1. Context
Education and Training Facilities (ETFs) operating in complex operational environments face diverse disruption scenarios, ranging from critical subject matter expert (SME) incapacitation and IT hardware failures to regional border closures, health emergencies, and facility compromises. Traditional risk management often treats risk registers as static compliance documents that are filed away until an audit occurs.
To ensure uninterrupted mission continuity, the NATO-Georgia Joint Training and Evaluation Center (JTEC) engineered a Dynamic, Spreadsheet-Based Risk Register. This operational framework maps named disruption scenarios against structured impact categories, automatically calculates inherent and residual risk scores, assigns explicit accountability based on severity thresholds, and establishes pre-planned mitigations across residential, hybrid, and remote delivery modes.
2. Core Operational Differentiators & Architecture
The JTEC Risk Register model introduces several unique structural features that make it easily adoptable by any ETF without requiring specialist software:
Multi-Dimensional Impact Assessment: Risks are evaluated not by a single metric, but across four distinct operational dimensions scored on a 1-5 scale:
Personnel & Safety
Mission Continuity
Reputation & Relations
Financial & Resources
Inherent vs. Residual Risk Scoring & Automated Workflow Triggers: The register multiplies impact levels against probability scores (1-5) to establish an initial risk score. Crucially, as residual scores and severity levels are updated post-mitigation, the spreadsheet automatically calculates and dictates who must be involved and what mandatory actions must be taken (immediate departmental handling vs. Senior Leadership Team meetings or mandatory Board convocations).
Tiered Response Timelines & Mandates: Every risk scenario is tied to an explicit action timeline (ranging from Immediately for minor disruptions to 0-2 Hours for moderate IT failures, 2-12 Hours for major instability, and 24-72 Hours for catastrophic facility incidents).
Pre-Planned Mode Flexibility: Courses and exercises are engineered to transition seamlessly between residential, hybrid, or remote execution, ensuring that external disruptions alter how training is delivered rather than stopping it.
Resilience Through Personnel Turnover: By tying responsibilities, escalation triggers, and mitigation protocols directly to functional roles and automated spreadsheet formulas rather than individual names, the risk register survives staff rotations and turnover, ensuring institutional memory remains intact.
3. Practical Breakdown of Tracked Disruption Scenarios
The risk register covers a comprehensive spectrum of institutional vulnerabilities, complete with named owners and strategic mitigations:
Critical SME Incapacitation (Instructional Gap): Handled via established SOPs, monthly operational logs, and proactive treatment strategies backed by anticipatory intelligence.
Primary Server Hardware Failure (IT Disruption): Managed at the departmental level with prompt DCOM/COS notification, dynamic risk assessments, and formal tiered course delivery contingency planning.
Major Facility Compromise (Man-Made / Accidental): Governed by mandatory board convocations, Crisis Management Team activation, multi-channel communication with Ministries of Defense, and strategic resilience redesigns.
4. Implementation Guide for the Community of Interests (CoI)
Any NATO ETFs, PTECs, NATO COEs or ETFs can implement this proven risk management model using standard spreadsheet software by following four steps:
Establish the Disruption Library: Catalog potential localized and systemic threats (pandemics, cyber attacks, server failures, SME loss) into a centralized spreadsheet.
Define Multi-Axis Impact & Probability: Score risks across personnel, mission continuity, reputation, and resources, utilizing automated formulas to calculate inherent and residual risk scores that instantly trigger required leadership actions.
Pre-Engineer Mitigations & Action Timelines: Outline exact operational responses, mandatory escalation pathways, and multi-mode delivery alternatives (residential/hybrid/remote) before an event occurs.
Integrate into Routine Governance & Turnover Protocols: Review the risk register regularly during executive command meetings to test hypothetical scenarios, verify residual risk, and ensure mitigation ownership remains active across all departments regardless of personnel rotations.