The HSE-gateway

Risk and Vulnerability Analysis (RVA-analysis)

If the risk assessment relates to emergency preparedness or HSE issues at an overall level, we recommend an RVA-analysis (ROS-analyse). At the University of Bergen, CIM shall be used as a tool for RVA-analysis, and the employees who work with this type of analysis are usually appointed at the faculty level.

Main content

What is an RVA-analysis?

RVA is the abbreviation for risk and vulnerability analysis (In Norwegian it is called a ROS-analyse). Some people use the term to describe risk assessments in general, but in this section we use it to describe a special type of risk analysis method for overall risk assessment related to emergency preparedness or HSE issues at an overall level

If the risk assessment relates to emergency preparedness or more overall HSE issues, one carries out an RVA-analysis. RVA-analyses are performed using CIM, and the employees who work with this type of analysis are usually appointed at the faculty level. For risk assessments relating to HSE issues at a local unit level or for a single task, one can use an HSE risk assessment or Safe Job Analysis (SJA).

An RVA-analysis follows the risk assessment process, which comprises planning, risk analysis and risk evaluation. We recommend that you are familiar with the process before continuing. You can read more about the risk assessment process here.


Emergency preparedness is defined as planned and prepared measures that allow us to manage undesired events in a manner that minimises their consequences. In principle, this relates to public safety.

Public safety is the ability of society (in this case the ability of the University of Bergen) to safeguard against and manage events that pose a threat to fundamental assets and functions, and represent a risk to life and health. Such events may be triggered by natural phenomena or caused by technical or human error or deliberate actions.

It can be difficult to draw a clear line between an undesired event from the perspective of public safety and an HSE event. One possible rule of thumb is that an event from a public safety perspective may represent a crisis for the organisation, requiring the appointment of the crisis staff at the faculty/university and activation of measures from the emergency plans. An HSE event can therefore, in the worst case scenario, also represent a public safety event. 

Overall HSE in this context relates to issues, for which an overview analysis may perhaps be performed before studying the details. It could also be HSE issues that are analysed at a general level for the faculty.

Vulnerability: It is not possible to conduct an RVA-analysis without assessing vulnerability. Vulnerability may have several definitions, but for the purpose of RVA-analyses, we can say that vulnerability is an expression of the “Insufficient ability of an object of analysis to withstand the outcome of an undesired event, and insufficient ability to recover original status or function after the event” (NS 5814-2008).

The opposite of vulnerability is resilience.

How are we equipped to withstand the impact of an extreme weather with unusually high levels of precipitation and strong winds? Examples of impact are power cuts and flooding. And how quickly could we recover our original functionality after such an event? 

When is an RVA-analysis required?

The goal for a risk and vulnerability analysis (RVA) is to establish an updated overview of risk covering the facultys area of responsibility, assess the vulnerability of the organisation and propose how risk and vulnerability should be managed by means of any new measures to reduce risk. The purpose is to contribute towards a satisfactory level of safety for the organisation and its users by means of targeted prevention and emergency preparedness. Emergency plans and the choice of scenarios for drills can be based on the RVA-analysis.

  • Public safety and emergency preparedness, overall HSE
  • The Faculty (or department/centre at general level)
    • The Faculty management in collaboration with the departments decide which areas to analyse
  • Based on events that may represent a crisis and require appointment of the crisis staff and activation of measures in the emergency plans
  • Overall HSE-related subjects


The Risk Module in CIM is used as a tool for the RVA-analysis. 

We organise courses in RVA-analyses in CIM on a regular basis.

Saving RVA-analyses

The RVA-analyses are documented in CIM and can be accessed there. In addition, completed RVA-analyses shall be archived in ePhorte.

Organisational RVA (RVA-analysis for entire organisation):

An organisational RVA is a type of RVA-analysis conducted as a general analysis for the University of Bergen as a whole. Selected scenarios are analysed.

An organisational RVA is carried out every four years, and is updated once a year. Units may be ordered to implement measures identified from an organisational RVA. One such measure may be to carry out more detailed RVA-analyses at faculty level.


  • Facilitated and entered in CIM by the Section for HSE and emergency preparedness
  • Analyses are performed in groups made up of resource personnel