Our ISO 31000-Aligned Security Risk Analysis Methodology

Risk as a Relationship

Risk arises from the interaction of four connected elements: a credible threat, a vulnerability the threat can exploit, the effectiveness of the controls intended to reduce that exposure, and the consequence if the threat succeeds.

Risk ratings depend on how the threat, vulnerability, controls and consequence interact in your particular setting. Consider an attempted perimeter breach. The threat may be high, but reliable detection and a response that reaches the breach in time can reduce the chance of entry. If alerts are routinely missed or the response arrives too late, the exposure remains high. The rating should reflect what the controls achieve in practice and the consequences that remain possible.

The framework is designed to examine these relationships precisely — rather than inferring risk from the presence or absence of security measures alone.

The Four Components

Keown & Associates assesses security risk through four connected components:

Control effectiveness is assessed separately because the presence of a control does not mean the control will work. Where controls are weak, poorly integrated or unreliable, residual vulnerability remains high.

How well do the controls work in practice?

In more than 30 years of security work, I have seen sites invest in walls, fencing, radar, guards, cameras and response teams, only to find that the protection those measures provide has weakened over time.

Cameras are a common example. Some feeds have no one assigned to watch them. Elsewhere, operators face a stream of false alarms or are expected to watch screens through a 12-hour shift. An incident can appear on a working camera and still go unnoticed.

That is why I follow the whole sequence during an assessment: what triggers an alert, whether an operator can recognise what is happening, and how the response unfolds. A deeper analysis of site conditions, operating records and practical tests shows me what happens when the system is needed.

ISO 31000 Alignment

The analytical approach is aligned to ISO 31000, the international standard for risk management. ISO 31000 establishes that risk should be understood in context, that risk management should be structured, iterative, and integrated with decision-making, and that it should be based on the best available information rather than on assumption.

For a practical introduction, read our ISO 31000 physical security risk assessment explainer.

In practice, this means that every engagement begins with a clear definition of context and objectives — what matters to this organisation, in this environment, at this point in time. Analysis is anchored to that context, not applied generically across all clients and sectors.

ISO 31000 alignment also means that risk ratings and recommendations are structured to be defensible — capable of withstanding scrutiny from boards, audit committees, regulators, and insurers.

Structured Analysis, Not Audit

The framework does not produce compliance checklists or audit scores. It produces a structured understanding of where risk resides, how material it is, and what actions would reduce it most effectively — in the shortest operational path and with the clearest accountability.

This framework enables decision‑makers to focus on the core questions that support sound risk decisions: which assets are most critical, which threats are credible, where the most significant vulnerabilities exist, and what level of residual risk the organisation is willing to accept.