Organizational THIRA Application is a process that uses THIRA or the Threat and Hazard Identification and Risk Assessment created by the homeland security community for assisting communities, businesses and organizations assess risk and take appropriate actions to mitigate the risks. The Organizational THIRA Application when applied to a business or organization is a process that can be concluded with ease, as it was designed to be a process that any individual or entity could use. There are four steps within the Organizational THIRA Application process and they include (1) Identifying threats and hazards of concern to the organization (2) Describing the threats and hazards and showing how they may impact an organization (3) Establishing a capability target for each of the identified threat or hazard and (4) Applying the results of the identification and assessment process. In this article, we will be taking a closer look at how businesses and organizations can use the organizational THIRA application process to identify, assess and counter the threats, hazards and risks that face industries today.


Organizational THIRA Application: The Core Capabilities

There are five specific core capabilities that relate to the organizational THIRA application process that all business and organizations utilizing THIRA should be made aware of. These five capabilities include prevention, protection, mitigation, response and recovery. Prevention is a capability where an organization stops or takes measures to prevent a terrorist attack or incident. Protection is simple a process where the way of life or normalcy of assets and workers are protected from incidents. Mitigation is about lessening the impact of future crises so that loss of life and property can be reduced or eradicated altogether. Response is a process where organizations will respond quickly to save lives, property and assets. Recovery is often the final process of a crisis focusing on bringing the environment and the organization back to normalcy after an incident has occurred. Each of these five core capabilities require extensive planning, exercise, public information, warning and reasonable coordination in order for an ending result to be successful.


Successful Organizational THIRA Applications Required the Whole Organization

In general emergency management, many of us speak about a process or more of a culture known as ‘Whole Community’ involvement. This is where the entire community becomes involved in emergency management objectives and goals. The whole community includes the government and community leaders, agencies within the community and even citizens and entities within the community. The more people involved in the Whole Community effort, they greater chance of success will follow when emergency management activities are being concluded. This same approach can be applied to businesses and organizations by establishing a ‘Whole Organization’ approach whereas the entire organization and people within the organization is involved in the process. It is easier to involve the entire organization because it can often be made into a priority or a requirement of those who are employed through the business or organization. The challenge will be creating a culture where people want to participate with passionate intentions.


Organizational THIRA Application: Step 1 – Identify the Threats and Hazards

The first step of the organizational THIRA application within a business or organizational setting is to identify the threats and hazards of concern for the organization or business. Leaders or coordinators participating in this process should develop a team to discover and define likely threats and hazards and the sources of them. Discuss the factors needed for including and not including threats and hazards of concern for the organization or business and updating previous assessments and threat and hazard identification processes. THIRA can easily be adapted into other assessment processes, it doesn’t require the organization or business to ‘scrap’ other assessment protocols that are in place.

When considering the type of threats and hazards that could concern the organization or business, remember to research into the three-types of hazards that are most common in the emergency management field. These hazards include natural, man-made and technological. Natural hazards include events such as flooding, tornadoes, severe weather, pandemics, earthquakes and animal disease outbreaks. Man-made hazards might include dam failures, the accidental release of hazardous materials, power and water failures, train derailment and radiological releases. Technological hazards can include workplace violence, acts of terrorism, active shooters, industrial espionage and sabotage. Determining the sources of the hazards of concern might require a company or organization to complete more extensive research into these sources. Please note that there are many sources for such research including but not limited to government branches, universities and colleges, organizations dedicated to disaster information, local community-based programs and state and regional fusion centers. Organizations and businesses should also seek the support of subject matter experts in various categories of hazards and threats as well.

Identifying threats and hazards, especially for a company or organization with limited experience in doing so, could appear to be overwhelming and never ending. This is because of the wide range of hazards and types of threats that exist today. New ones are being evolved and discovered each day as well. This is overwhelming, indeed but it shouldn’t have to be. Businesses and organizations should only be focusing on the threats and hazards that will likely occur to the business or organization, not each and every one of the threats and hazards out there. There are some factors to consider when identifying potential threats and hazards of a business or organization, these factors include: (1) Consider the likelihood of the incident. If your company is located in a rural area of the Midwest, a tornado incident is likely to occur but a nuclear attack is probably not as likely to occur. What has occurred more in this sense? A tornado or a nuclear detonation? (2) Consider the significance of the hazard. What would happen if the incident were to occur? How would it impact the organization or business? Would it close it down or harm profits? Could it impact the community that the business or organization resides in? What impacts would occur and how significant would they be? Considering the likelihood and significant of potential hazards will allow organizations to single out those they are likely to occur and thus create a better assessment in the process.


Organizational THIRA Application: Step 2 – Describing the Threats and Hazards

The next steps of the organizational THIRA application is to give threats and hazards context by describing them and their impact on the business or organization. In this phase of the application, leaders and coordinators will consider the factors of hazards and also provide examples of each hazard and threat that is a concern for the business or organization. When considering the factors of the hazards, it is wise to include the time, place and conditions about when the hazard would occur. What time of the day or the year will the hazard or threat likely occur? What area of the business or organization will the hazard be present in? What other conditions will be present before, during and after the threat or hazard occurs? It important to note that many of the factors that an organization or business will be considering are often subject to change. It is important to continue monitoring these factors exclusively to identify when changes occur.

Now let’s take a look at two different examples of the context that can be added to the identified threats of a manufacturing facility located in rural western Kentucky. The first threat is a tornado emergency whereas a large tornado is spotted on the ground and damage is occurring. The second example is an accidental release of hazardous chemicals used within a cooling process at the manufacturing facility when products are being made. What sort of descriptions would you likely want to give for these two examples? Consider the factors listed above: (1) time (2) place and (3) conditions. Consider what time of the day and/or year the hazards could occur and also what significance will likely be present concerning the time of day or year. For example, if a tornado happens at night, it will be harder for managers to look to the sky to see if a threat is coming for the facility. Consider the place of the threat. A hazardous release of chemical in an area where workers are commonly at poses significant public health risks. And what about the conditions for the hazard actually occurring? Is western KY an area where conditions are favorable for severe weather during severe weather season? Now re-examine these factors to threats and hazards that are not likely to occur. Can we see an actual terrorist attack on a local manufacturing facility located in rural Kentucky happening before a tornado emergency or a chemical release?


Organizational THIRA Application: Step 3 – Establishing Capability Targets

The next step of the organizational THIRA application is to establish capability targets for each of the threats and hazards of concern to the business or organization. Remember the five core capabilities talked about above, including (1) prevention (2) protection (3) mitigation (4) response and (5) recovery. How can each of these core capabilities be applied to each identified threat and hazard of concern for the organization or business? To determine this, a leader or coordinator and their assessment teams needs to identify the impacts of each hazard and the outcomes that are to be desired. Guidance should also be determined, developed and provided in terms of developing such capabilities for each threat and hazard of concern. In the end, examples of completed capability targets should also be emphasized as well.

When discovering the impacts of a threat or hazard, consider the size and complexity of the potential incident. If a tornado hits the community, public services such as police and fire personnel are going to be busy and will likely not be able to dedicate all of their manpower and services to a manufacturing facility that was also hit during the storm. There will be other victims to tend to and any lifesaving effort will always be a first priority for emergency management departments. When it comes to an emergency, there are three phases that responders will follow in a specific order including (1) lifesaving efforts (2) stabilizing the scene and (3) protecting property and other assets.

What are the desired outcomes of a threat or hazard event occurring within an organization’s or business environment? The desired outcome will likely be the absolute prevention of lives being lost and persons being injured, of course. But there is more to it. Preventing the loss of property and assets is also important because profit and economic stabilization can be dramatically impacted if such areas are damaged or destroyed due to a hazard. It is important for businesses and organizations to develop a desired outcome and to determine the factors and actions that need to take place in order for such an outcome to be plausible and able to occur.


Organizational THIRA Application: Step 4 – Applying the Results

The final step of the organizational THIRA application process for businesses and organizations is to apply the results of the threat and hazard identification and risk assessment process. The application of the results are meant to meet the requirements of the target capabilities determined for each area of concern during the assessment process. The factors to be considered in this final step might include (1) determining estimated resources for target capabilities (2) considering resource typing procedures (3) determining requirements for obtaining such resources and (4) resource allocation activities.

Determining estimated resources for target capabilities is important to many businesses and organizations due to budgetary and spending requirements. A business cannot simply afford to create an unlimited spending budget for acquiring resources to deal with specific hazards and threats. The United States federal government cannot even practice this. Disasters are one of the most significant methods of putting a nation and an organization in debt due to the significant losses and requirements that shortly follow the incident. Determining the resources needs and estimated the amounts of resources before an actual incident occurs can essentially save a business or organization a lot of money and manpower in the end. Success can occur if an organization or business is willing to strategically plan for estimating resources needed for threats and hazards that are of a concern to the entity.

Resource typing can easily managed by using a successful system created specifically for this needed requirement of managing an incident. Businesses and organization that currently do not have such a system can easily consider utilizing the National Incident Management System also known as NIMS for short as the system to be used to manage and type resources. This system is common in all levels of government and even a requirement to be used by all public health and emergency management related agencies and departments. NIMS wasn’t just created for the government though, it was also created to be easily adapted into organizations and businesses alike. This free system can really be beneficial for organizations and businesses.

How will resources be allocated or collected if you will? One particular feature of incident management is mutual aid partnerships and general resource sharing partnerships as well. A business or organization should be out developing partnerships with other businesses, organizations and entities within their communities. Basically, this derives to the old saying “I’ll scratch your back if you scratch my back”. How can a manufacturing facility partner up with a local retail giant in terms of disaster response? If the retail giant is hit, the manufacturing facility’s fork trucks could provide better access for cleanup thus enabling the retail giant to save money during its recovery process. If the manufacturing facility is hit, the retail giant could provide food and water to personnel during the response and recovery process. This is merely just one example of a partnership that can be established.


Conclusion of the Organizational THIRA Application Process

Understanding the potential of threats and hazards that could impact and business or organization is important. Ignoring such elements will likely result in an increased threat of loss of life, larger numbers of injuries and significant impacts to profits, budgeting a local economic stabilization. You know that threats and hazard exist, you should be determining them and how they can impact your business or organization and then take steps to decrease such impacts. Ignoring these elements is not only ignorant but it is completely irresponsible and poses a risk not only to the business or the organization but to the people who make up the business or organization as well as the consumers of that business or organization. The time to prepare is now!

Thank you for reading my article about Organizational THIRA Application for businesses and organizations. If you have enjoyed reading this article, please support me for taking the time to create it by sharing it with others and especially on social media outlets. This article was written by Shawn J. Gossman, a professional in the emergency management and organizational continuity fields.

About the Author

Shawn J. Gossman
Shawn J. GossmanB.S., M.S., M.B.A., SEM, PDS
Shawn J. Gossman is an article and publication contributor of rural and remote-based emergency management, continuity and public health topics. Shawn holds a Master of Science concentrating in Emergency Management and a MBA in Hazardous Environment Logistics and Supply Chain Management. Shawn is dedicated to helping rural communities and organizations be a part of the Whole Community approach of National Preparedness.