Turning Legal Obligations into Safety: Norway’s Police Risk Assessment System for IPV Under Article 51 IC

2.1 The risk assessment is a cornerstone of the national system

The Istanbul Convention applies to “all forms of violence against women, including domestic violence” (Article 2(1) IC). “Violence against women” is “all acts of gender-based violence that result in, or are likely to result in, physical, sexual, psychological or economic harm or suffering to women, including threats of such acts, coercion or arbitrary deprivation of liberty, whether occurring in public or in private life” (Article 3(a) IC). Pursuant to Article 51 IC, Parties to the Convention have a positive obligation to perform risk assessments in such cases. A risk assessment shall thus be performed not only in IPV cases, but also for instance in cases concerning female genital mutilation, honour-based violence, or stalking against women (GREVIO, 2024b, point 12).

Stalking deserves a special note. Stalking involves “a pattern of repeated and unwanted intrusive behaviour that causes fear or distress in those targeted. Stalkers create an environment in which they appear omnipresent, leading to constant wariness and anxiety for the victim” (McEwan, 2021; see also Kropp & Cook, 2021). Stalking inflicts psychological harm and suffering on the victim, and when the victim is female, it is a form of violence that falls within the scope of the Convention. Stalking may occur within and outside the context of IPV and is therefore sometimes addressed as a distinct phenomenon (McEwan, 2021). For stalking, a specific risk assessment tool is available: SAM (Stalking Assessment and Management guide) (McEwan, 2021). When stalking targets a current or former partner, an IPV risk assessment should also be performed, but it might not always be clear who counts as partner (Ørum, 2023). In Norway, the “Elverum homicide” – Elverum being the place where the victim was ultimately shot and killed by her persecutor – tragically illustrates the complexity. Before she was killed, she had been persistently stalked for about a year. The acts of stalking did not involve any physical contact between the victim and her stalker, yet qualify as violence under the Convention due to the psychological harm and suffering inflicted upon her (for the facts of the case, see Spesialenheten for politisaker, 2025, section 1). Initially, the persecutor and the victim had only had a brief Tinder date, making it doubtful in terms of criminal law that the stalking could be deemed as IPV, nor was it understood that stalking is a form of violence. The result was that neither an IPV risk assessment nor a stalking assessment was performed. The poor handling of the case resulted in a public outcry against the police.

Pursuant to Article 51 IC, the State shall take the necessary “legislative and other measures to ensure that an assessment of the lethality risk, the seriousness of the situation and the risk of repeated violence” is carried out by “all relevant authorities” in order to “manage risk” and if necessary “provide coordinated safety and support” (Article 51 IC).

Article 51 IC must be read in light of the general positive obligation laid down in Article 5(2) IC, obliging the State to take “the necessary legislative and other measures to exercise due diligence to prevent, investigate, punish and provide reparation for acts of violence covered by the scope of [the IC] that are perpetrated by non-State actors” (Article 5(2) IC; emphasis added).

What Article 5(2) IC does with respect to gender-based violence against women is to specify the content of the positive obligation that is already laid down in the European Human Rights Convention(Council of Europe, 1950 (ECHR)) Article 1 (the State shall “secure” the individual’s rights and freedoms). In the context of IPV, Article 1 ECHR should be read particularly in conjunction with Articles 2, 3 and 8 ECHR. It follows that the State shall take active steps to prevent private individuals from violating the human right to life, the right not to be subjected to torture and inhuman and degrading treatment, and the right to privacy. In IPV cases, the private party who is the aggressor is a person who is or was part of the victim’s private sphere, such as a current or former husband or intimate partner. To ensure compliance, the Istanbul Convention establishes a monitoring mechanism effectuated by the expert group GREVIO⁸ (Chapter IX IC).

With respect to IPV, the positive obligation to display “due diligence” mentioned in Article 5(2) IC, imposes a duty on the State to “organise [its] response […] in a way that allows relevant authorities to diligently prevent […] [IPV]. Failure to do so incurs state responsibility for an [IPV act]” (The Explanatory Report to the Istanbul Convention (ER) point 59 (Council of Europe, 2011b; emphasis added)).

It follows that the State shall provide a system for effective response to IPV. Due diligence is an obligation of means, not of result (point 59 ER). The obligation may therefore be fulfilled also when a repeat IPV incident was not prevented, if the system still had provided for all measures that reasonably could have been taken in the concrete case. It is well-established case law that the positive obligation does not impose an “impossible or disproportionate burden” on the police ( Kurt vs. Austria, 2021 , § 158, in the context of Article 2 ECHR). However, the Istanbul Convention sets out an extensive catalogue of preventive measures that the national system must implement. The risk assessment mentioned in Article 51 IC is but one of these measures, yet as it is the mechanism around which the preventive and protective measures in concrete cases revolve, it is crucial to the system.

Thus, according to GREVIO, in its focus report on risk assessment, the assessment is “a cornerstone” of the comprehensive set of measures required by the Istanbul Convention (GREVIO, 2024b, point 1). Risk assessment is “a first step to ensuring co-ordinated safety measures and support to victims” (point 12), and serves as “a crucial mechanism” for States to fulfil their due diligence obligation to prevent and protect individuals from IPV (point 1).

Here it should be recalled that the law assumes that it is possible to predict the risk of repeat violence. The point is important considering that some risk assessment researchers have contested the possibility of predicting the risk of violence in individual cases, alleging that group-based empirical data cannot be used to predict behaviour in specific (individual) cases. Moreover, the margin of error has been claimed to be so wide as to make any such prediction “virtually meaningless” (Hart, Michie, & Cooke, 2007, as cited in Skeem & Monahan, 2011).

However, consensus has now been reached that such risk may be predicted, if not with 100% accuracy then at least with a level of accuracy that is helpful in the majority of cases (e.g., Bonta & Andrews, 2024; Hilton, 2021; López-Ossorio, 2016; Shapiro & Noe, 2015; Skeem & Monahan, 2011). Indeed, Kleinberg et al. (2017) demonstrated how a machine-learning algorithm far outperformed judges in assessing suspects’ risk of recidivism to criminal behaviour, including acts of violence. Clearly, what matters is that on average, risk assessments produced by using tools prove to be more accurate than unaided risk assessments.

Use of risk assessment is especially suitable in IPV cases as this kind of violence is characterised by repetitive patterns. In the landmark case of Kurt, the European Court of Human Rights (ECtHR) thus stated that “consecutive cycles of domestic violence, often with an increase in frequency, intensity and danger over time, are frequently observed patterns in that context” (§ 175).

Thus, at present, from a legal point of view, it suffices to note that Parties to the Istanbul Convention indeed have a positive obligation to perform risk assessments in IPV cases. The interesting questions rather revolve around predictive accuracy of the respective tools and – with special relevance to robustness – the tools’ feasibility of use.

GREVIO emphasises that the purpose of the risk assessment is

to ensure that all relevant authorities, not just the law enforcement authorities, as of receipt of the complaint, effectively assess and devise a plan to manage the safety risks a victim faces, on a case-by-case basis, according to standardised procedures and in co-operation with each other. (GREVIO, 2024b point 4; see also point 261 ER).

Following the intervention of GREVIO in Kurt, the ECtHR agreed to this interpretation of the risk assessment provision (Kurt §§ 167–168 and 174).

The Convention requires the risk assessment to be performed as of the receipt of the IPV complaint by the police, and renewed risk assessments to be made continuously thereafter as the risk could change and new information might need to be considered (Kurt, GREVIO’s intervention § 141).

Due diligence therefore imposes obligations concerning who should do something (“all relevant authorities, not only law enforcement authorities”); what to be done (“assess and devise a plan to manage the safety risks a victim faces”); and how to do it (the assessment and devising the plan must be done “effectively”, concretely in light of individual circumstances (“on a case-by-case basis”), and “according to standardised procedures and in co-operation with each other”).

2.2 Robustness is a dimension of effectiveness

The wording of Article 51 IC does not mention an obligation to make use of “tools” or “instruments” to perform the risk assessment, only providing that “an assessment” be performed of “the lethality risk, the seriousness of the situation and the risk of repeated violence.” GREVIO is clearly aware that different risk assessment tools are available and in use by Parties to the Convention (GREVIO, 2024b point 7 et seq.), and that different approaches may underlie the respective instruments. Yet, GREVIO has not come out with preferences in support of any specific tool. The silence on the matter may still not lead to the conclusion that any risk assessment may be acceptable under the positive obligation in Article 51. In Kurt the ECtHR thus noted that “the assessment of the nature and level of risk constitutes an integral part of the duty to take preventive operational measures” and that the “adequacy” of the risk assessment performed by the police was relevant when determining whether the positive obligation was fulfilled (Kurt § 159).

On closer inspection, several conditions may be inferred from Article 51 IC. Firstly, it establishes conditions regarding quality, as the risk assessment must be made “effectively” (Kurt §§ 167–168). Hence, it must be sufficiently accurate to be reliable and actionable.

Secondly, it must be performed in time to be relevant to the victim’s protection needs. An accurate assessment is worthless if produced only after the victim has suffered a repeat incident, perhaps is even dead. Thirdly, the assessment, the making of a protection plan and the protective measures must be provided according to standardised procedures. Victims should be provided equal treatment irrespective of the police district or the police officer that happens to handle their case. Due diligence thus presupposes a standardised system across the State, ensuring effective assessment and protection according to the level of risk in the individual case. This rules out the possibility of applying pure clinical assessment – that is, unaided personal assessment.

To fully understand the implications of the above, it should be noted that several public services and organisations are usually involved in the efforts to protect and support an IPV victim. Police must typically cooperate with local community services providing medical aid, family counselling services, local schools if children are exposed, women’s shelters, and so on. Measures may also involve the services of public prosecutors and judges when there is need for arrest and detention, restraining orders and the use of electronic control. Clearly, for such collaboration to function effectively, a common understanding of the risk in the specific case is needed. This further implies that the risk assessment of the police must be effectively communicated to the involved actors in a manner that does not leave any possibility for misunderstanding.

Finally, although the positive obligation is an obligation of means and not of result, the obligation does have a bearing on the handling of the individual IPV case, as it requires the system to provide adequate risk assessment in each and every IPV case (adequacy understood in terms of quality, timeliness and equal treatment). In order to fulfil the positive obligation, the system must function consistently over time, which logically means that it must function consistently for each individual IPV case as they materialise over time. It follows that any system claiming to “effectively” prevent repeat IPV and protect the victim in accordance with the assessed level of risk must also be able to show that it is sufficiently robust to do this over time.

Robustness could mean that one should not aim for a “perfect” system if in the long run it cannot be sustained because it is too demanding in terms of resources. This would inevitably lead to bottlenecks and system collapse and have detrimental consequences to all ensuing IPV cases that are left without adequate attention from the police. The aim, rather, is to provide a system that works reliably over time though with lesser ambition for perfection. This would be sufficient to fulfil the positive obligation, which as noted does not demand efforts that are “impossible” or a “disproportionate burden” on the police. The long-term perspective of the positive obligation thus carries with it an obligation to provide for robustness in the police system for handling IPV cases.

With respect to the choice of risk assessment tool, it is crucial that it must be able to single out high-risk cases, as these must be prioritised. However, the tool should not score more cases as high risk than is really the case (false positives), as this would put an unsustainable burden on the system. Yet, for the assessor wanting to be on “the safe side” in any given case, it could be tempting to raise the risk level, thus providing a solution that is “perfect” for the individual case yet unsustainable for the system. From a legal point of view the functioning of the risk assessment tool used in the IPV system is therefore highly relevant to the dimension of robustness enshrined in the positive obligation under the Istanbul Convention.

3.1 Norway: Structured professional judgement and the central role of the preventive risk analyst

SARA:SV, a shortened version of the risk assessment tool SARA (Kropp & Hart, 2004), has been used by Norwegian police in IPV cases since 2015. The tool is a form containing 15 risk indicators, ten items about the aggressor and five about the victim. The aggressor risk factors are split into two classes of five items each, one concerning the aggressor’s history related to IPV and the other about the person’s current psychosocial situation. The remaining five risk factors aim to shed light on the victim’s vulnerability to being exposed to renewed IPV incidents by the same aggressor. In addition, the form contains a field where the assessor – i.e., the PRA – may add any information s/he deems to be relevant. Moreover, a list of the various registries from which the PRA may retrieve relevant information is provided (e.g., the firearms registry, the criminal records registry, the investigation case file if a criminal investigation against the aggressor is conducted, etc.).

SARA:SV is a guideline for the assessment. Originally, it was a “dumb” sheet of paper without any digital functionalities. At the beginning of 2025 the form was digitalised; however, this did not substantially alter the situation as the form still is not integrated with any of the available registries, nor is the calculation of the risk assessment in any way assisted by technology. What the digitalisation mainly did was provide easier access to the form as an application on police officers’ iPhones. In addition, it generates police IPV data more consistently than was the case before. As noted in the introduction, the lack of such data was criticised by GREVIO.

The risk factors are coded by the PRA as 0 (= absent), 1 (= possible or partial), or 2 (= present). Once the form is completed the PRA shall weigh the scores and come to decision about the specific level of risk. The level may be set to low, medium, or high.

Pursuant to the National Instruction (NI) from the Police Directorate (Politidirektoratet, 2025), the purpose of the assessment is “to contribute to identification, prioritisation and management of risk in relations with risk of future violence” (point 1, second paragraph). The 2022 instruction also included the wording “[to] facilitate internal and external cooperation concerning prevention” (Politidirektoratet, 2022, point 1.1, second paragraph). However, it is clear that structured risk assessment still shall be the basis for cooperation and shared priorities internally in the police and with external partners (point 4.3 NI).

Pursuant to the National Instruction (Politidirektoratet, 2025), the PRA plays a central role in the handling of IPV cases, working in parallel with criminal investigators and prosecutors when criminal investigation is opened against the aggressor. However, as the aims of the preventive and the investigative tracks differ, information management and concrete activities carried out in the respective tracks are separated from each other; see also point 4.2 NI, pursuant to which the risk assessments shall be performed separately from the investigation.

Specifically regarding the role of the PRA, the instruction provides that the PRA shall perform a structured risk assessment in “all criminal cases” concerning IPV and honour-related violence (point 1, last paragraph). The assessment shall be initiated “as soon as possible” and be finalised “as soon as information sufficient to determine the level of risk is provided” (point 4.2, second and third paragraph). In cases that are followed up by the PRA renewed risk assessment shall be performed “minimum every third month” (point 4.5).

However, the tasks and responsibilities of the PRA extend beyond performing risk assessments. He or she is also responsible for identifying if there is a need for measures to be provided by external partners (such as local community services) and for sharing the information necessary to that end (point 5.5 NI). In high-risk cases the PRA shall ensure that a meeting takes place with the public prosecutor, the chief investigator, and others as necessary “to secure a common understanding of the risk, and identify and carry out measures” (point 4.4 NI). Where relevant the PRA shall also alert public services responsible for passport, firearms licensing, driver’s licence, residence permit, etc. (point 5.6 NI), and naturally, update the information on the preventive case as registered in the police system (point 6.1 NI).

As regards the competence to perform the structured risk assessment, the PRA need not be formally certified for use of SARA:SV, but must have completed a mandatory course as approved by the Police Directorate. Furthermore, the PRA “should have” experience or formal competence in dealing with IPV cases and “ought to” complete the five-credit study “Introduction to Police Intelligence” (point 7.2 NI). The PRA is thus a person in whom the IPV system invests competence and skills so as to enable him or her to fulfil a crucial and specialised role in the preventive track of the police system for IPV cases.

3.2 Canada and Spain: Actuarial risk assessment by frontline police officers

Where Norway has opted for a tool that requires use of specialised competence, the police in the Canadian province of Ontario and police organisations across all of Spain have opted for actuarial risk assessment tools that may be applied by frontline police officers with just some basic training in the use of the tools (Hilton, 2021; VioGén is further explained in Section 3.3 below). The risk assessments are therefore not dependent on a PRA being available.

Similarly to tools based on the SPJ approach, actuarial risk assessment tools apply predefined risk factors. However, where SARA:SV applies 15 risk factors, ODARA only includes 13 items (omitting factors related to victim vulnerability) (Hilton, 2021, p. 80), whereas VioGén uses 39 (!) risk factors for the initial risk assessment and 43 (!) for the renewed assessment (González et al., 2018a, pp. 102–107).¹¹ In contrast to SARA:SV, both ODARA and VioGén are scored dichotomously, meaning that the risk factor is scored as being present or non-present in the individual case. VioGén also includes the option “don’t know” when there is a lack of sufficient information sufficient to score.

The algorithm that calculates the level of risk may be simple or complex, and again ODARA and VioGén seem to be at opposite ends of the scale. ODARA simply requires the user to add the present risk factors up to a maximum of 13 (Hilton, 2021, pp. 80 and 89). The calculation may thus be performed “automatically” by the police officer, who just counts the present risk factors. The numerical value (output) is preassigned to a specific level of risk. With respect to VioGén, the risk level is calculated by a computer coded with an algorithm counting and weighing the risk factors present and generating an output, which – similarly to ODARA – is preassigned to a specific risk level (López-Ossorio, 2016). The system makes use of two algorithms (“protocols”), one for the initial risk assessment (the “VPR”)¹² and one for the renewed assessment (the “VPER”).¹³

Common to both ODARA and VioGén is that the numerically expressed risk is preassigned to specific risk levels. This excludes the possibility of uncertainty or misunderstandings about the risk level in concrete cases that is sometimes is observed for tools that describe outcomes in terms of categories such as low, medium, and high (Jung et al., 2013). SARA:SV is such a categorical risk assessment tool, and as different persons may have different understandings of where each risk category begins and ends, similar cases may be assigned to different categories despite only minor differences in their risk (Hilton, 2021). When the risk instead is expressed in numbers and the risk level is numerically defined, the risk level is clear to everybody involved in the follow-up of the case.

In the following, the focus is on the VioGén system, as Spain – like Norway – is Party to the Istanbul Convention, while Canada is not.¹⁴ GREVIO has thus had a chance to provide feedback on the system. VioGén is an example of how police may tackle the IPV problem in an effective and systematic manner nationwide, and demonstrates a genuine effort to comply with the positive obligation set out in the Convention. It is worth noting that a decision was taken from the beginning that the risk assessment tool had to be usable by frontline police officers, and that it should be backed by technology (Garrido, 2012, Ch. 4.3).

3.3 More on the VioGén system

In 2004, realising they had a serious IPV problem, Spain adopted the Ley Orgánica 1/2004 (LO) (Garrido, 2012; González et al., 2018a, ch. 2.1.1; López-Ossorio, 2016). Its objective is to “act against gender-based violence” (Article 1(1)) and “establish integrated measures to prevent, sanction and eradicate this kind of violence, and provide assistance to the victim […]”¹⁵ (Article 1(2) LO). Article 31 LO specifically addresses obligations of the police in this respect, while Article 32 sets out an obligation to provide plans for systematic collaboration between the police and other professional actors in the field of IPV. The VioGén system was established as a tool to help fulfil the legal obligations. It is a web-based ICT solution used by all professional actors involved in IPV cases (González Álvarez et al., 2018a, ch. 2.2.2, 2018b, p. 3). It also provides the risk assessment module applied in each case. The specific legal foundation for the risk assessment protocols VPR/VPER was laid down in Instrucción no. 10/2007 of the Secretary of State for Security of the Ministry of Interior, replaced by Instrucción no. 4/2019.

Spain has a population of approximately 50 million, and is constitutionally organised into a federal level, plus 17 autonomous “comunidades”, each with its own legislature, police organisation, prosecutorial system and judiciary, in addition to the corresponding institutions that exist on the federal level. The Ley Orgánica had powers only to become effective on the federal level, which for police organisations meant La Policía Nacional (“urban” police) and La Guardia Civil (“rural” police). However, over the years the police forces of the 17 autonomous communities have hooked up to the system. In addition, the system is used by other actors tasked with IPV cases, and as of 2018 has approximately 30,000 users across 300 organisations (González Álvarez et al., 2018a, Ch. 2.2.2, 2018b, pp. 4 and 7). Apart from police officers, the users include members of the judiciary and the public prosecutor’s office; specialists on gender violence in the police; penitentiary administrations; forensic experts; public welfare services; social services of local entities; and members of coordination units with an official mandate concerning violence against women (González Álvarez et al., 2018b, p. 4).

At the time when the Ley Orgánica was adopted, the aim was rapidly to improve the situation of victims, irrespective of where they were living, by building capability in the police to deal with IPV effectively and uniformly across the country. To achieve this, it was deemed necessary to implement clear procedures underpinned by a comprehensive electronic information system (Garrido, 2012, Ch. 4.3). The protocols for the risk assessment were regarded as central to the system, and on the initiative of the government, the algorithm for the risk assessment and the risk indicators were developed over some years in a collaborative effort between academia and the police (Garrido, 2012; López-Ossorio, 2016). The VPR and VPER have been revised and modified several times, with a major revision in 2016 (López-Ossorio et al., 2019). As of 2019, version 5.0 is in use (Instrucción no. 4/2019).

The VioGén system thus enables police forces at different levels to deal with IPV cases in a uniform manner across the country, and functions as a means for coordination and communication with other actors assigned to tasks in the handling of each case.

Like Norway, Spain has been subject to review by GREVIO, which praised the standardised procedures provided for by the VioGén system and its professional use. Still, a point of criticism was that VioGén was deficient with respect to detecting IPV cases associated with lethal risk (deadly outcome) (GREVIO, 2024a). Since the weakness was detected, Spain has taken measures to yet again revise the risk assessment protocols (González-Álvarez et al., 2023).

An important question is, of course, whether VioGén has proved to be effective. However, measuring effects in this field is notoriously difficult, and an analysis of VioGén’s effect on the IPV rate in Spain is beyond the scope of this article. Data available from the Spanish State Observatory on Violence against Women (SSOVM) for the period 2003–2022 show a reduction of on average 20 IPV fatalities per year (down from 70+ per year in 20033 to 50- per year in 2022). With respect to IPV cases with a police response, the number of cases decreased every year from 2010,0, while the trend has been the opposite since 2016, meaning that the numbers have increased. There is a major difference in the evolution of cases with no perceived risk and those requiring police protection: while the former decreased from 20111 to 2018, the latter increased steadily from 20133 to 2018. In 2022, for the first time the number of cases requiring police protection was higher than the number of cases with no perceived risk. From 2011–2022 the number of cases where restraining orders and protective measures were implemented remained around 30,000 per year (SSOVM, 2023). In brief, the IPH rate has decreased while the rate of serious IPV cases seems to be on an increase.

The data do not demonstrate a causal relationship with VioGén. The increase in the IPV rate could, for instance, be caused by a general increase in the level of violence, but this is also difficult to assess. Another possibility is that the high visibility of IPV cases in Spanish media in recent years has altered victims’ motivation for reporting such cases. Where before domestic violence and abuse were private matters involving feelings of shame and hopelessness, nowadays victims might take a different view and be more inclined to report to the police (SSOVM, 2023).

While these possible causes do not have any direct relation to VioGén, it should be considered important that, through VioGén, a system for equal and effective treatment of IPV cases across the whole of Spain has been implemented. Putting into practice a standardised and robust system that largely neutralises police officers’ personal perceptions of IPV may have had the effect that women’s trust in police attitudes and handling of IPV cases has increased. This in itself could lead IPV cases to be reported that would earlier not have been reported. If this is the case, VioGén has signalled to victims that their cases are diligently and effectively handled, an effect that must be regarded as positive.