4. The Risk Assessment Process
4.1 Flowchart of Risk Assessment Process
<![if !vml]>
<![endif]>
4.2 Requirements
To perform a successful exercise in risk assessment the following requirements should be fulfilled.
LOCAL - NATIONAL - INTERNATIONAL
RISK ASSESSMENTS, HAZOP - FMEA- ETA- HRA STUDIES, 5s, HEALTH SAFETY ENVIRONMENTAL MANAGEMENT SYSTEM- FORMULATION- INTEGRATION- DOCUMENTATION- SUPPORT, AUDITS, EDUCATION AND TRAINING, OCCUPATIONAL EXPOSURE MEASUREMENT, CONTROL FORMULATION, LOCAL EXHAUST VENTILATION TESTING AND EXAMINATION.
Risk Assessment
This note explains the principles and procedures for performing a suitable and sufficient assessment of risks to the health and safety of employees and other persons arising out of any work activities and to the environment in general.
The emphasis must be to manage the risks.
Therefore risk assessment is only one part (albeit a fundamental part) of a planned risk control process or effective health, safety & environment management system.
2. Definitions
| Hazard | any source of (or situation with) potential to cause harm or damage to people, equipment, environment or reputation. |
| Risk | the likelihood and consequences (in terms of severity) of a hazardous event ( incident). |
| Competent person | is someone who has:
|
| Suitable and sufficient | an assessment which:
|
| Tolerable | a risk reduced to the lowest level that is reasonably practicable. A.L.A.R.P. |
| Trivial | a risk which is of such a low level as to present no need for controlling action. |
| Undertaking | an act, or decision, taken by, or on behalf of, the company. |
3. Context
It has long been recognised that risk assessment is a large part of health, safety and environmental management, and that this is an inseparable function of managing and organisation.
A well-planned risk assessment process should provide an INVENTORY FOR ACTION and form the basis for planning the implementation of control measures.
To prevent complacency and familiarisation those persons tasked with performing assessments should do so with a fresh pair of eyes and a questioning approach.
3.1 The 'What and Why' of Risk Assessment
Risk Assessment is a systematic analysis of all the organisations activities to determine:
Hence the basic process is:
4. The Risk Assessment Process
4.1 Flowchart of Risk Assessment Process
<![if !vml]>
<![endif]>
4.2 Requirements
To perform a successful exercise in risk assessment the following requirements should be fulfilled.
Note: Risk assessment does not have to be bureaucratic or complex. It can be a simple recognition exercise which guides future actions. Any process which becomes a burden will be disliked and abused.
4.3 The Risk Assessment Process in Practice
4.3.1 Planning
Before starting, think about the:
4.3.2 Defining Activities
This is possibly the most crucial and difficult part of the process. The usefulness of risk assessment findings can be severely limited if the information is not able to be crossed referenced or linked to people and their activities.
Activities can be defined in terms of location; premises; work tasks; plant/equipment/machinery; or individuals.
It is important that a consistent approach is used. Ideally, at the end of the process for example an individual should be able to find out what significant risks he/she is exposed to whilst at work; what measures the company has implemented to control these risks and why; make a judgement as to the suitability of those control measures.
Generic assessments covering an activity performed by a number of people or in a number of locations can be used, and in combination with some form of cross-referencing system, may provide the best way forward.
4.3.3 Identifying and Categorising Hazards
When observing a defined activity an assessor needs to consider three things to enable hazards to be identified:
Note: If, during the consideration it becomes apparent that there is only a negligible source or potential for harm, then the process needs to go no further for this activity.
Once identified, then those significant hazards remaining need to be categorised. These can be broad categories, there is even potential for the use of 'checklists' or 'prompts' for this part of the process.
To help with the process of identifying hazards it is useful to categorize hazards in different ways, for example by topic eg:
1. mechanical;
2. electrical;
3. radiation;
4. substances;
5. fire and explosion
6. product quality
7. environmental damage
8. reputation;
Hazards prompt-list
A complementary approach is to develop a prompt-list of questions such as:
During work activities could the following hazards exist?
4.3.4 Estimating Risk
Risk, by its definition, can be estimated by considering two things:
It must be emphasised that when estimating risk, all people who may be potentially exposed to harm must be taken into account.
HENCE a hazard (of whatever potential) is more serious if it affects a greater number of people.
4.3.5 Deciding if the Estimated Risk is Tolerable
When the level of severity and likelihood have been determined this can be used to decide if the risk is tolerable.
During this the manager needs to think about:
Risk Level Estimation Matrix
(With definitions and advice on setting likelihood and severity criteria)
Introduction
When setting the level of risk, as stated earlier in this note, the determination is based on estimating the potential severity of the harm and the likelihood that the harm will occur.
Estimating the potential Severity of Harm
When attempting to establish the potential severity of the harm presented by the hazard two main issues need to be considered.
Likelihood is combination of many factors and these include:
When estimating risk one must consider all the people who can be exposed to the harm created by the hazard. Therefore any hazard is more serious if affects a greater number of people.
Deciding Tolerance to the Risk
Once the potential severity and likelihood have been considered it is necessary to decide on tolerance to the risk.
Tolerance is concerned with setting priorities and resource commitment.
Tolerable means either the risk is estimated to be at a level which can be accepted for the time being and is not greatly over that which would be expected in normal daily life in general, or that it has already been reduced to the lowest level that is reasonably practicable.
The task below uses a grading regime of 1 - 4 for both severity and likelihood.
1 = Unlikely/Slightly Harmful
4 = Very Likely/Extremely Harmful
Table 1: Risk Level Decision
| Severity Scale | ||||
| 1 Slightly Harmful |
2 Harmful |
3 Very Harmful |
4 Extremely Harmful | |
| 1 Highly Unlikely |
Trivial Risk | Trivial Risk | Tolerable Risk | Moderate Risk |
| 2 Unlikely |
Trivial Risk | Tolerable Risk | Substantial Risk | Substantial Risk |
| 3 Likely |
Tolerable Risk | Moderate Risk | Substantial Risk | Intolerable Risk |
| 4 Very Likely |
Moderate Risk | Moderate Risk | Intolerable Risk | Intolerable Risk |
4.3.6 Planning for the Control of Estimated Risks
Those residual risks (remaining after considering current control measures) classified as moderate, substantial or intolerable usually require action to be taken to reduce them to as low as is reasonably practicable.
When deciding appropriate control measures the manager, in consultation with the assessor and persons exposed to the risk, should start at the top of their hierarchy of control and agree which measures are most effective.
Hierarchy of Controls
Introduction
When planning for the control of risks then the decision process for allocating the most appropriate control should be fairly formal. The list below provides the generally accepted hierarchy of control for protecting health and safety. Starting at number one, those persons responsible for deciding the resources of control measure implementation should only dismiss a higher level control if it is unacceptable or unreasonable in terms of cost; time; effort; impracticability; prevention of necessary activity.
Hierarchy
Any controls implemented need to be monitored for:
The usual result is a combination of engineering, technical, procedural and behavioural controls.
Other decisions which should be linked with risk assessment include;
Note: If the findings of risk assessments are included in other planning processes then H.S.E.M. becomes incorporated with normal working practices and less bureaucratic.
Risk Control Decision Table
Introduction
When considering the appropriate response to control the risk, once the risk level has been estimated, and the relevant level of tolerance calculated, the table below can be used to provide guidance on the amount of time, effort, money and other resources which need to be allocated in providing or developing effective controls.
Risk Control Decision Table
Risk Control Decision Table
| Risk Level | Action and Timescale |
| Trivial | No action is required - simple documentary records need to be kept to show item has been considered. |
| Tolerable | No additional controls are required. Consideration may be given to a more cost-effective solution or improvement that imposes no additional cost burden. Monitoring is required to ensure that the controls are maintained. |
| Moderate | Efforts should be made to reduce the risk, but the cost of prevention should be carefully measured and limited. Risk reduction measures should be implemented within a defined time period. Where the moderate risk is associated with extremely harmful consequences, further assessment may be necessary to establish more precisely the likelihood of harm as a basis for determining the need for improved control measures. |
| Substantial | Work should not be started until the risk has been reduced. Considerable resources may have to be allocated to reduce the risk. Where the risk involves work in progress, urgent action should be taken. |
| Intolerable | Work should not be started or continued until the risk has been reduced. If it is not possible to reduce risk with unlimited resources, work has to remain prohibited. |
4.3.7 Cross-Referencing
To ensure that the risk assessment process does not become a paperwork exercise with little realised benefit it is necessary to plan for the cross referencing of assessments.
This cross-referencing is unnecessary if individual risk assessments have been performed. However if task, geographical or generic risk assessments have been carried out, then it will be necessary to have an effective cross-referencing system in place.
The aim of this cross-referencing is to enable an individual/ location/ process area to be provided with the relevant information on the overall risks associated with all their work activities. It has been stated earlier that this is the main aim of the process - to be able to show that the risks have been assessed AND that, so far as is reasonably practicable, those risks have been reduced (by elimination or control).
The procedure for cross-referencing needs to have been planned at the beginning of the risk assessment process. It can be done on a job title basis, location/ process/ individual or subject groupings.
5. Follow up Actions
Once an initial risk assessment process has been undertaken, there are a number of follow-up actions which are required:
5.1 Recording of significant risks
Significant findings include:
5.2 Monitoring of implementation of required controls
This can be done through setting performance standards for individuals and objectives for the location/ process. Performance standards could be part of an appraisal process.
5.3 Provide information to all employees
Where significant findings have been identified.
This is where cross-referencing and incorporation of risk assessment into standard decision making processes are vital.
5.4 Undertake detailed risk assessments
When more detailed analysis is required to provide specific information
5.5 Organise health surveillance /other monitoring
If found to be required.
6. Reviewing the Process
Risk assessment is a dynamic process and therefore needs to be regularly or continually reviewed.
Sample questions that need to be asked are:
The review findings will indicate if new assessments and actions are required and should improve health and safety management generally.
Definition of Acceptable Risk
A definition of "acceptable risk" is "The residual risk remaining after controls have been applied to associated hazards that have been identified, quantified to the maximum practicable, analyzed, communicated to the proper level of management and accepted after proper evaluation".
"Risk" can be broadly defined as the probability of occurrence and potential severity of some adverse event or outcome. Risk can be assessed in a number of ways, from highly quantitative measures using relatively refined data to calculate "absolute risk", to qualitative means using the assessor's knowledge and experience to render a judgment regarding risk.
"Acceptable risk" must be defined by the organization responsible and accountable for managing the risk (or controlling the hazard). The determination that the risk of some adverse event or outcome is at an acceptable level should be made in light of an adequate assessment of the probability of occurrence and an understanding of the severity or "cost" of the outcome (in terms of injuries, illnesses, fatalities, property loss, or lost productivity). In addition, government expectations and the public's perception typically should serve to reduce the tolerance for risk.
Occupational safety and health standards (regulatory, and consensus) in essence establish minimum acceptable risk for the subject activity or exposure as defined by the standard setting organization. If a hazard is controlled in accordance with the appropriate standard, then the risk of the adverse event or outcome should be held to the level deemed acceptable by the standard setting organization. Regulatory standards establish minimum levels of performance, often leaving some level of risk remaining. If this residual risk is high (relative to the affected organization's risk tolerance) after applying controls established by standards, the affected organization may implement controls beyond the requirements of the standard to further decrease the probability and/or resulting severity of an adverse occurrence.
