An Investigator’s Introduction to Risk Management

This workshop aims to introduce participants to basic principles of risk assessment and risk management, which they can apply to their professional and personal contexts. It provide a working process and guidance on how to conduct a risk assessment and use this assessment as a tool for making decisions at an individual and/or team level.

Workshop Overview

Topic: Mindset, methods and tools to help manage risks before, during and after the investigation

Aims:

  • To introduce participants to basic principles of risk assessment and risk management, which they can apply to their professional and personal contexts.
  • To provide a working process and guidance on how to conduct a risk assessment and use this assessment as a tool for making informed decisions.
  • To demonstrate the importance of developing a “risk and safety mindset” for investigators (as individuals and teams) rather than adopting an automatized behaviour and a set of standard tools and methods.

Learning outcomes:

  • Assess different types of risk for individuals and teams.
  • Identify ways to address and manage identified risks.
  • Apply context relevant methods and tools for risk assessment and mitigation.

General guidelines for trainers:

  • This workshop can be divided into 30-40 minute long sessions. Breaks are not included in the timeline; you can decide when to allocate them based on your context. Between sessions, you can add a short break or a quick energizer activity.
  • For group activities, divide participants into teams of 3-5 people. Please adapt times allocated to feedback and post-exercise discussions/debriefing based on the number of participants and size of groups. You can also encourage participants to assign various roles when working in groups. These roles can include Facilitator, Note-taker, Timekeeper, Presenter or Artist (if a visual presentation is required.)
  • For online workshops, we recommend sharing a timer on the screen during energizers and small group activities.
  • Whenever possible, adapt the workshop examples to the context of your audience.

Mode of delivery: online / in-person workshops

Workshop duration (without breaks): 2 hours and 45 minutes

Number of participants: 6 to 24

Related workshops:

Related Exposing the Invisible articles and guides:

Workshop activities and templates, to download:

Learning Activities

Opening (15 minutes)

Workshop Introduction

Read Watch Listen | 5 minutes

Instructions for trainer

  • Grab attention if needed by posing a question or commenting on a relevant topic, image, etc.

  • Introduce yourself and the goals of the workshop.

  • Optional: Introduce the source of the workshop material (Tactical Tech.)

  • Mention as a “disclaimer” that risk is context specific and constantly evolving: participants are experts in their own environment and ultimately responsible for their own risks. If they have a particularly high level of risk, they should seek further training and professional advice.

  • Inform participants of the workshop agenda.

  • Suggest ground rules for the workshop, including but not limited to respect, confidentiality and equality principles. Ask participants whether they would like to modify your suggestions or add other rules. Ensure that everybody understands and agrees with the rules.

Participants' Introductions / Check-in

Produce | 10 minutes

Instructions

  • Facilitate a quick round of introductions by asking participants to answer a couple of questions about themselves, their work and their main expectation from the workshop. Mapping expectations at this point will allow you to make final adjustments on how to deliver the content but also to make clear what will not be addressed, and why.

  • To connect the topic, you can also ask participants to share specific situations (of their own or read elsewhere) when things have gone wrong in unexpected or funny ways, and how they dealt with it. Participants may not feel comfortable sharing real-life examples so this can be optional. Mention that they should avoid sharing any private information and they can step out of the exercise if they are uncomfortable with the question.

  • Alternatively, you can pick an icebreaker exercise that encourages participants to get creative by drawing answers or ideas on an online whiteboard or, if off-line, stand up and perform some tasks. Check the Icebreakers section in the Facilitator’s Manual for inspiration.

Risk Assessment (1 hour and 25 minutes)

Introduction to Risk and Scenarios

Read Watch Listen | 15 minutes

Instructions

Make a short presentation focusing on essential points:

  • Defining risk - Risk is the answer to three questions:

    • What can happen?
    • How likely is it?
    • What would the consequences be? → By answering these simple questions, we can start assessing our risk levels.
  • “What can happen?” - Risk scenarios: By defining an ideal scenario (“everything goes as planned”) and all the potential scenarios that deviate from it (“something goes wrong”), we can map our objectives and identify a range of events that could prevent us from succeeding.

  • Optional - Describe an example of an investigation / research / field trip relevant to participants’ context and environment:

    • Present its main objectives and define a "success scenario".
    • Break the investigation / research / field trip down into small, practical and manageable steps, in chronological order (“First, we must... Then... Finally… ”, etc.).
    • For each step, describe one or two risk scenarios that could prevent success.

RESOURCES:

Identifying Risk Scenarios: Individual Exercise

Produce | 30 minutes

Tools/Material

  • Risk management templates (Word files)
  • NOTE: The presented templates are only examples of how to organise a risk assessment, trainer/participants can feel free to adapt or modify them as they see fit.
  • This is an individual exercise, which does not require break-out rooms.

Instructions

[5 minutes]

  • Ask participants to individually imagine a potential investigation. Alternatively, provide an example investigation, keeping it narrow and manageable (e.g. collect water samples to test levels of pesticide use in an area).

[15 minutes]

  • Ask participants to individually fill-in the first table of the risk management template as follows:

    • Write down the investigation’s main objective(s) at the top of a page (e.g. collect 30 water samples using a specific protocol and ship them to a lab for testing).

    • Fill-in a table that includes the following sections: a. Type of activities to be performed – in chronological order (e.g. transport to site, environmental sampling, testing for pesticides, etc.)

      b. Success scenario: what will investigators do during these activities, if everything goes well. Encourage participants to be as concrete as possible, even if this means using their imagination or drawing hypotheses (e.g. Rent a camper-van and drive to the site, stay there three weeks to conduct interviews and collect samples; collect three water samples every week from ten different sites; during this time, keep the samples cold in a fridge; ship the samples to a testing lab for analysis, etc.)

      c. Potential risk scenario: What could go wrong at each step? Encourage participants to let their imagination run wild and not jump too fast into thinking about mitigation measures.

[5 minutes] Once the time is up, ask two-three volunteers to share what they have written to the larger group. Ask them what success looked like to them and whether they can give one or two examples of risk scenarios.

[5 minutes] Open the floor to other participants:

  • While their colleagues were presenting, did they think of other potential risk scenarios?

  • Ask participants what would be the benefit of doing this exercise as a team - rather than individually.

  • Explain how working in a team can help identifying new risk scenarios and be more creative.

Assessing and Prioritizing Risk Scenarios

Read Watch Listen | 10 minutes

Instructions

Make a short presentation including the following points:

  • How likely is it? What would the consequences be? - Describe how to assess likelihood and consequences using qualitative scales (e.g. consequences: "minimal / minor / serious / major / catastrophic"; likelihood: "extremely unlikely / very unlikely /unlikely / likely / very likely"). Alternatively, mention that participants can also use quantitative (1/2/3/4/5) scales.

  • Ranking risks – Risk matrix - Explain how to assess risks using the matrix. An example of simple risk matrix is included in the risk management template. You can demonstrate how to place two or three difference scenarios in the matrix. Mention that the matrix is an extremely simplified tool to make decisions, reality is more complex and uncertain.

  • Briefly mention the importance of risk perception and subjectivity. - Since different individuals are likely to assess similar scenarios differently, collaboration can help to better assess and prioritize risks.

  • Optional: Provide an example of three or four risk scenarios identified earlier, describe how you assess their likelihood and consequences, and how you rank them by order of priority.

RESOURCE:

Risk Assessment

Collaborate | 30 minutes

Tools/Materials

Instructions

  • Divide participants into small groups (3 to 5 people per group). Ask them to decide on a note-taker and someone to present their work to the main group.

[15 minutes] Ask participants to take one case from the previous exercise - when each participant worked individually - and to collaborate to:

  • Identify potential risk scenarios — encourage each group member to contribute with new scenarios.

  • Assess the likelihood and consequences of each risk scenario, using either a qualitative or quantitative scale.

  • By comparing likelihood and consequences – and using a risk matrix if they wish – rank risk scenarios from the most to the least important.

  • Encourage participants to identify physical and digital risks as well as how they are interconnected – do not think of them in isolation.

  • Ask them to list their findings (the more the better).

[10 minutes] Once the time is up, participants go back to the main group. A representative of each group then presents the group’s case and the risks they have identified.

[5 minutes] Debriefing - sum up the main ideas resulting from the activity:

  • Risk is inherited – Participants might only consider risks for themselves and less for their sources or other people they will collaborate with. Encourage them to consider everyone involved in the investigation, including colleagues, sources, investigated subjects, etc. Participants’ risk is also other people’s risk, and vice versa.

  • The do no harm principle – Ask participants whether an investigation could create additional harm. In this case, should they be ready not to investigate?

  • Events are uncontrollable and people are unpredictable – Participants should think of risks assessments as tools to prepare for the unexpected, rather than checklists.

  • Participants might fall into the trap of thinking separately about digital and physical risks. Signal that they are closely connected and that a digital threat might have physical effects and vice-versa.

Mitigating Risk (45 minutes)

Introduction to Risk Management

Read Watch Listen| 15 minutes

Instructions

Gove a short presentation focusing on:

  • Defining risk management – To reduce the likelihood or consequences of a risk scenario or mitigate its effects after it has happened.

  • Risk management can happen in three ways:

    • Reducing likelihood – Eliminate or modify the risk; put warning systems in place; etc.

    • Reducing consequences – Separate/isolate the risk; training, exercises and drills; equip to better handle the risk; etc.

    • Fixing damage – Rehearse responses to the risk; plan for relief or rehabilitation should the risk happen; etc.

  • Robust strategies – When possible, favour mitigation measures that are less likely to create new risks and can be adapted to a range of scenarios. For example, setting up proof of life documents and communication plans with your team ahead of investigating can help mitigate many risk scenarios. Similarly, emergency bags are useful in a range of situations. The bottom line: prepare, prepare, prepare.

  • Collaboration – By collaborating, we increase our knowledge, reduce uncertainty, question our biases and ultimately are able to better mitigate our risks. Collaborating is also important to share best practices and learn from others.

  • Optional: Provide an example of a risk scenarios identified earlier. Describe three or four potential mitigation strategies, their pros and cons.

Risk Mitigation

Collaborate | 30 minutes

Tools/material

Instructions

  • Divide participants into small groups (3 to 5 people per group) – if possible, keep the same groups as the previous exercise. Ask them to decide on a note-taker and someone to present their work to the main group.

[15 minutes] For the risk scenario assessed and prioritized in the previous exercise, ask participants to work together to:

  • Identify two or three mitigation strategies for reducing each scenario’s likelihood and consequences or limiting its impact in case it happens.

  • Discuss how they would put this mitigation measures in place. Encourage participants to think about practical aspects, as well as new risks that could arise as a result of their actions.

[10 minutes] Once the time is up, participants go back to the main group.

  • A representative of each group presents the group’s case, including:

    • the mitigation measure they have identified,
    • how they would implement it, and
    • what new risks they have identified during this phase.

[5 minutes] Debriefing - sum up the main ideas resulting from the activity:

  • Participants share some of the risk mitigation solutions they came up with.

  • You can comment and add to their ideas.

  • Emphasize that risk assessment is an iterative process. Putting mitigation measures in place can, in turn, generate new risks that should be assessed.

Closure (20 minutes)

Take-home Exercise: Risk Assessment

Produce | 10 minutes

Tools/material

Instructions

  • Briefly mention that proactively assessing and managing risk can seem tedious at first. Once participants master the process, risk assessments can be done fairly quickly. There is only one way to get there: practice.

  • Encourage participants to apply what they have learnt during the session by using the "Risk Assessment – guiding questions" sheet in their own time and for every project / investigation. This guiding sheet will help them assess the risks associated with any activity they undertake.

  • Encourage participants to write down the results of their assessment, as well as any questions that arise during the process.

  • Encourage participants to share their notes with you and the rest of the group via a safe communication channel or a shared cloud space. You can share your feedback and comments with the group at a later point or organise a post-workshop feedback session, if possible.

Closure / Check-out

Read Watch Listen | 10 minutes

Instructions

  • Wrap up the workshop and sum up its contents.

  • Run a quick review of the session. Each participants would say:

    • one thing they found very good about the session and
    • one thing they would improve for the next time
  • You can encourage participants to ask questions or give some final tips.

  • Share contact information if relevant and any follow-up details.

To keep participants informed about what is going on at all times, trainers can effectively sum up workshop contents following these steps:

    1. [in the introduction] tell participants what is going to happen;
    1. [during each part of the session / workshop] remind them what is happening;
    1. [at the end of the session/workshop] tell them what just happened. In addition, at the end, trainers need to make sure they point out which expectation have been addressed.

Further Resources

Contact Us

Please reach out to us at Exposing the Invisible if you:

  • have any questions about this workshop plan and facilitation guidelines,
  • use this workshop plan and want to share feedback and suggestions that can help to improve them,
  • adapt the workshop plan to a specific context and want to share the results with us,
  • want to suggest new activities, tips or examples that can be added to this workshop,
  • want to share your expertise and collaborate with us on developing and testing new workshops.

Contact: eti@tacticaltech.org (GPG Key / fingerprint: BD30 C622 D030 FCF1 38EC C26D DD04 627E 1411 0C02).

Credits and Licensing

CC BY-SA 4.0

This content is produced by Tactical Tech's Exposing the Invisible project, and licensed under a Creative Commons Attribution-ShareAlike 4.0 International license

  • Workshop author: Léopold Salzenstein
  • Instructional design: A. Hayder
  • Editorial and content: Christy Lange, Laura Ranca, Wael Eskandar
  • Graphic design: Yiorgos Bagakis
  • Website development: Laurent Dellere, Saqib Sohail
  • Project coordination and supervision: Christy Lange, Laura Ranca, Lieke Ploeger, Marek Tuszynski, Safa Ghnaim, Wael Eskandar

This resource has been developed as part of the Collaborative and Investigative Journalism Initiative (CIJI) co-funded by the European Commission under the Pilot Project: "Supporting investigative journalism and media freedom in the EU" (DG CONNECT).

This text reflects the author’s view and the Commission is not responsible for any use that may be made of the information it contains.

More about this topic