport to site, environmental sampling, testing for pesticides, etc.)

    b. Success scenario: what will investigators do during these activities, if everything goes well. Encourage participants to be as concrete as possible, even if this means using their imagination or drawing hypotheses (e.g. Rent a camper-van and drive to the site, stay there three weeks to conduct interviews and collect samples; collect three water samples every week from ten different sites; during this time, keep the samples cold in a fridge; ship the samples to a testing lab for analysis, etc.)

    c. Potential risk scenario: What could go wrong at each step? Encourage participants to let their imagination run wild and not jump too fast into thinking about mitigation measures.

[5 minutes] Once the time is up, ask two-three volunteers to share what they have written to the larger group. Ask them what success looked like to them and whether they can give one or two examples of risk scenarios.

[5 minutes] Open the floor to other participants:

• While their colleagues were presenting, did they think of other potential risk scenarios?

• Ask participants what would be the benefit of doing this exercise as a team - rather than individually.

• Explain how working in a team can help identifying new risk scenarios and be more creative.

Instructions

Make a short presentation including the following points:

• How likely is it? What would the consequences be? - Describe how to assess likelihood and consequences using qualitative scales (e.g. consequences: "minimal / minor / serious / major / catastrophic"; likelihood: "extremely unlikely / very unlikely /unlikely / likely / very likely"). Alternatively, mention that participants can also use quantitative (1/2/3/4/5) scales.

• Ranking risks – Risk matrix - Explain how to assess risks using the matrix. An example of simple risk matrix is included in the risk management template. You can demonstrate how to place two or three difference scenarios in the matrix. Mention that the matrix is an extremely simplified tool to make decisions, reality is more complex and uncertain.

• Briefly mention the importance of risk perception and subjectivity. - Since different individuals are likely to assess similar scenarios differently, collaboration can help to better assess and prioritize risks.

• Optional: Provide an example of three or four risk scenarios identified earlier, describe how you assess their likelihood and consequences, and how you rank them by order of priority.

RESOURCE:

• "Holistic Security Manual", Tactical Tech

Tools/Materials

• Risk management templates: https://cdn.ttc.io/s/exposingtheinvisible.org/workshops/risk-assessment/ETI_Risk-Management-Templates.docx
• Breakout “rooms” online or off-line

Instructions

• Divide participants into small groups (3 to 5 people per group). Ask them to decide on a note-taker and someone to present their work to the main group.

[15 minutes] Ask participants to take one case from the previous exercise - when each participant worked individually - and to collaborate to:

• Identify potential risk scenarios — encourage each group member to contribute with new scenarios.

• Assess the likelihood and consequences of each risk scenario, using either a qualitative or quantitative scale.

• By comparing likelihood and consequences – and using a risk matrix if they wish – rank risk scenarios from the most to the least important.

• Encourage participants to identify physical and digital risks as well as how they are interconnected – do not think of them in isolation.

• Ask them to list their findings (the more the better).

[10 minutes] Once the time is up, participants go back to the main group. A representative of each group then presents the group’s case and the risks they have identified.

[5 minutes] Debriefing - sum up the main ideas resulting from the activity:

• Risk is inherited – Participants might only consider risks for themselves and less for their sources or other people they will collaborate with. Encourage them to consider everyone involved in the investigation, including colleagues, sources, investigated subjects, etc. Participants’ risk is also other people’s risk, and vice versa.

• The do no harm principle – Ask participants whether an investigation could create additional harm. In this case, should they be ready not to investigate?

• Events are uncontrollable and people are unpredictable – Participants should think of risks assessments as tools to prepare for the unexpected, rather than checklists.

• Participants might fall into the trap of thinking separately about digital and physical risks. Signal that they are closely connected and that a digital threat might have physical effects and vice-versa.

Mitigating Risk (45 minutes)

Instructions

Gove a short presentation focusing on:

• Defining risk management – To reduce the likelihood or consequences of a risk scenario or mitigate its effects after it has happened.

• Risk management can happen in three ways:

  • Reducing likelihood – Eliminate or modify the risk; put warning systems in place; etc.

  • Reducing consequences – Separate/isolate the risk; training, exercises and drills; equip to better handle the risk; etc.

  • Fixing damage – Rehearse responses to the risk; plan for relief or rehabilitation should the risk happen; etc.

• Robust strategies – When possible, favour mitigation measures that are less likely to create new risks and can be adapted to a range of scenarios. For example, setting up proof of life documents and communication plans with your team ahead of investigating can help mitigate many risk scenarios. Similarly, emergency bags are useful in a range of situations. The bottom line: prepare, prepare, prepare.

• Collaboration – By collaborating, we increase our knowledge, reduce uncertainty, question our biases and ultimately are able to better mitigate our risks. Collaborating is also important to share best practices and learn from others.

• Optional: Provide an example of a risk scenarios identified earlier. Describe three or four potential mitigation strategies, their pros and cons.

Tools/material

• Risk management templates (Word files)
• Breakout “rooms” online or off-line

Instructions

• Divide participants into small groups (3 to 5 people per group) – if possible, keep the same groups as the previous exercise. Ask them to decide on a note-taker and someone to present their work to the main group.

[15 minutes] For the risk scenario assessed and prioritized in the previous exercise, ask participants to work together to:

• Identify two or three mitigation strategies for reducing each scenario’s likelihood and consequences or limiting its impact in case it happens.

• Discuss how they would put this mitigation measures in place. Encourage participants to think about practical aspects, as well as new risks that could arise as a result of their actions.

[10 minutes] Once the time is up, participants go back to the main group.

• A representative of each group presents the group’s case, including:

  • the mitigation measure they have identified,
  • how they would implement it, and
  • what new risks they have identified during this phase.

[5 minutes] Debriefing - sum up the main ideas resulting from the activity:

• Participants share some of the risk mitigation solutions they came up with.

• You can comment and add to their ideas.

• Emphasize that risk assessment is an iterative process. Putting mitigation measures in place can, in turn, generate new risks that should be assessed.

Closure (20 minutes)

Tools/material

• "Risk Assessment - guiding questions" sheet

Instructions

• Briefly mention that proactively assessing and managing risk can seem tedious at first. Once participants master the process, risk assessments can be done fairly quickly. There is only one way to get there: practice.

• Encourage participants to apply what they have learnt during the session by using the "Risk Assessment – guiding questions" sheet in their own time and for every project / investigation. This guiding sheet will help them assess the risks associated with any activity they undertake.

• Encourage participants to write down the results of their assessment, as well as any questions that arise during the process.

• Encourage participants to share their notes with you and the rest of the group via a safe communication channel or a shared cloud space. You can share your feedback and comments with the group at a later point or organise a post-workshop feedback session, if possible.

Instructions

• Wrap up the workshop and sum up its contents.

• Run a quick review of the session. Each participants would say:

  • one thing they found very good about the session and
  • one thing they would improve for the next time

• You can encourage participants to ask questions or give some final tips.

• Share contact information if relevant and any follow-up details.

Further Resources

• "Safety First!", guide in Exposing the Invisible - The Kit

• "Security in a Box", guides and tutorials on digital security for civil society.

• "Holistic Security Manual". A Tactical Tech manual about physical and digital security and well-being when researching and investigating in action - it also includes a Trainer’s manual to help develop holistic security workshops.

• Pre-assignment considerations, recommendations and guides, from the Committee to Protect Journalists.

• Templates of risk assessments, proof of life documents, communication plans, from the Rory Peck Trust.

• Basic safety guides and tutorials from the Electronic Frontier Foundation (EFF)

• Safety and security guides from the Global Investigative Journalism Network (GIJN), and a list of organisations working in the civil society safety and security support field.

• Workbooks and resilience training from Front Line Defenders.

• BSAFE, the UN’s security awareness training.

• Tipsheets, resources and templates from the Dart Center for Journalism and Trauma.

Contact Us

Please reach out to us at Exposing the Invisible if you:

• have any questions about this workshop plan and facilitation guidelines,

• use this workshop plan and want to share feedback and suggestions that can help to improve them,

• adapt the workshop plan to a specific context and want to share the results with us,

• want to suggest new activities, tips or examples that can be added to this workshop,

• want to share your expertise and collaborate with us on developing and testing new workshops.

Contact: eti@tacticaltech.org (GPG Key / fingerprint: BD30 C622 D030 FCF1 38EC C26D DD04 627E 1411 0C02).

Credits and Licensing

CC BY-SA 4.0

This content is produced by Tactical Tech's Exposing the Invisible project, and licensed under a Creative Commons Attribution-ShareAlike 4.0 International license

• Workshop author: Léopold Salzenstein

• Instructional design: A. Hayder

• Editorial and content: Christy Lange, Laura Ranca, Wael Eskandar

• Graphic design: Yiorgos Bagakis

• Website development: Laurent Dellere, Saqib Sohail

• Project coordination and supervision: Christy Lange, Laura Ranca, Lieke Ploeger, Marek Tuszynski, Safa Ghnaim, Wael Eskandar

This resource has been developed as part of the Collaborative and Investigative Journalism Initiative (CIJI) co-funded by the European Commission under the Pilot Project: "Supporting investigative journalism and media freedom in the EU" (DG CONNECT).

This text reflects the author’s view and the Commission is not responsible for any use that may be made of the information it contains.