Ministry of the
Solicitor General

Methodology Guidelines 2019


If you require an alternative format, please email

Hazard Identification and Risk Assessment Program

Methodology Guidelines 2019

Office of the Fire Marshal & Emergency Management

Version Control


This is version 1.0 of the HIRA Methodology Guidelines (issue 1, no revisions).

Publication of New Versions

The Ontario Hazard Identification and Risk Assessment Guidelines will be published every 5 years. The formal update process begins 1-2 years prior to each publication, to allow time for comprehensive engagement and review of content. A new version is published at the conclusion of this process.

Revision List

Revisions to the current version can occur at any time. The version number should be updated with each revision, by changing the number after the decimal point, and recorded using the table below:

Revision List - table with header row plus one row of content, followed by 4 empty rows

Revision Number (1.X)

of Change

Date of Revision

Revision Made By (Name)

Approved By (Name)

1.0 original version 2019-05-01 Sarah Thompson Jon Pegg,
Mario Di Tommaso


Approval of the Methodology Guidelines 2019, signed by Mario Di Tommaso, Deputy Solicitor General Community Safety, and Jon Pegg, Chief, Emergency Management.

Expert Advisers and Reviewers

  • Cody Anderson, Public Safety Canada
  • David Etkin, York University
  • Matthew Godsoe, Public Safety Canada
  • Melanie Goodchild, The Waterloo Institute for Social Innovation and Resilience
  • Trina Gorr, City of Ottawa
  • Tara Hamilton, Ontario Office of the Fire Marshal
  • Daryl Mahoney, Alberta Emergency Management Agency
  • Adam McAllister, Ontario Ministry of Natural Resources and Forestry
  • Caroline Nolan, The Ottawa Hospital
  • Laurie Pearce, Royal Roads University
  • Elizabeth Scambler, Emergency Management British Columbia
  • Jennifer Smysnuik, City of Toronto
  • Lori Thompson, Alberta Emergency Management Agency
  • Lauren Perry, Emergency Management Coordinator, City of Sault Ste. Marie

Thank you to all who attended regional engagement sessions in 2018 for their contributions to the content of this guide, and to host communities for their hospitality:

  • The Town of Fort Frances
  • The City of Kingston and Frontenac County
  • The City of Mississauga
  • The City of Woodstock
  • The City of Sudbury


Sarah Thompson, Program Development Officer - HIRA, Emergency Management

Special Thanks

Special thanks to the many representatives of municipal, regional, Indigenous, and unincorporated communities across the province, for their engagement with and commitment to this project.

Emergency Management Ontario acknowledges its presence on lands traditionally occupied by Indigenous Peoples. You can search the specific treaty area for addresses across Ontario on the digital map of Ontario treaties and reserves:

Introduction HIRA Guidelines 2019


The purpose of HIRA is to assess the potential risk of hazards with the capacity to cause a disaster. This helps set priorities for prevention, mitigation, preparedness, response and recovery. This also helps local government, city council, land use planners, residents, and emergency management professionals take action to reduce future losses.

Risk assessments help to establish a focus for emergency management programs, allocate resources, and plan appropriately.

The HIRA allows for the assessment of risk based on hazards, exposure, vulnerability, capacity and resilience.

Core questions:

  • What risks can lead to a disaster?
  • What impacts could occur over a range of scenarios?
  • Are there scenarios in which the level of risk is unacceptable or unmanageable?
  • What are the impacts, relative to each hazard?
  • What existing measures prevent or mitigate the risk?

This Hazard Identification and Risk Assessment (HIRA) guidebook provides a process you can use to answer these core questions. It also includes a series of resources to help you.

The Guideline uses an “whole-of-society” approach to risk. This approach recognizes the need for coordinated action at all levels, across government, sectors and communities.

A HIRA can:

  • Help you to understand and prepare for hazards
  • Save time and resources by identifying potential scenarios
  • Help create emergency plans, exercises and training based on events of significance
  • Help your program become proactive rather than reactive

The guidebook is not intended to be used to predict which hazard will cause the next emergency.

The Office of the Fire Marshal and Emergency Management continues to engage in a collaborative process across ministries to develop risk assessment methodology, to ensure consistency between legislative requirements.

What is Risk?

‘Risk’ is a term used to describe the potential to lose (or gain) something of value, when posed with a situation involving danger. Most definitions of risk have two core things in common:

  • Peoples’ interaction with danger
  • The degree of potential harm

Everyday life includes the risk of loss, but also for positive opportunities. In fact the root word for risk, “Riscare” is thought to be the origin of the phrase “Nothing ventured, nothing gained”.

This origin provides insight into risk itself. It is viewed as being, in part, socially constructed. Society interacts with uncertainty based upon the nature of its culture, religion, education and many other qualitative factors.

These complex systems are often the focus of Emergency Management.

This guideline uses this holistic perspective of risk. This includes notions of hazard likelihood and consequence.

Measurement of risk can include objective and measurable factors, such as how often tornadoes occur. Other measurements are subjective and difficult to measure, such as the degree to which psychological trauma occurs.

There can even be fundamental differences in perspective about whether or not (or the degree to which), something is harmful. An example of this is the destruction of the environment, which is valued very differently by environmentalists and real estate developers.

Ultimately, how risk is measured is determined by values and assumptions that should be transparent.

There is no one correct way to express risk. However, a good risk analysis, will be extremely clear about:

  • Its purpose
  • Why particular metrics were chosen, and
  • Limitations of the analysis

Addressing Risk

Risk can be addressed in six ways, outlined below. The decision to adopt any of these strategies depends on the values of decision-makers and the community, as well as the results of risk assessment.

Accept: An activity is determined to be acceptable, within existing social, economic, political, cultural, technical and environmental conditions or constraints.

Example: It may be considered unacceptable that schools will collapse in a moderate earthquake. However, it is decided by senior officials that infrastructure improvements will be spread out over the next 10 years. Risk is accepted within that time period.

Avoid: Choose not to take on an activity at all, evading all risks.

Example: A decision not to build within a flood extent, avoids the risk of riverine flooding.

Adapt: Modify existing behaviour to adapt to known risks.

Example: Efforts to develop drought-tolerant crops to partially adapt to the risk of warming climate conditions.

Reduce: Take mitigation actions that remove some or all of the risk.

Example: The introduction or improvement of measures to reduce risk include physical works, as well as regulations, policies, control systems and other means.

Transfer: Move all or part of the risk to a third party.

Example: Insurance programs, or hiring a third party, transfer risk.

Share: Distribute the risk among multiple organizations or individuals.

Example: The responsibility for risk reduction measures is shared between municipalities, response agencies, private partners, non-profit organizations, residents or others. This could take the form of a Memorandum of Understanding.

Risk Treatment and comprehensive Emergency Management

The treatment informs the creation of specific prevention, mitigation, preparedness, response and recovery plans.

In the first example above, the infrastructure improvement plan is a mitigation strategy. This plan was created based on the decision to accept the risk.

About Data

HIRA is not all about the math! Statistics related to past events or number rankings are only one part of a bigger picture. Other information such as the knowledge of Indigenous elders, community perspectives, and the perspectives of expert staff should also be an important part of your assessment.

It is important to discuss, deliberate, consult, build consensus, and use scenarios to think about risk. In many ways, the process of risk assessment is in many ways more important than the result.

Consider that are two main types of data that are both important to HIRA:

Quantitative data

Deals with numbers and things you can measure objectively. This includes items such as the cost or the number of people affected by an emergency.

Qualitative Data

Is built on understanding what has taken place using interviews, observations and reports. Typically, this would include talking to those who responded to, or were impacted by, an event.

The goal of risk assessment is to set priorities for risk prevention, mitigation, preparedness response and recovery. This includes thinking about past, present and future trends.

Keep in mind that risk changes over time; as do people, infrastructure and everyday life in communities across Ontario. For example, a hazard that occurred in the past may be less likely now or may produce different consequences if it were to happen today.

HIRA Process Overview

The 2019 Ontario HIRA approach has been designed with communities in mind to help you work through five steps.

HIRA programs may begin at any step of this process, consistent with the status of existing programs. This guide begins with ‘Plan’, which should be the first step for new programs.

Key Actions for Each HIRA Step


Articulate the objectives and process.

Key actions:

  • Define your specific objectives.
  • Bring community partners and stakeholders to the table.


Identify Hazards

Identify hazards that have the potential to cause harm.

Key actions:

  • Get a (big) community map!
  • Identify and discuss potential hazards
  • Document historical events and consequences


Build Community Knowledge


Estimate the number of people and assets located in harm’s way.


Identify conditions that increase susceptibility to hazards.


Understand the capacity of people, and assets to prevent, mitigate, prepare, respond to and recover from the effects of hazards.

Key actions:

  • Use past events or fictional scenarios to think about how your community could be affected by hazards.
  • Use map(s) to understand where and how impacts may occur.
  • Share the results with the community.


Risk Assessment

Estimate the risks by using quantitative, and qualitative knowledge.

Key actions:

  • Use scoring guidelines in this section to assign values for likelihood and consequence and create a final score.



Document findings and evidence.

Key actions:

  • Record scores
  • Communicate findings

Step One: Plan

Important milestones for launch are described in this section, including

  1. Get buy-in
  2. Determine and appoint Community Planning Team
  3. Appoint advisory group and supporting teams
  4. Determine Key Partners and Stakeholders
  5. Create a project charter
  6. Discuss ethical principles of the HIRA
  7. Approve the plan


Before starting on HIRA, the very first step is to obtain buy-in from senior management in your organization.

  1. Engage as early as possible.
  2. Ensure you include all relevant internal stakeholders in the process.
  3. Use terms that each stakeholder group can understand, and avoid jargon.
  4. Clearly state the benefits and importance of HIRA

Include a proposal or business case for teams that support the development of HIRA, Teams can include:

The Community Planning Team

The community planning team is led by the Community Emergency Management Coordinator (CEMC). This group will lead the process of assessing the community’s risk.

It is an ideal to include 3-4 individuals who are committed to the process, and have different perspectives, skills, and knowledge.

This could include but is not limited to:

  • Municipal staff who serve emergency roles, such as public works staff or volunteers
  • a member of the fire department or local first responder, including volunteers
  • a social services representative, such as a counselor or support worker
  • a long-term community member or Elder

Supporting Teams

You may choose to support the community planning team with other internal staff, either consistently or on an ad-hoc basis. You may even have the resources to create a staff project team to support the work.

It is an advantage if supporting staff have a variety of skills among them, such as administrative, interviewing, writing, basic research or analysis skills.

You may wish to assemble a separate group to provide executive oversight. It is important to keep this group separate as it should not directly influence the content of HIRA.

Ideally, there will be a political champion for the planning process. This may be the mayor or council member, or a well-respected community leader or Elder. This person’s role is to advocate and to help gain community members’ trust and willingness to participate, and would ideally form part of the executive oversight group.

Advisory Group, Key Partners and Stakeholders

The community planning team gathers information from members of the community, provides feedback and helps guide the HIRA via an advisory group.

The advisory group should consist of community members and subject matter experts, and inclusive of core members and some ad-hoc members. It may be appropriate to have sub-groups (e.g. utilities). This group could include any of the following:


□ Elders and Aboriginal Leaders

□ Mayor and council

□ Community Leaders

□ Community Members

□ Community Advocates

□ Faith-based leadership

□ Non-profit partners

□ Representatives of minority or marginalized groups

Private Industry

□ Electrical Distribution, generation, transmission

□ Telecom systems

□ Oil and Gas

□ Financial Services

□ Food Suppliers

□ Infrastructure owners/operators

□ Cyber security professionals

□ Water Management


□ Provincial Ministries

□ Federal Departments

□ Tribal Councils

□ Representatives of local unincorporated communities

Local Government

□ Public health employees

□ Stormwater / drinking water experts

□ Conservation Authorities (source water protection, floodplain)

□ Environmental planners

□ City planners

□ Geospatial services/IT

□ Analytics or data researchers

□ Policy experts

□ Transportation

□ Social services, crisis response, and psychological support experts

Other Subject Matter Experts

□ Scientists and researchers

□ Engineers

□ Academics

□ Social services experts, including emergency social services

□ Emergency management professionals

□ First responders

□ Coroners’ service

□ Hospital or healthcare professionals

□ NGO and non-profit agencies

□ Emergency Management Program Committee (EMPC) members

□ Crisis response workers

Project Charter

Program coordinators should ideally create a project charter, including partners, supporting groups, program scope, work plan, resource needs and timeline for the HIRA. The project charter forms the foundation for your project, so it is helpful to refer to it often, to help maintain transparency, accountability and measurability.

Ethical Practice

How risk is measured is determined by values and assumptions that should be made clear. Considering ethics is a key way to express the values and assumptions of HIRA.

For example, an assessment could focus on economic loss. One way to do this is to consider total cost to a community, another is to examine cost relative to income level. These two approaches prioritize very different values.

Ethics are concerned with what is good or right for individuals and society and are reflected in the way risk is measured. The following questions can help guide the conversation:

  • A special duty-of-care is owed to certain individuals or groups, such as:
    • Persons with disabilities
    • Wards of the state (Prisoners, healthcare patients etc.)
  • A duty to ensure the best outcome for the largest number of people.
  • The wellbeing of people is the first and foremost priority.

Or perhaps you have other guiding principles, values and assumptions.

A risk profile for the province of Ontario was formed upon the following ethics:

  1. Transparency: Emergency Management has a duty to serve the public; including their right to obtain key information that benefits its safety and security.
  2. Professionalism: A professional obligation to provide the public with competent practice.
  3. Comprehensiveness: Emergency Management is proactive, includes an all-hazard approach, all ‘pillars’, and partners from all parts of society.
  4. Risk-based: Sound risk management principles should be used in assigning priorities.
  5. Respectfulness: The equal dignity of all people must be respected, along with their customs and culture, and their right to the necessities of life.
  6. Resilience: Emergency Management aims to strengthen the resiliency of citizens, organizations, communities, systems and society.
  7. Equity: It is vital to provide appropriate care to all citizens of Ontario, consistent with their needs. Equity ensures a fair distribution of supports and resources.

Approve the Plan

Now that the structure, partners and plan are in place, it’s time to ensure that the project plan is formally approved.

Step Two: Identify Hazards

Topics described in this section include:

  1. 1. Understand hazards
  2. Identify hazards that could affect the community
  3. Develop hazard profiles

What is a Hazard?

In order to perform a HIRA it is first vital to understand and identify hazards that could affect the community.

A hazard is any process, phenomenon or human activity that may cause harm, including:

  • loss of life
  • injury or other health impacts
  • property damage
  • social and economic disruption
  • environmental degradation.

Natural forces can create hazards, but these only lead to emergencies when they interact with human systems and structures.

Example: A flood that occurs in an uninhabited area, with no impact to infrastructure or agriculture, is not an emergency.

Hazards can result from a number of triggers:

  • Planned Outages
  • Malfunctions
  • Technological or mechanical failure
  • Design flaw, or planning failures
  • Procedural Gaps
  • Negligence
  • Accidents
  • Intentional attacks
  • Natural forces impacting human systems

Hazards can also lead to or trigger other hazardous events.

Example: An ice storm can lead to a power blackout, which could result in the disruption of water supply.

Consider hazards that may affect your community, as well as how different hazards may interact with one another.

Hazards evolve over time for many reasons, including changes to the climate, population growth, and the increasing connectedness of digital systems. This will change the risk of hazards over time.

Identify Hazards in your community

The following list is a starting point in identifying hazards in your community. These correspond to the hazard information included in the 2019 Hazard report, published by the Provincial Emergency Management Office:

Agricultural & Food Emergency

□ Farm Animal Disease

□ Food Contamination

□ Plant Disease or Infestation


□ Avalanche

□ Drought or Low Water

□ Earthquake

□ Erosion

□ Extreme Cold

□ Extreme Heat

□ Flood

□ Fog

□ High Wind

□ Hurricane

□ Land Subsidence

□ Landslide

□ Lightning

□ Storm Surge

□ Thunderstorm

□ Tornado

□ Wildland Fire

□ Winter Weather


□ Space Object Crash (Any)

□ Space Weather

Hazardous Materials

(Fixed site or in transport)

□ Chemical

□ Nuclear (Facility)

□ Oil or Natural Gas

□ Radiological


□ Water Quality

□ Infectious Disease

□ Substance Use & Overdose

Public Safety

□ Active Threat


□ Civil Disorder

□ Crowd Disaster

□ Cyber Attack

□ Electromagnetic Pulse (EMP)

□ Geopolitical Pressures

□ Sabotage


□ Building or Structure Failure

□ Dam Failure

□ Fire/Explosion

□ Mine Emergency

Supply & Distribution

□ Communications Failure

□ Electrical Energy Failure

□ Food Shortage

□ Medical Drug, Blood Product or Supplies Shortage

□ Petroleum Product Shortage

□ Water or Wastewater Disruption


□ Aviation

□ Marine

□ Public Transit Systems

□ Rail, Light Rail, Subway

□ Road and Highway

Develop Hazard Profiles

To understand hazards you should also document information about each one. Using a map is often the best way to explore and discuss the potential impact on the community.

The headings below can then be used to organize hazard information. This evidence will create an important justification for risk evaluation later in the HIRA process.

Consider using the following groupings for your information:

  1. Definition

    Define the Hazard

  2. Description

    Describe the hazard, including local information.

  3. Spatial Scale, Timing and Warning Period

    Describe the potential scale of impact, the specific area affected, the time of year it occurs, the typical duration, and the warning period.

  4. Potential Impacts

    Describe the main impact, specific to the local area and geography.

  5. Secondary Hazards

    List any significant secondary or cascading hazards.

  6. Past Occurrences

    List and describe past occurrences of the hazard, particularly events that directly affected the local area.

  7. Risk Statement

    Summarize the key factors for each hazard. Include:

    • Will factors affect the potential likelihood or consequence?
    • How is the hazard expected to change?

Step Three: Build Community Knowledge

Topics described in this section include:

  1. Understand the importance of community context
  2. Use data to enhance your community profile
  3. Define and map the community
  4. Understand key community assets
  5. Understand critical infrastructure
  6. Applying community knowledge
  7. Developing scenarios
  8. Build awareness of overlapping Ontario programs

Define & Map the Community

Before you begin to collect community knowledge, it is important to first outline the boundaries of your community, key jurisdictions, and lines of ownership or operation.

Make use of community map(s)!

Your map can be as elaborate or as simple as you want it to be. The main goals are to create a common understanding and to facilitate group discussion.

Considerations might be:

  • fire or policing district coverage
  • neighbourhoods or residences beyond community borders
  • hunting and fishing grounds
  • nearby communities
  • boundaries of reserve land or traditional territories
  • resources and infrastructure within or near the community

Once you have defined boundaries, begin to develop your map with drawings, photos or text that indicate specific aspects of your community. This includes establishing a clear picture of:

  • who or what is in your community
  • where these people, assets, or systems are located

Maps should include assets and key features (such as buildings, organizations, rivers, bridges, roads) and information identified through the process of collecting data about your community.

As you move through this section, you can use the map to support and summarize your information. This type of map also provides a rich way to keep community members informed about your findings.

Community assets

Many types of municipal assets may be important to consider and mark on the map(s):

  • Retirement and nursing homes
  • Schools and youth facilities
  • Public venues and gathering places
  • Memorials and symbolic structures
  • Religious or cultural venues
  • Protected areas or areas of environmental importance

Consider that some of these may be owned or operated by the municipality, while others may be the jurisdiction of other levels of government or private entities.

The Importance of Community Context

The key questions of HIRA cannot be answered without building specific knowledge about your community, including:

  • Critical Infrastructure and community assets, including cultural and social assets
  • Information about the demographics and distribution of people

This information is intended to inform credible, community-specific, accurate scenarios. Guidance on scenarios appears on page 27 under Developing Scenarios.

Templates and other materials are provided in Annex A: Scenario Workshop Tool

Use data to enhance your community profile

Data in the Canadian Census provided by Statistics Canada is useful to profile your community and explore themes outlined in this section.

It provides information that can be used to inform a common understanding of the basic features of your community and its population.

Reminder: Regulation 378/18 contains 5 community profiles that contribute to building community knowledge:

  • Geographic Profile
  • Critical infrastructure Profile
  • Demographic Profile
  • Community Services Profile
  • Economic Profile

Data provided by Statistics Canada includes:

Community Profiles

Who is in your community? The overview of statistical data for each community (census subdivision) in Ontario and across Canada.

Population data

The Census of Population data provide a profile of communities by age, sex, marital status, family characteristics and more.


Statistics Canada's newest labour market indicator is the Job Vacancy and Wage Survey, with data for the 76 economic regions in Canada.

Health and well-being

Where in Canada are people most satisfied with their lives? You will find the answers in the Statistics Canada study on Life Satisfaction.

Critical Infrastructure

Defining threats to Critical Infrastructure is the key to understanding the potential consequence to life-sustaining services. In Ontario, such services are divided into the following categories:

  • Continuity of Government: Municipal, provincial and federal governments.
  • Electricity: Power generation, electricity transmission and distribution.
  • Financial Institutions: Banks and trust companies, credit unions, insurance companies, mutual fund companies, stock exchanges.
  • Food and Water: Water treatment, storage, monitoring, distribution, waste water and sewage treatment, food production and harvesting, food processing and distribution, food inspection and monitoring.
  • Health: hospitals, ambulance services, pharmaceuticals, blood services, and long-term care facilities.
  • Oil and Natural Gas: Oil refineries, distribution and retail operations; natural gas distribution.
  • Public Safety and Security: Emergency services, emergency operations and evacuation centres, military facilities, correctional facilities, flood and erosion control, pollution monitoring, weather forecasting.
  • Telecommunications: 9-1-1 communications, telephones, wireless telephones, pagers, television stations, radio stations, internet.
  • Transportation: highways and roads, snow removal services, railways, public transit, airports, navigation, port facilities, canals and shipping locks, movable bridge systems, ferries, marine communication and navigation, border controls.

List and map your critical infrastructure as best you can, and consider the following to establish vital information:

  • Who owns or operates it?
  • Are there regulations for its operation?
  • Where are assets or systems located? Are they exposed to hazards?
  • What other assets or infrastructure are connected or inter-dependent?
  • What standards, policies or procedures exist?
  • Is an all-hazard planning approach used?
  • Do assets and infrastructure have continued improvement programs?
  • Do measures recognize the changing nature of risk?

Applying Community Knowledge

Community knowledge informs your understanding of exposure, vulnerability and capacity. These elements will become vital to determine the potential consequence of each hazard.


If a hazard occurs in an area of with no people or important assets, systems, or resources, then there is no risk.

Conversely if people, assets, systems or resources are located in (exposed to) potentially dangerous settings, an emergency risk may exist.


Vulnerability is any condition that increases the susceptibility of a community (people, assets, and systems) to the impact of hazards. In order to create a profile of vulnerability, consider the following categories:


Characteristics inherent in social interactions, institutions, and systems of cultural values. See Annex B: Social Risk Factors  for a description of some common social vulnerabilities.


Characteristics inherent in economic interactions, institutions, and systems. Includes business activities, wealth and income.


Environmental factors or processes which increase the susceptibility of an individual, a community, assets or systems to the impacts of hazards.


Buildings, facilities, and digital networks as well as challenges linked to location, materials, and jurisdiction.

Political or Reputational

Reputation can be viewed as a critical organizational asset, in much the same way as the physical integrity of buildings or structures. This category refers to interactions, institutions, and systems of politics, as well as the public perception of the organization.


It is vital to understand both the formal and informal capacity of your community to prevent, mitigate, prepare for, respond to and recover from the effects of hazards.

Capacity is a reflection of the potential to withstand the effects of a hazard. By contrast, ‘capability’ is the ability to effectively utilize capacity in prevention, mitigation, preparedness, response and recovery.

Community or individual capacity can be affected by many factors, including:

  • Pre-event preparation (such as preparedness kits)
  • Access to resources
  • Personal ability or disability
  • Availability of community, family or other types of social support

Informally, community groups, individuals, family units, and other groups of people have varying capacity to respond to and recover from hazards.

While vulnerability describes susceptibility of a community, capacity is about its ability to cope and adapt.

Example: Somebody with low income (a vulnerability) may also have a high capacity to cope and adapt to hazards. Due to a strong informal network of friends and family.

If the capacity of people or assets is high, this contributes to the resilience of a community. Resilience is the “ability to resist, absorb, accommodate, adapt to, transform and recover from the effects of a hazard in a timely and efficient manner”.

Making Cities Resilient Campaign

Cities can participate in the United Nations Office for Emergency Risk Reduction (UNISDR) “Making Cities Resilient Campaign” (MCRC). More information can be found here:

Developing Scenarios

It is important to include a variety of processes and tools to help key partners and stakeholders understand hazards.

Key to this is the development of Scenarios, to develop an applied understanding of the risks posed by the hazard, and highlight potential impacts to the community. Past incident data and input from experts are vital to form this understanding.

Discussion & Dialogue

It is important to discuss hazards and their consequences. This can be achieved in many ways including storytelling, workshops, brainstorming, and talking to those in other communities who have experienced a disaster.

Such sessions can also help to address and work through assumptions and personal perceptions of risk.

Examples of scenarios that are useful for risk assessment include:

  • Most severe events: The worst case for a specific hazard.
  • Events of significance: Those which may not be a worst case but present specific challenges of particular interest to your community.
  • Extreme Scenario: A scenario that is not plausible within the bounds of imaginable conditions, but useful to test the limits of existing or intended capability. These are usually very extreme, though may be possible in certain conditions.

It is beneficial to consider a variety of scenarios, in order to answer the core questions of HIRA.

Information and tools to facilitate scenario development can be found in
Annex A: Scenario Workshop Tool.

Overlapping Ontario Programs

There are many overlapping requirements and programs of support for critical assets and infrastructure. Examples at the time of publication include:

Ontario Municipal Asset Management Regulation O. Reg. 588/17

Starting in January 1, 2018, every municipality is required to prepare a strategic asset management policy that includes levels of service. The Asset Management Plan step 4 and some of step 5 are applicable to HIRA. Technical levels of service and community levels of service metrics are also useful data for HIRA.

Federation of Canadian Municipalities Municipal Asset Management Program

This is a five-year, $50-million program funded by Infrastructure Canada to support Canadian communities.

Fire Protection and Prevention Act

O. Reg. 378/18: Community Risk Assessments’ requires an assessment of community risk related to Fire Protection Services. While Fire risk is the primary concern, some components can be used to partially fulfil HIRA needs.

Climate Change

The Ontario Centre for Climate Impacts and Adaptation Resources endorses the ‘Climate change adaptation framework’ ( While this assessment is not interchangeable with HIRA, the two are complimentary. HIRA can be used to help complete or partially complete step 2, 3 and 4 within this framework.

Planning Act Tools

More information on the Planning Act, and all applicable resources can be found on this web page: . HIRA can complement and inform these requirements.

Step Four: Assess Risk

Topics described in this section include:

  1. Risk Assessment Overview
  2. Likelihood Overview
  3. Consequence Overview
  4. Process: Likelihood and consequence
  5. Consequence categories
  6. Consequence overview charts
  7. Resilience & Risk

Risk Assessment Overview

Analysis of the information you have collected will allow you to evaluate and score the likelihood and consequence factors for each hazard or combination of hazards.

The method described below relies on a balance between experience and community perspectives, as well as statistics and quantitative data sources.

The critical factors used to evaluate risk are likelihood and consequence. You should consider many scenarios, which include combinations of these factors, including:

  • High Consequence, High Likelihood
  • High consequence, Low Likelihood
  • Low consequence, High Likelihood
  • Low Consequence, Low Likelihood


To understand risk, it is vital to understand what the chances are that a hazard will occur. A hazard with zero likelihood poses no threat, while 100% likelihood poses a “certain” threat.


Consequence is the result of the interaction between exposure, vulnerability and capacity in a community. For more detail on this concept and on the diagram at left, see Consequence Overview on page 33.

Understanding many different types of consequence helps inform effective future program development and risk treatment. Consequence includes the effect of a hazard on structures, people, the environment and reputation.

Scoring Consequence & Likelihood

Likelihood and consequence can be given number values, to provide an overall score for risk using an equation. Such equations are useful for well-defined problems. A limitation of such equations is that they are not well suited to ill-defined or complex systems. More sophisticated assessment using multiple tools, discussions and other methods are better suited for this.

However, if you would like to create a ranking of hazards using this method, use the following equation:

Risk = Likelihood X Consequence

Determine and score a realistic (i.e. not impossible) outcome that can reasonably be projected to occur for a given hazard.

To understand the ‘big picture’ for each hazard, it is important to consider a variety of scenarios (and possible scores). The final score should be based on events of significance for your community (see page 27).

Possible scores are as follows:

Likelihood: Low 1, High 6

Consequence: Low 1, High 30

Ideally, final scores should be plotted on a simple graph, as shown below:

For additional assistance with scoring, please contact your field officer for additional resources.

The following pages provide an overview of the method. The following pages explain the scoring process.

Likelihood Overview

How likely is it that your community could be impacted by the hazards you identified?

Once you have collected information on the likelihood of hazards, place them into the categories below.

Please note: When calculating likelihood, consider past, present and potential future trends, as well as the input of subject matter experts. ‘Return period’ is a scientific way to estimate of the likelihood of an event, which is often used in HIRA. However, as it is based on historic data only, this should be considered alongside evidence of current and future likelihood.

Likelihood Scoring Table




Percent Chance



Occurs every
100 years or more.

Less than a 1% chance
of occurrence in any year.


Very Unlikely

Occurs every
50 – 99 years.

Between a 1- 2% chance
of occurrence in any year.



Occurs every
20 – 49 years

Between a 2-5% chance
of occurrence in any year.



Occurs every
5 – 19 years

Between a 5 - 20% chance
of occurrence in any year.



Occurs <5 years.

Over 20% chance
of occurrence in any year.



The hazard
will occur annually.

100% chance
of occurrence in any year.

Example: The hazards for the imaginary community of Trillium were identified as being floods, explosions and earthquakes. The Trillium historical record shows that there have been floods every year. The Fire Chief said that explosions happen every five years or so. A local professor said that there has not been a strong earthquake in the history of the area, but one may be possible. The likelihood table for Trillium would look like:

Sample Likelihood Table






Almost Certain


Flooding from ice break-up in the spring occurs annually. Urban flooding during heavy rain also occurs in some areas during the summer.




Trillium is in a stable geologic area and has not experienced an earthquake in over 200 years. Subject matter experts indicate that the area is not likely to experience another.

Consequence Overview

The potential consequence of a hazard is highest when people or assets:

a) Are exposed to a hazard

b) Are vulnerable to a hazard

c) Have little capacity to respond or adapt

The more of these characteristics a person or asset has, the higher their potential consequence from a hazard.

The diagram below illustrates this concept further.

Venn Diagram showing the intersection of 'Exposure' 'Vulnerability' and 'low capacity'. The Venn diagram shows 3 equal intersecting circles. At the intersection of 'Exposed' and 'low capacity' individuals or assets are described as follows: 'Have the potential to endure, may not be at risk'. At the intersection of 'Low Capacity' and 'Vulnerable' individuals or assets are described as follows: 'High risk only if affected'. At the intersection of 'Exposed' and 'Vulnerable' individuals or assets are described as follows: 'Potential to adapt, but may be at risk'. At the centre, in the space where all three circles overlap, individuals or assets are described as follows: 'High Risk'.

If people or assets are exposed to a hazard, they may experience any or all of the following consequences. People or asses could be directly or indirectly affected, and experience consequences including:

  • Fatalities
  • Injuries/Illness
  • Psychosocial
  • Social Connections
  • Evacuation or shelter-in-place
  • Property Damage
  • Critical Infrastructure Service
  • Environmental Damage
  • Economic
  • Reputational

The consequences will be more pronounced in those who are vulnerable. Vulnerability is also known as the susceptibility of a community, system or asset to the damaging effects of a hazard.

The ability of people or assets to adapt to, transform and recover from those effects, regardless of how vulnerable or exposed, is determined by their capacity. If this capacity is low, the effects may be more severe, or longer-lasting.

Consequence Categories

Consider each of the following ten consequence categories:


Potential number killed as a result of the hazard.


Potential number injured or ill because of the hazard.


The number of people traumatized and having difficulty functioning socially or in the workplace.

Social Connections

Access to formal or informal networks of support, including family and community supports. Reciprocity, trust, and cooperation between people may be negatively affected.

Evacuation or shelter-in-place

Potential for formal evacuation, shelter-in-place orders, or people stranded.

Property Damage

The direct negative consequences of a hazard on buildings, structures and other forms of property, such as crops.

Critical Infrastructure Service

The negative consequences of a hazard on processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the functioning of government.

Environmental Damage

The negative consequences of a hazard on the environment, including the soil, water, air and/or plants and animals.


The negative economic consequences of a hazard, including on commercial, industrial or regional economies.


The perception of one or more organizations or jurisdictions, in the minds of its stakeholders, the public, and others who are vital to its success.

Scoring Consequence

For your chosen scenario follow these steps:

1. Rate each of the ten consequence categories above ‘None’, ‘Low’, ‘Medium’ or ‘High’ (use the Consequence Overview Chart on pages 35-36 to help you)

2. Count the number of times each rating was used.

3. Multiply the count for ‘Medium’ by 2, and ‘high’ by 3.

4. Add the totals for ‘Low’ ‘Medium’ and ‘High’.

The result is the total is the overall consequence score for the hazard.

Consequence Overview Chart

Consequence Overview Chart








Not likely to result in fatalities.

Not likely to result in injuries or illness.

Not likely to result in significant impacts to individuals’ mental and emotional wellbeing.

Not likely to impact access to supports and networks. Trust and cooperation are unaffected.

Not likely to result in an evacuation shelter-in-place orders, or people stranded.


Causes loss of life within the scope of normal operational capacity.

Causes injury/illness within the scope of normal operational capacity.

Localized, moderate and/or generally short-term impacts to individuals’ mental and emotional wellbeing.

Likely to result in some localized reduced access to supports and networks. Trust and cooperation are affected.

A small or localized portion of the population is evacuated, sheltered-in-place, or stranded.


Causes loss of life requiring extra emergency operations support.

Causes injury/illness requiring extra emergency operations support.

Significant but generally localized impacts to individuals’ mental and emotional wellbeing, including long-term impacts.

Likely to result in reduced access to supports and networks. Trust and cooperation are affected.

A moderate and generally localized portion of the population evacuated, sheltered-in-place, or stranded.


Loss of life severe enough for mass fatality procedures to be activated.

Injury/illness requiring mass-casualty or other highly specialized plans and supports.

Widespread impacts to individuals’ mental and emotional wellbeing, including long-term impacts.

Likely to result in significantly reduced access to supports and networks. Trust and cooperation are severely affected.

A large or widespread portion of the population is evacuated, sheltered-in-place, or stranded.







Consequence Overview Chart (continued)

Consequence Overview Chart (continued)








Not likely to result in property damage.

Not likely to disrupt assets or services.

Not likely to result in environmental damage.

Not likely to disrupt business/financial activities.

Not likely to result in significant political or reputational impacts.


Could cause minor, mostly cosmetic damage.

Could cause minor disruption of assets or services.

Could cause localized and reversible damage. Quick clean up possible.

Disruption of business/financial activities or the economy of the local area.

Likely to result in limited or short-term political or reputational impacts.


Localized severe damage.

Could cause major but localized or short-term disruptions to critical infrastructure services.

Could cause major but reversible damage. Clean up difficult.

Could result in losses for a few businesses, some negative consequences for the economy of the region.

Likely to result in some significant or long- term political or reputational impacts.


Widespread severe damage.

Could cause widespread, severe, ongoing disruption of assets or services.

Could cause severe, irreversible damage. Clean up not possible.

Could result in losses for an industry, or severe economic impact in the region or province.

Likely to result in significant and/or lasting political or reputational impacts.







Scores for each category should be added together, for a maximum possible total of 30.

Total consequence scores and categories: 0 – 10 Low 11 – 20 Medium 21 – 30 High

Resilience and Risk

Resilience is the cumulative result of both formal and informal community activities that build the capability of the community to adapt to, transform and recover from hazard consequences. This includes comprehensive emergency management programs, but also much more.

Resilience includes people’s capability to resist, absorb, accommodate, adapt to, transform and recover. This includes emergency management, but also municipal planning, community initiatives, grassroots events, and many other activities.

A community with a high level of resilience may be able to cope with a hazard, even if there are few or no formal mechanisms for mitigation, response or recovery. In other words, high levels of resilience may mean that a community has high capacity to respond and recover, even if vulnerability and exposure are high.

To ensure that resilience has been considered, review the information collected and ensure that existing capabilities are reflected in the scenarios, as well as the consequence and likelihood assessments.

Total Scores

Total scores are not always useful for making risk decisions. This is because extreme scenarios often score lower than others.

Example: a nuclear facility emergency is an extremely low likelihood event (e.g. 1), but would have extremely high consequence (e.g. 30).

A total score of 30 (e.g. 1 x 30) is considered very low.

Creating and using such scores should therefore be done with caution.

If total scores are used, the following categories may be used to organize the results:

Total Score Categories

Total Score (LXC)




0 - 30

Very Low

31 - 60


61 - 90


91 - 120


121 - 150

Very High

151 - 180


Step Five: Report & Follow-Up

Topics described in this section include:

  1. Results
  2. Documentation
  3. Communication
  4. Connected Risk
  5. Risk Treatment Options
  6. Approval and Revision Schedule
  7. Revision Log


Now you should be able to answer the key questions that define HIRA:

  • What risks can lead to an emergency?
  • What impacts could occur over a range of scenarios?
  • Are there scenarios in which the level of risk is unacceptable or unmanageable?
  • What are the impacts, relative to each hazard?
  • What existing measures prevent or mitigate the risk?


Make sure you document the process, including justification and evidence for all scores.

Creating a record of your reasoning and thought behind the evaluation process will help support recommendations to the Emergency Management Program Committee or Municipal Emergency Control Group, future program development, and provide a formal record of the work.

This helps to ensure continuity of the Hazard Identification and Risk Assessment process and program.


The most important variable in any risk communication is trust.

Engaging with stakeholders early and often will help build trust with members of the community.

Accurate information provided early, and in languages and channels that people understand, trust, and use, enables them to make choices and take actions to protect themselves, their families and communities.

Effective communication and education with decision-makers, partners and the public informs effective program development and can help reduce harm caused by emergencies. 

Effective communication is:

  • accurate
  •  evidence-based
  • sensitive to social, economic, political and cultural contexts

Keep in mind that people have their own opinions about the characteristics and severity of risk. It is important to try to understand these by building relationships with many stakeholders across the community.

Ignoring public perception can lead to significant challenges in the communication of risk and even the implementation of risk reduction initiatives.

Unfortunately, it is common for there to be a gap between experts and the public in their understanding of risk.

Connected Risk

It is important to understand that hazards have connected consequences. Scenario workshops are especially well-suited to exploring connected risk.

The term ‘Cascading consequences’ is often used to describe the sequence of connected effects that can occur as the result of a hazard or hazards. This includes secondary hazards as well as a range of physical, social or economic disruption.

It is also possible that specific response actions could result in unintended consequences in the wake of hazards. This is also worth considering when creating impact pathways or scenarios.

Risk Treatment Options

A HIRA is only one part of a comprehensive emergency management program. Once the risk for each of the hazards is known, it is vital that attempts be made to reduce their risks, beginning with the hazards identified as having extreme and very high levels of risk.

Robust and evidence-based recommendations for risk treatment should be based on the HIRA data you have gathered. These can then be passed to senior levels of government for review.

To support and justify requests for support between levels of government, it is vital to have a clear understanding of residual (left-over) risk. This understanding helps anticipate response needs in the wake of an emergency and informs development of recommendations for risk treatment.

Consider how you could treat any residual risk.

See Annex C: Risk Scoring & Treatment Tables for a selection of fillable summary tables.

Thinking about risk treatment is the first step to designing a robust risk mitigation strategy.

Approval and Revision Schedule

It is important to remember that a HIRA is an ongoing process and hazards and their associated risks must be monitored and reviewed. The process of ongoing improvement, revision and assessment is vital, and should occur regularly.

Hazards and risks may change over time so it is important to review your HIRA annually.

Revision Log

Keep track of your HIRA revisions! This will help ensure continuity of documentation and assessment from year to year.

Use a log to keep track of this vital information. You should also include documentation for the HIRA with this record.