Algorithms are not the only process to assess vulnerability.
Organizations, including the American Hospital Association, suggest questions to measure vulnerability.
Following are some questions that could be asked:
What could go wrong that is under the domain of your department?