Within risk management constructs, external risk is as equally valid as internal risk. Natural disasters, external hazardous materials releases, and workplace violence from outside the organization can harm employees and affect organizational operations as much or more than inter-workplace hazards.
In many cases, organizations look to regulations, solvency, liability, and optics as guidance for their risk management of these situations; if an organization fails to plan and prepare for a hurricane, an active shooter event, or a shelter-in-place situation, for example, this oversight can have negative consequences on the organization’s operations, finances, and reputation. The fact that the organization’s operations did not create the hazard does not negate the need to plan for it; likewise, seeking to invalidate the situation or simply hope it goes away can lead to regulatory noncompliance and even legal violations.