However, the results to date have been inconclusive. The second assessment is a national-level threat assessment of the terrorist threat in the United States. Department of Justice and FBI officials told us that the September 11 terrorist attacks may dictate revisions to these assessments and delay their completion. While we view both of these assessments as positive, the FBI noted that these would be limited to threat assessments only and will not include other important aspects of risk management that we discuss below. The Department of Justice took over that program in fiscal year 2001, and has worked with the FBI to create a risk management tool for state and local governments.This tool includes a step-by-step methodology for assessing threats, risks, and requirements. A Risk Management Approach Can Guide Preparedness Efforts

Risk management is a systematic, analytical process to consider the likelihood that a threat will harm an asset or individuals and to identify actions that reduce the risk and mitigate the consequences of an attack or event. However, risk and vulnerability assessments need to be bolstered by a criticality assessment, which is the final major element of the risk management approach.
What GAO Found

Because of the terrorist attacks against the World Trade Center and the Pentagon on September 11 and the subsequent appearance of letters containing anthrax, terrorism rose to the top of the national agenda. The Attorney General has indicated that the country needs to be prepared for still more terrorist incidents. The Department of Justice is working with state and local governments to complete risk management tools for the domestic preparedness program. However, the FBI told GAO that these will be limited to threat assessments only and will not include other aspects of risk management that GAO advocates. Despite these inconclusive results, the federal government can benefit from risk management. Risk management is a systematic and analytic process to consider the likelihood that a threat will endanger an asset and to identify actions that reduce the risk and mitigate the consequences of an attack. An effective risk management approach includes a threat assessment, a vulnerability assessment, and a criticality assessment. Such an approach could help the nation prepare against threats it faces and help better target finite resources to areas of highest priority.