Assess Vulnerability & Risk

In step 2, you'll consider the sensitivity and adaptive capacity of your exposed assets to determine which ones are vulnerable. To characterize risk for your most vulnerable asset-hazard pairs, you'll plot the probability of the hazard against the magnitude of the potential loss.

Some groups handle this step themselves; others hire professionals to help them conduct vulnerability and risk assessments.

Steps to Resilience
This content supports the highlighted step.

Understanding Vulnerability

Looking over your list of asset-hazard pairs, you may notice that all assets on the list are not equally likely to be damaged. Another concept—vulnerability—will help you understand which ones are most and least likely to be harmed. Vulnerability is the predisposition or tendency of an asset to be adversely affected by hazards.

As you begin this step, some of the phrases we use for new concepts may feel like unimportant jargon. Be assured that understanding the terms will become more useful as you move forward. Knowing the elements of each concept can help you identify specific approaches to building resilience.

Sensitivity determines potential impacts

To determine if an asset is vulnerable, first consider its sensitivity to the hazards it is exposed to. Is the hazard capable of damaging the asset?

  • If an asset could sustain a negative impact from a hazard, it is sensitive to that hazard. For example, a furniture store is sensitive to flooding.
  • If the potential impact from a hazard is minimal, the asset is not sensitive. For example, assets such as parking lots are generally not sensitive to severe weather.

Check each assets' adaptive capacity

Even if an asset is sensitive to a hazard, it is not necessarily vulnerable. Does the asset have characteristics that enable it to deal with or adjust to the hazard?

Adaptive capacity—the ability to adjust to new situations—reduces the potential impact of a sensitive asset. For each asset-hazard pair, consider the ability of the asset to avoid damage or adapt to its hazard.

House raised on stilts on the left, house at ground level on the right

These two homes in a flood-prone area are both exposed, yet the one on the right is obviously more likely to be damaged if a major flood occurs. Raising buildings above expected flood levels is one example of adaptive capacity, which reduces vulnerability.

Assessing vulnerability

To assess vulnerability, you'll describe the potential impact and adaptive capacity for each of your asset-hazard pairs. Add two columns to your list of asset-hazard pairs to record your input.

Based on your descriptions, add a third column and categorize the vulnerability of each asset-hazard pair as low, medium, or high.

Understanding Risk

For asset-hazard pairs with high or medium vulnerability, you'll also want to characterize the risk they represent. Risk is a compound concept that describes the chance of sustaining a substantial loss.

  • The first element of risk is the probability of a hazard occurring. How likely is it that the hazard will happen in your location? How frequently has it occurred in the past, and is that frequency increasing due to climate change?
  • The second element is the magnitude of consequences from the event. Would the hazard cause a major disruption for a large number of people for an extended period? Would it require large amounts of money and time to regain the previous level of function?

When referring to risk from weather and climate-related hazards, higher risk reflects either a higher chance of a hazard occurring or a higher cost (financial or otherwise) if the hazard occurs. To characterize risk, you'll rate these two parameters for each of your asset-hazard pairs.

Estimate the probability of a hazard

For the hazards that could impact your most vulnerable assets:

  • Collect information on how frequently the hazard has occurred in your region in the past.
  • Check if climate change or other stressors are likely to increase the frequency or severity of the hazard over time.

Digital tools and data available through this site can help you find the answers to these questions. For instance, you can explore past and current conditions or check applied forecasts.

Based on what you find, estimate the probability a hazard will occur as low, medium, or high. Develop a simple rule set for the three categories to ensure that you apply probability consistently. 

Example rule set for categorizing probability:

If a hazard is likely to occur within 5 years, designate it as a high probability. Categorize events that are likely to occur just once in 5 to 20 years as medium probability. Designate events that are likely to occur less frequently than once in 20 years as low probability.

Estimate the magnitude of a loss

Gather available information to help you estimate or illustrate the financial and social costs of the loss you would experience if the hazard occurs. To get started, explore the losses that resulted from recent hazards in other places or find out what it took for communities to recover from hazardous events that occurred a decade or more ago.

Again, develop a simple rule set to help you categorize the magnitude of a loss as low, medium, or high.

Characterize risk

3x3 matrix for plotting probability versus magnitude of consequence


For every asset-hazard pair, plot the probability of the hazard and the magnitude of the loss on a 3x3 matrix like the one shown here. Asset-hazard pairs that plot in the High-High or High-Medium areas of the matrix represent your highest chances of sustaining a substantial loss.


Check FEMA's National Risk Index

Maps in the National Risk Index let users compare Expected Annual Loss, Social Vulnerability, and Community Resilience for 18 natural hazards. Access the interactive online mapping application from FEMA to check your community's status. Learn more in the National Risk Index Primer.

Do you need to hire a consultant?

You may want to view examples of vulnerability assessment reports on this site. Be aware that many communities choose to hire consultants, adaptation practitioners, or Architecture and Engineering (A&E) firms to assist them in compiling their vulnerability and risk assessments. Professionals who fill these roles still need plenty of input from the local champion and team, but they can help groups navigate unfamiliar concepts to document the most pressing potential climate problems in your community.

Qualitative versus quantitative assessments

Communities often begin with qualitative methods such as categorizing vulnerability and risk as low, medium, or high. This approach is fairly quick and effective in identifying vulnerable assets and characterizing risk. However, to set priorities for building resilience for the most important parts of a complex system, groups often choose to do the extra work it takes to quantify vulnerability and risk.

To zero in on specific locations where resilience-building can benefit the entire community, efforts require detailed spatial information and quantitative data on hazards and property values. This quantitative information needs to be paired with an understanding of and commitment to addressing issues related to equity in the community. Quantitative geospatial information may be available as web-accessible map layers. Data available in this format make it relatively easy to calculate and display measures of vulnerability and risk across the community. Maps produced using these methods can display the severity of potential hazards and highlight locations where risk is high. Using a map-based quantitative approach also helps reduce uncertainty, making it easier for your team and decision makers to set priorities.

Where should you start?

In general, groups address their highest risk first. However, if you recognize that damage to a specific asset (for example, a heavily used bridge or your telecommunications capacity) could initiate multiple failures across other sectors in your community, consider that asset as a top priority. Think about the things your community truly depends upon to function, and use that knowledge to set your priorities.

Decision point

Can you accept the risk climate presents to your assets? If not—continue on to Step 3.

Instructions on these pages encourage you to gather specific types of information. You may find it convenient to download this prepared spreadsheet and use it to record input as you move through the steps.

Access the Steps to Resilience Glossary for definitions and examples of words related to resilience.

References for Steps to Resilience

Overview of Steps to Resilience

Last modified
15 July 2021 - 3:48pm