To put this issue in context, prior to 911 GAO questioned Congress's and the Administration's expenditure of billions of dollars to mitigate the consequences of a successful deployment of NBC's by terrorists, without any risk assessment.  Here we are, over ten years later, and we now have a proposed policy for future risk assessment.  This is a slow but positive step.  The problem is that, beyond the development of a risk assessment approach, we don't have more.

Risk assessment lays the ground work for cost effective mitigation, which is the function of a separate approach undertaken here under the title "Disaster," which is referred to as "Preparing for, Responding to, and Recovering from Disasters."  In this section DHS proposes that it will work with "Stakeholders" to develop a "Strategy for Resilience."

Another way of putting this is that DHS bureaucrats will work with industries that are both at risk and threat sources (to the public at large) to develop mitigation strategies. If we were to add that they will report their results to congress, then we would have a perfect iron triangle, in which those working on this issue would rotate their employment between congress, industry, and the administration.

Risk assessment needs to be a separate function, but it could and should do more than just produce assessments.