Security management · Risk assessment

Security risk assessment, from threat to residual risk

A risk assessment is only useful when the reasoning is visible. This shows the chain a security manager works through, the levels at which it is applied, and how the result is recorded so leadership can accept or reject the residual risk.

Illustrative analytical example, demonstrates method, not operational guidance for a specific organisation.

The assessment chain

Step 1

Threat

Improvised explosive attack against a fixed target in a capital-city district with a history of complex attacks.

Step 2

Vulnerability

Office sits on an arterial road with limited stand-off, a single approach and predictable staff arrival timings.

Step 3

Exposure

Twenty-two national and international staff present between 08:00 and 17:00, with visitor traffic on set days.

Step 4

Impact

Potential fatalities and serious injury, structural damage, programme suspension and prolonged staff-care obligations.

Step 5

Mitigation

Stand-off improvement, blast film, access control and search, arrival-time variation, safe room, drill rhythm, casualty plan.

Step 6

Residual risk

Reduced but not eliminated. Held at a level the organisation has formally accepted, with a named owner and quarterly review.

Applied at five levels

Level	What it covers	What it decides
Country	National threat environment, governance, conflict dynamics, legal and regulatory exposure.	Board risk appetite, country-entry decisions, insurance and donor assurance.
Regional	Sub-national conflict geography, armed-group influence, access and administrative control.	Programme footprint decisions and regional movement policy.
City	Urban threat pattern, district exposure, incident clustering, guarding and residence standards.	Office and residence siting, curfews, movement approval levels.
Operational area	Site, compound, distribution point or field base and its immediate surroundings.	Site security standards, staffing posture, community engagement.
Route / corridor	Road segment, checkpoints, hostile-act history, road condition and communications coverage.	Journey approval, timing, convoy rules and abort criteria.

Risk matrix

Country register entries plotted by likelihood and impact. Reference numbers correspond to the country register below.

Security risk matrix across the East Africa and Horn of Africa country register
	Insignificant	Minor	Moderate	Major	Severe
Almost certain	MODERATE risk. None	SUBSTANTIAL risk. None	SEVERE risk. None	CRITICAL risk. SD-A2	CRITICAL risk. None
Likely	LOW risk. None	MODERATE risk. ER-A3	SUBSTANTIAL risk. SO-A3 ET-A3 ET-A4 SS-A5 DJ-A2 BI-A3	SEVERE risk. SD-A3 SD-A5 SS-A1 SS-A2 KE-A3 UG-A2 TZ-A1	CRITICAL risk. SO-A1 SD-A1
Possible	LOW risk. None	MODERATE risk. DJ-A4	MODERATE risk. DJ-A3 KE-A5 UG-A3 UG-A4 TZ-A2 TZ-A5 RW-A3 BI-A5	SUBSTANTIAL risk. ET-A5 ER-A1 KE-A4 UG-A1 RW-A2 BI-A2 BI-A4	SEVERE risk. SO-A2 ET-A1 ET-A2 SD-A4 SS-A3 SS-A4 KE-A1
Unlikely	LOW risk. None	LOW risk. None	MODERATE risk. None	MODERATE risk. TZ-A4 RW-A4 BI-A1	SUBSTANTIAL risk. SO-A4 ER-A2 ER-A4 DJ-A1 KE-A2 TZ-A3 RW-A1
Rare	LOW risk. None	LOW risk. None	LOW risk. None	LOW risk. None	MODERATE risk. None

LOW
MODERATE
SUBSTANTIAL
SEVERE
CRITICAL

Country risk register: Somalia to Burundi

The rated risks carried in each country assessment, drawn from the Country Risk Laboratory. Ratings are analyst judgements from public reporting and describe the environment for a civilian organisation, not any named employer.

Ref	Country	Risk	L	I	Rating	Mitigation
SO-A1	Somalia	Staff caught in the effects of an explosive attack on a nearby government, security or hotel target	4	5	CRITICAL	Stand-off and site hardening; avoid venues used by officials; keep exposure short at high-profile locations; safe room and drills.
SO-A2	Somalia	Ambush or roadside device against vehicle movement on an inter-city corridor	3	5	SEVERE	Per-journey route assessment; varied timing; road check on the day; abort criteria and communications schedule.
SO-A3	Somalia	Detention, extortion or long delay at an informal checkpoint	4	3	SUBSTANTIAL	Checkpoint mapping; documented no-payment position; scripted responses; single negotiation contact; report every event.
SO-A4	Somalia	Abduction of staff for ransom or leverage	2	5	SUBSTANTIAL	Reduce predictability; restrict advance disclosure of movement; vetted drivers; rehearsed crisis plan.
ET-A1	Ethiopia	Staff caught in armed confrontation or crossfire during regional road movement	3	5	SEVERE	Region-specific movement approval; daylight-only travel; route assessment refreshed on the day; abort criteria.
ET-A2	Ethiopia	Abduction for ransom on an Amhara or Oromia road corridor	3	5	SEVERE	Reduce predictability; low-profile vehicles and posture; restrict movement disclosure; rehearsed crisis plan.
ET-A3	Ethiopia	Loss of contact with a field team during a communications shutdown	4	3	SUBSTANTIAL	Redundant comms; pre-agreed check-in windows; no-contact procedure with escalation timings.
ET-A4	Ethiopia	Access withdrawn or permissions withheld, suspending delivery	4	3	SUBSTANTIAL	Documented access agreements; partner-led contingency delivery; pre-agreed suspension and resumption criteria.
ET-A5	Ethiopia	Identity-based pressure or detention of national staff at a checkpoint	3	4	SUBSTANTIAL	Agreed checkpoint protocol; documentation discipline; named legal and welfare support; incident reporting without blame.
SD-A1	Sudan	Staff killed or injured by indirect fire or air attack in a contested urban area	4	5	CRITICAL	Programme criticality; minimum footprint and staffing; hardened shelter and drills; relocation triggers agreed in advance.
SD-A2	Sudan	Armed looting of premises, vehicles or warehoused stock	5	4	CRITICAL	Disperse stock; no fuel or vehicle concentration at staffed sites; low visible profile; documented low cash holdings.
SD-A3	Sudan	Detention or interrogation of staff at a checkpoint or cross-line crossing	4	4	SEVERE	Same-day permissions from every party; documentation discipline; scripted responses; named legal and welfare support.
SD-A4	Sudan	Death or injury from explosive remnants of war in an area fighting has passed through	3	5	SEVERE	Explosive-ordnance awareness for all staff; mine-action clearance information; rule against entering unswept structures.
SD-A5	Sudan	National staff and dependants left exposed after international relocation	4	4	SEVERE	Written national-staff support policy agreed before any relocation; salary continuity; relocation options; family contact plan.
SS-A1	South Sudan	Ambush or armed robbery against a road or river movement	4	4	SEVERE	Journey management and route assessment; daylight movement; comms schedule; abort criteria; no valuables or cash in transit.
SS-A2	South Sudan	Staff caught in communal or subnational armed violence near a field base	4	4	SEVERE	Early-warning indicators with named local sources; lock-down and relocation plans; pre-agreed suspension thresholds.
SS-A3	South Sudan	Sexual violence against a staff member	3	5	SEVERE	Explicit assessment and controls; accommodation and movement standards; trained focal points; confidential, survivor-centred response.
SS-A4	South Sudan	Serious medical emergency at a location distant from adequate care	3	5	SEVERE	Pre-deployment medical mapping; first-aid capability on movement; documented referral and escalation with a named provider.
SS-A5	South Sudan	Armed or administrative interference in selection, procurement or recruitment	4	3	SUBSTANTIAL	Documented, transparent criteria; community feedback channels; escalation route; readiness to pause rather than concede.
ER-A1	Eritrea	Detention or questioning of staff over movement, photography or perceived political activity	3	4	SUBSTANTIAL	Legal and behavioural briefing; permit discipline; detention plan with consular and family liaison.
ER-A2	Eritrea	Harm to local staff or contacts through documented association	2	5	SUBSTANTIAL	Minimum data held in-country; no contact lists on devices; informed-consent approach to naming anyone.
ER-A3	Eritrea	Movement or programme blocked by withheld permissions	4	2	MODERATE	Plan around permit timelines; contingency activities that need no movement; no commitments contingent on unissued permits.
ER-A4	Eritrea	Injury from explosive remnants of war near former border-conflict areas	2	5	SUBSTANTIAL	Explosive-ordnance awareness briefing; marked routes only; local mine-action information before any field visit.
DJ-A1	Djibouti	Attack on a hotel, restaurant or venue frequented by internationals	2	5	SUBSTANTIAL	Vary venues and timings; assess stand-off and exits; keep exposure short; rehearsed incident procedure.
DJ-A2	Djibouti	Heat-related illness or death among drivers, guards or field staff	4	3	SUBSTANTIAL	Work-rest cycles; hydration standards; scheduling around peak heat; heat-illness recognition and first aid.
DJ-A3	Djibouti	Corridor or port disruption interrupting regional supply	3	3	MODERATE	Contingency routing and pre-positioning; monitor maritime advisories; buffer stock at destination.
DJ-A4	Djibouti	Opportunistic crime against staff in Djibouti City	3	2	MODERATE	Area briefing; avoid night walking in identified areas; low-value carry; taxi and driver standards.
KE-A1	Kenya	Roadside device or ambush affecting movement in Garissa, Wajir, Mandera or the Lamu hinterland	3	5	SEVERE	Separate movement standard for the north-east; route assessment and road check; convoy and comms rules; abort criteria.
KE-A2	Kenya	Attack on a soft target used by staff in Nairobi or Mombasa	2	5	SUBSTANTIAL	Venue selection criteria; vary patterns; short exposure at high-profile sites; rehearsed incident procedure.
KE-A3	Kenya	Road traffic collision during staff movement	4	4	SEVERE	Driver standards and assessment; speed policy; vehicle checks; night-travel ban; journey approval.
KE-A4	Kenya	Violent urban crime, including carjacking or express abduction	3	4	SUBSTANTIAL	Vetted transport; arrival and departure procedures; low-value carry; area briefing repeated regularly.
KE-A5	Kenya	Staff caught in protest or public-order response	3	3	MODERATE	Written movement-pause thresholds; remote-working plan; avoid identified assembly points; monitoring and early notification.
UG-A1	Uganda	Armed attack or crossfire affecting staff in western border districts	3	4	SUBSTANTIAL	District movement rules; local early-warning indicators; daylight movement; suspension thresholds.
UG-A2	Uganda	Road traffic collision, including motorcycle-taxi use	4	4	SEVERE	Driver standards; motorcycle-taxi prohibition for work travel; speed policy; night-travel ban; vehicle checks.
UG-A3	Uganda	Staff caught in public-order events around an election cycle	3	3	MODERATE	Monitoring and notification; movement-pause thresholds; remote-working plan; avoid assembly points.
UG-A4	Uganda	Administrative or legal restriction on operations	3	3	MODERATE	Keep registration and reporting current; retain legal advice; assess political exposure of activities and partners.
TZ-A1	Tanzania	Road traffic collision on an inter-city route	4	4	SEVERE	Driver standards; journey approval; speed policy; night-travel ban; rest scheduling; vehicle maintenance.
TZ-A2	Tanzania	Violent or opportunistic crime against staff or visitors	3	3	MODERATE	Area briefing; vetted transport; low-value carry; residence standards; cash-handling rules.
TZ-A3	Tanzania	Marine incident on a ferry or boat movement	2	5	SUBSTANTIAL	Operator standards; lifejackets; manifest and check-in; refuse overloaded vessels.
TZ-A4	Tanzania	Security incident in south-eastern border districts	2	4	MODERATE	Separate movement standard; cross-border incident monitoring; local early-warning contacts; suspension thresholds.
TZ-A5	Tanzania	Regulatory or registration failure interrupting operations	3	3	MODERATE	Compliance calendar with named owners; legal advice retained; document control.
RW-A1	Rwanda	Harm to participants, contacts or staff through identifiable data or reporting	2	5	SUBSTANTIAL	Anonymisation by default; informed consent; minimum data; secure storage; legal review before publication.
RW-A2	Rwanda	Road traffic collision on hill roads or in wet conditions	3	4	SUBSTANTIAL	Driver standards; night-travel restriction; wet-weather rules; vehicle maintenance and checks.
RW-A3	Rwanda	Cross-border escalation disrupting north-western operations	3	3	MODERATE	Border-status monitoring; movement rules tied to status; contingency plans; suspension thresholds.
RW-A4	Rwanda	Legal or administrative exposure from research or public comment	2	4	MODERATE	Legal briefing and review; clear internal approval for public statements; staff briefed on local law.
BI-A1	Burundi	Grenade or armed incident affecting staff or premises	2	4	MODERATE	Site access control; vary patterns; avoid political gatherings; rehearsed incident and lock-down procedure.
BI-A2	Burundi	Questioning or detention of national staff over the organisation's work	3	4	SUBSTANTIAL	Agreed protocol; documentation discipline; named legal support and family liaison; blame-free reporting.
BI-A3	Burundi	Road traffic collision or breakdown on poor roads or during fuel shortage	4	3	SUBSTANTIAL	Journey approval; fuel planning; vehicle maintenance; night-travel ban; recovery arrangements.
BI-A4	Burundi	Serious medical emergency without adequate local care	3	4	SUBSTANTIAL	Documented referral pathway including regional escalation; first-aid capability; insurance confirmed before deployment.
BI-A5	Burundi	Loss of operating permission or administrative restriction	3	3	MODERATE	Current registration and reporting; documented non-political position; legal advice retained; relationship management.

Country assessments

Each country is assessed in full, including its operating environment, threats, vulnerabilities and operational considerations, in the Country Risk Laboratory.

SEVERESomalia

An armed opposition retaining the capability to mount complex and explosive attacks in urban centres, contested control on inter-city roads, and a security transition that shifts responsibility faster than it builds capacity.

SUBSTANTIALEthiopia

A country where the security picture is regional rather than national: Addis Ababa functions normally while armed conflict, communication restrictions and access denial persist in parts of Amhara, Oromia and the Tigray periphery.

CRITICALSudan

Active war between organised military forces, with urban ground fighting, air and artillery use, collapsed services, and humanitarian access determined by front lines and by permissions from the parties.

SEVERESouth Sudan

Localised armed violence, subnational and communal conflict, and one of the world's most consistently documented environments for violence against aid workers, compounded by seasonal roads and thin medical capability.

MODERATEEritrea

Low reported criminal and armed threat to foreign civilians, but a tightly controlled operating environment where the principal risks are administrative, legal and informational rather than violent.

MODERATEDjibouti

A comparatively stable base and logistics hub whose risk profile is shaped by its neighbours, by maritime threat in the Bab al-Mandab approaches, and by extreme heat rather than by armed violence ashore.

SUBSTANTIALKenya

A stable regional hub with two distinct problems: a persistent cross-border threat in the north-east and coastal hinterland, and urban crime and protest dynamics in Nairobi and Mombasa.

MODERATEUganda

Generally permissive for civilian operations, with concentrated risk in the western border districts near the DRC, political and public-order friction around elections, and criminality in Kampala.

LOWTanzania

A largely permissive environment where crime, road safety and regulatory compliance dominate the risk picture, with a localised watch item in the south-east near the Mozambique border.

LOWRwanda

Low crime and a highly ordered operating environment, with the material risks sitting in regional spillover from eastern DRC, in political and information sensitivity, and in road safety.

MODERATEBurundi

Constrained operating conditions with political sensitivity, localised armed incidents and regional tension with Rwanda and eastern DRC, alongside routine crime and weak road and medical infrastructure.

Applied assessments

Somalia: country, regional and city assessments

The method above applied to Somalia at three levels. Each assessment states a threat level in UK terminology, the drivers behind it, the risks that shape decisions with likelihood and impact rated, the mitigation for each, and the assumptions, confidence and public sources the judgement rests on.

Country assessmentSEVEREAn attack is highly likely.

Somalia, country assessment

Armed opposition capability, contested territorial control and a security transition in progress. For civilian organisations the practical risk is concentrated in movement, in the predictability of routines, and in the standard of the sites they occupy.

Risk drivers

Sustained capability to mount explosive and complex attacks in urban centres, directed mainly at government and security targets.
Contested control on inter-city corridors, with informal checkpoints and taxation reported by transporters.
A security transition that produces short-lived gaps in control in districts adjoining main routes.
Clan and political competition that can turn local disputes into armed confrontation at short notice.
Climatic shocks, drought and flooding, that displace people and reshape access without any change in the threat picture.

Threat, vulnerability and exposure

Threat

· Al-Shabaab retains intent and capability for complex attacks on government, hotel and aid-adjacent targets nationally.
· Kidnap for ransom and abduction of national and international staff, most often on movement rather than at static sites.
· Clan and federal-state political disputes that produce armed standoffs at short notice.
· Improvised explosive devices on main supply routes between urban centres.

Vulnerability

· Predictable movement patterns and repeated use of the same routes, times and accommodation.
· Reliance on a small number of trusted intermediaries for access negotiation and information.
· Uneven incident reporting between capital and field offices, so patterns surface late.
· Static sites in mixed-use urban areas where standoff distance cannot be achieved.

Exposure

· International and national staff on road movement between Mogadishu and regional hubs.
· Programme sites and partner offices in contested districts outside federal control.
· Airport-corridor movement in Mogadishu, concentrated at a small number of chokepoints.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
SO-01	Staff caught in the effects of an explosive attack on a nearby government, security or hotel target	4	5	CRITICAL	Site selection with stand-off; avoid venues used by officials; keep exposure at high-profile locations short; safe-room standard and drills.
SO-02	Ambush or IED against vehicle movement on an arterial or inter-city route	3	5	SEVERE	Route risk assessment per journey; varied timing and routing; day-of-travel road check; written abort criteria held by the vehicle commander.
SO-03	Detention, extortion or delay at an informal checkpoint	4	3	SUBSTANTIAL	Checkpoint mapping with transporters; documented no-payment position; scripted responses; single point of contact for negotiation; report every event.
SO-04	Abduction of staff for ransom or leverage	2	5	SUBSTANTIAL	Reduce pattern predictability; restrict advance disclosure of movement; vetted drivers and vehicles; crisis-management plan rehearsed with named roles.
SO-05	Programme suspension through loss of access following a security or political event	4	3	SUBSTANTIAL	Partner-led contingency delivery; remote monitoring capability; pre-agreed suspension and resumption criteria.
SO-06	Crime against staff and premises, including armed robbery and theft	4	2	MODERATE	Access control and guarding standards specified in contract; cash-handling limits and rules; residence security survey.
SO-07	Aid diversion or association with an armed actor damaging acceptance	3	4	SUBSTANTIAL	Partner vetting and due diligence; distribution monitoring; community feedback channels; clear public position on independence.
SO-08	Medical emergency without timely access to adequate care	3	4	SUBSTANTIAL	Medical capability mapped before deployment; first-aid trained staff on movement; documented referral and evacuation arrangement with a named provider.

Assumptions

· No fundamental change in armed-opposition capability or intent during the assessment period.
· Security-force transition continues broadly on its stated course rather than collapsing or accelerating sharply.
· Organisation maintains a low-profile posture and does not adopt armed protection.

Confidence

Moderate, the pattern is consistently reported in open sources, but district-level verification is limited and route conditions change faster than reporting confirms.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

Regional assessmentSEVEREAn attack is highly likely.

South-Central Somalia (Banadir, Lower Shabelle, Bay)

The highest concentration of both programme activity and armed-opposition capability. Urban proximity risk and corridor risk sit alongside each other, and the two require different controls.

Risk drivers

Attack capability concentrated in and around Mogadishu and along the Afgooye and Baidoa corridors.
Frequent changes in control of route segments outside main towns.
Displacement into urban settlements, increasing programme presence in dense, hard-to-secure locations.

Threat, vulnerability and exposure

Threat

· Sustained armed-group presence and taxation on the routes linking Mogadishu, Afgooye, Baidoa and the Lower Shabelle agricultural belt.
· Indirect fire and IED attacks near military and government positions.
· Interference with aid delivery, including diversion demands at district level.

Vulnerability

· Programme dependence on a single overland corridor per district.
· Partner staff living within communities under armed-group influence, limiting what they can report.
· Limited ability to verify access agreements independently.

Exposure

· Distribution sites drawing large crowds at fixed, published times.
· Convoy movements carrying visible commodity loads.
· Field monitors travelling without a second vehicle or reliable communications.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
SC-01	Proximity exposure in Mogadishu to attacks on government and security targets	4	5	CRITICAL	Stand-off and access control at sites; venue vetting; short exposure at high-profile locations.
SC-02	Checkpoint extortion, delay or detention on the Afgooye and Baidoa corridors	4	3	SUBSTANTIAL	Checkpoint mapping refreshed with transporters and partners; documented no-payment position; scripted responses; every interaction reported.
SC-03	Loss of a corridor segment mid-journey, leaving staff between safe locations	3	4	SUBSTANTIAL	Fallback location named for every leg; communications check schedule; authority to hold or return delegated to the vehicle commander.
SC-04	Distribution disruption or crowd incident at a site in a dense settlement	3	3	MODERATE	Site layout and queue management planned with the community; separate entry and exit; abort criteria agreed before the activity.
SC-05	Local armed dispute affecting a programme location	3	3	MODERATE	Community engagement and early-warning contact; suspension threshold agreed in advance; no armed presence at sites.

Assumptions

· Programme delivery continues to rely on road movement rather than air for most inter-district activity.
· Community acceptance remains the primary protection at programme sites.

Confidence

Moderate, corridor conditions are described consistently by transporters and partners but are rarely independently verified.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

Regional assessmentSUBSTANTIALAn attack is likely.

Puntland & Somaliland

A materially different picture from South-Central: more predictable administration and lower attack tempo, with risk concentrated around contested boundaries, coastal areas and periods of political tension.

Risk drivers

Disputed administrative boundaries, including around Sool and Sanaag, where tension can escalate quickly.
Armed-group activity reported in the Golis mountain areas of Puntland.
Political and electoral competition that periodically produces unrest in urban centres.
Coastal and maritime exposure, including reporting on piracy and irregular movement.

Threat, vulnerability and exposure

Threat

· Localised ISS presence in the Bari mountains and periodic attacks on security forces.
· Contested-boundary flashpoints, including Las Anod and surrounding districts.
· Criminal abduction along coastal and border routes.

Vulnerability

· Assumption that comparatively stable areas require lighter procedures.
· Cross-boundary movement planned without local political awareness.
· Escalation planning built around Mogadishu contacts rather than local authorities.

Exposure

· Staff transiting boundary districts between Somaliland and Puntland.
· Field visits to coastal and mountainous districts of Bari and Sanaag.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
PS-01	Escalation of a boundary dispute affecting movement or programme presence	3	4	SUBSTANTIAL	Avoid contested boundary areas without a specific assessment; monitor local political reporting; suspension criteria agreed in advance.
PS-02	Unrest around political events in Garowe, Hargeisa or Bosaso	3	3	MODERATE	Event calendar maintained; movement curtailment during announced events; staff briefed on avoidance rather than observation.
PS-03	Armed incident in the Golis and adjacent rural areas	2	5	SUBSTANTIAL	No routine movement into affected areas; specific authorisation and escort arrangements only where unavoidable and lawful.
PS-04	Road traffic accident on long inter-city routes	4	4	SEVERE	Journey management with rest schedule; daylight-only travel; vehicle standards and driver assessment; medical plan for the route.
PS-05	Crime against staff and premises in urban centres	3	2	MODERATE	Residence and office security survey; access control; cash-handling rules.

Assumptions

· Administrations continue to permit programme presence and movement on current terms.
· No sustained escalation of boundary disputes into open conflict during the assessment period.

Confidence

Moderate, political reporting is reasonably accessible; rural areas are far less well covered.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

City assessmentSEVEREAn attack is highly likely.

Mogadishu

Proximity risk dominates. Where an organisation sits, how it moves and how predictable it is matter more than any single procedure.

Risk drivers

Attacks on government precincts, security facilities and hotels used by officials.
Airport road and arterial route exposure during routine transfers.
Dense urban environment where stand-off is difficult to achieve.

Threat, vulnerability and exposure

Threat

· Vehicle-borne and person-borne IED attacks on hotels, government compounds and checkpoints.
· Targeted shootings of officials, journalists and perceived collaborators.
· Indirect fire directed at the airport perimeter and government district.

Vulnerability

· Routine use of the same hotels, meeting venues and airport-run timings.
· Meeting locations chosen for convenience rather than standoff distance and exit options.
· Crowded arrival and departure procedures at compound gates.

Exposure

· Airport-road movement and compound entry points at peak hours.
· Hotel conference and meeting spaces used by international visitors.
· Staff waiting in vehicles outside compounds while access is cleared.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
MG-01	Attack on a nearby target affecting an office, residence or venue in use	4	5	CRITICAL	Site survey with stand-off, blast-mitigation glazing where feasible, vehicle screening at the gate, safe room and quarterly drills.
MG-02	IED or small-arms incident during an airport or arterial transfer	3	5	SEVERE	Varied timing and routing; day-of-travel route check; minimum-occupancy rules; abort criteria held in the vehicle.
MG-03	Inherited risk from a meeting venue with weak access control	4	4	SEVERE	Venue vetting before use; preference for own premises; exposure kept short; no repeat pattern at the same venue and time.
MG-04	Crime, including armed robbery, against staff off duty	3	3	MODERATE	Off-duty movement rules; approved locations only; residence security standards; curfew aligned to assessment.
MG-05	Delay or detention at a checkpoint inside the city	3	2	MODERATE	Documentation carried and current; scripted responses; report every interaction to build the pattern.

Assumptions

· Organisation maintains civilian, unarmed posture and does not co-locate with security or government facilities.
· Airport transfers remain the most frequent movement requirement.

Confidence

Moderate to high on the pattern of attack in Banadir; moderate on route-specific conditions.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

City assessmentSUBSTANTIALAn attack is likely.

Kismayo

Comparatively contained inside the town, with the significant exposure on approach routes and at the boundary of controlled areas.

Risk drivers

Armed opposition presence in the surrounding hinterland.
Regional political competition affecting local security arrangements.
Limited road access, concentrating movement into few predictable routes.

Threat, vulnerability and exposure

Threat

· Armed-group presence in surrounding districts with periodic attacks inside the city.
· Jubaland political and security-force friction producing armed incidents.
· IED risk on the routes into the city and towards Afmadow.

Vulnerability

· Reliance on air access, so contingency planning collapses if flights stop.
· Thin local security information beyond the immediate city.

Exposure

· Movement between the airport, city and port areas.
· Field activity in districts outside the security perimeter.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
KS-01	Incident on the approach route or at the edge of controlled area	3	5	SEVERE	Air movement preferred for staff rotation; overland only with specific assessment and stated abort criteria.
KS-02	Political friction affecting programme access or permissions	3	3	MODERATE	Relationship management with authorities; documentation current; suspension and resumption criteria pre-agreed.
KS-03	Crime and opportunistic theft against premises	3	2	MODERATE	Access control, guarding standards in contract, asset and cash controls.
KS-04	Medical emergency with limited local capability	3	4	SUBSTANTIAL	Capability mapped in advance; referral and air-transfer arrangement documented with a named provider.

Assumptions

· Air access remains available for routine rotation.
· Local authorities continue to permit programme presence.

Confidence

Moderate, reporting from Kismayo and Lower Juba is thinner than for Banadir.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

City assessmentSEVEREAn attack is highly likely.

Baidoa

A major displacement hub with substantial programme presence, reached mainly along a corridor where control changes.

Risk drivers

Corridor exposure between Mogadishu and Baidoa, including checkpoints and reported taxation.
Large displacement settlements with dense, hard-to-secure programme sites.
Armed opposition presence in surrounding districts.

Threat, vulnerability and exposure

Threat

· Armed-group control of the approaches and periodic attacks on security positions.
· Abduction risk on the Mogadishu to Baidoa road.
· Tension around displacement sites and assistance distribution.

Vulnerability

· Programme reach that depends on movement through areas under armed-group taxation.
· Displacement-site work that concentrates staff and assets in one place at one time.

Exposure

· Overland movement to and from Mogadishu.
· Distribution and registration activity in and around displacement sites.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
BD-01	Attack or ambush on the corridor during overland movement	3	5	SEVERE	Air movement as default; overland only on specific assessment, in daylight, with fallback locations named and abort criteria written.
BD-02	Checkpoint extortion or detention en route	4	3	SUBSTANTIAL	Checkpoint mapping refreshed with transporters; no-payment position documented; single negotiation point of contact.
BD-03	Crowd or security incident at a distribution site in a settlement	3	3	MODERATE	Site layout planned with community leaders; separate entry and exit; agreed abort criteria; no armed presence.
BD-04	Targeting of staff perceived as associated with authorities	2	5	SUBSTANTIAL	Visible independence; no co-location with security actors; community engagement maintained separately from authorities.

Assumptions

· Air access to Baidoa continues.
· Community acceptance remains the primary protection at settlement sites.

Confidence

Moderate, corridor conditions are reported consistently but change quickly.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

City assessmentMODERATEAn attack is possible, but not likely.

Hargeisa & Garowe

The most stable urban environments in the assessment, where routine risk is crime, road traffic and periodic political unrest rather than armed attack.

Risk drivers

Functioning municipal administration and policing.
Political and electoral events that periodically produce unrest.
Long inter-city routes with significant road traffic risk.

Threat, vulnerability and exposure

Threat

· Occasional political demonstrations and localised unrest around elections and boundary disputes.
· Petty and opportunistic crime rather than organised attack planning.

Vulnerability

· Procedures relaxed to the point that incident reporting and check-in habits lapse.
· Movement outside the cities planned on urban assumptions.

Exposure

· Staff caught incidentally in demonstrations or security-force responses.
· Road movement between Hargeisa, Burao, Garowe and boundary districts.

Risk register and mitigation

Ref	Risk	L	I	Rating	Mitigation
HG-01	Road traffic accident on inter-city movement	4	4	SEVERE	Journey management, daylight-only travel, rest schedule, vehicle standards, driver assessment, medical plan by route.
HG-02	Unrest around a political or electoral event	3	3	MODERATE	Event calendar; movement curtailment; avoidance briefing; office closure criteria.
HG-03	Crime against staff or premises	3	2	MODERATE	Security survey, access control, cash-handling rules, off-duty guidance.
HG-04	Complacency producing weak procedure adherence	4	2	MODERATE	Same reporting and journey discipline as higher-risk locations; periodic assurance check.

Assumptions

· No sustained escalation of boundary disputes affecting the urban centres during the assessment period.

Confidence

Moderate to high, urban reporting is reasonably accessible and consistent.

Sources

· ACLED conflict event data
· UN OCHA Somalia situation reporting
· Insecurity Insight aid-security reporting
· Somali national and regional media monitoring
· Mazin Intel analyst assessment

Country Risk Laboratory The full security-management cycle Somalia NGO case study Journey and corridor risk Country risk dashboards