Risk Management - Management and Productivity

RISK MANAGEMENT 

MANAGEMENT AND PRODUCTIVITY

Bayu Nurwinanto

General terms, “risk management” refers to the architecture (principles, framework and process) for managing risks effectively, while “managing risk” refers to applying that architecture to particular risks.

Relationships between the risk management principles, framework and process

Clause 3 (Principles)

For risk management to be effective, an organization should at all levels comply with the principles below.

a) Risk management creates and protects value.

Risk management contributes to the demonstrable achievement of objectives and improvement of performance in, for example, human health and safety, security, legal and regulatory compliance, public acceptance, environmental protection, product quality, project management, efficiency in operations, governance and reputation.

b) Risk management is an integral part of all organizational processes

Risk management is not a stand-alone activity that is separate from the main activities and processes of the organization. Risk management is part of the responsibilities of management and an integral part of all organizational processes, including strategic planning and all project and change management processes.

c) Risk management is part of decision making

Risk management helps decision makers make informed choices, prioritize actions and distinguish among alternative courses of action.

d) Risk management explicity addresses uncertainty

Risk management explicitly takes account of uncertainty, the nature of that uncertainty, and how it can be addressed.

e) Risk management is systematic, structured and timely

A systematic, timely and structured approach to risk management contributes to efficiency and to consistent, comparable and reliable results.

f) Risk Management is based on the best available information

The inputs to the process of managing risk are based on information sources such as historical data, experience, stakeholder feedback, observation, forecasts and expert judgement. However, decision makers should inform themselves of, and should take into account, any limitations of the data or modelling used or the possibility of divergence among experts.

g) Risk management is tailored

Risk management is aligned with the organization's external and internal context and risk profile.

h) Risk management takes human and cultural factors into account

Risk management recognizes the capabilities, perceptions and intentions of external and internal people that can facilitate or hinder achievement of the organization's objectives.

i) Risk management is transparent and inclusive

Appropriate and timely involvement of stakeholders and, in particular, decision makers at all levels of the organization, ensures that risk management remains relevant and up-to-date. Involvement also allows stakeholders to be properly represented and to have their views taken into account in determining risk criteria.

j) Risk management is dynamic, iterative and responsive to change

Risk management continually senses and responds to change. As external and internal events occur, context and knowledge change, monitoring and review of risks take place, new risks emerge, some change, and others disappear.

k) Risk management facilitates continual improvement of the organization

Organizations should develop and implement strategies to improve their risk management maturity alongside all other aspects of their organization.

Clause 4 (Framework)

The success of risk management will depend on the effectiveness of the management framework providing the foundations and arrangements that will embed it throughout the organization at all levels. The framework assists in managing risks effectively through the application of the risk management process (see Clause 5) at varying levels and within specific contexts of the organization. The framework ensures that information about risk derived from the risk management process is adequately reported and used as a basis for decision making and accountability at all relevant organizational levels.

This framework is not intended to prescribe a management system, but rather to assist the organization to integrate risk management into its overall management system. Therefore, organizations should adapt the components of the framework to their specific needs.

If an organization's existing management practices and processes include components of risk management or if the organization has already adopted a formal risk management process for particular types of risk or situations, then these should be critically reviewed and assessed against International Standard, in order to determine their adequacy and effectiveness.

1) Mandate and commitment

The introduction of risk management and ensuring its ongoing effectiveness require strong and sustained commitment by management of the organization, as well as strategic and rigorous planning to achieve commitment at all levels.

2) Design of framework for managing risk

• Understanding of the organization and its context.
• Establishing risk management policy.
• Accountability.
• Integration into organizational processes.
• Resources.
• Establishing internal communication and reporting mechanisms.

3) Implementing risk management

• Implementing the framework for managing risk.
• Implementing the risk management process.

4) Monitoring and review of the framework

In order to ensure that risk management is effective and continues to support organizational performance.

5) Continual improvement of the framework.

Clause 5 (Process)

The risk management process should be :

• An integral part of management.
• Embedded in the culture and practices, and
• Tailored to the business processes of the organization.

1) Communication and Consultation

Communication and consultation with external and internal stakeholders should take place during all stages of the risk management process. Therefore, plans for communication and consultation should be developed at an early stage. These should address issues relating to the risk itself, its causes, its consequences (if known), and the measures being taken to treat it. Effective external and internal communication and consultation should take place to ensure that those accountable for implementing the risk management process and stakeholders understand the basis on which decisions are made, and the reasons why particular actions are required.

2) Establishing the context

By establishing the context, the organization articulates its objectives, defines the external and internal parameters to be taken into account when managing risk, and sets the scope and risk criteria for the remaining process. While many of these parameters are similar to those considered in the design of the risk management framework, when establishing the context for the risk management process, they need to be considered in greater detail and particularly how they relate to the scope of the particular risk management process.

• Establishing the external context.
• Establishing the internal context.
• Establishing the context of the risk management process.
• Defining risk criteria.

3) Risk assessment

Risk assessment is the overall process of risk identification, risk analysis and risk evaluation.

Risk identification

The organization should identify sources of risk, areas of impacts, events (including changes in circumstances) and their causes and their potential consequences. The aim of this step is to generate a comprehensive list of risks based on those events that might create, enhance, prevent, degrade, accelerate or delay the achievement of objectives. It is important to identify the risks associated with not pursuing an opportunity. Comprehensive identification is critical, because a risk that is not identified at this stage will not be included in further analysis.

Risk analysis

Risk analysis involves developing an understanding of the risk. Risk analysis provides an input to risk evaluation and to decisions on whether risks need to be treated, and on the most appropriate risk treatment strategies and methods. Risk analysis can also provide an input into making decisions where choices must be made and the options involve different types and levels of risk.

Risk Evaluation

The purpose of risk evaluation is to assist in making decisions, based on the outcomes of risk analysis, about which risks need treatment and the priority for treatment implementation. Risk evaluation involves comparing the level of risk found during the analysis process with risk criteria established when the context was considered. Based on this comparison, the need for treatment can be considered. Decisions should take account of the wider context of the risk and include consideration of the tolerance of the risks borne by parties other than the organization that benefits from the risk. Decisions should be made in accordance with legal, regulatory and other requirements. In some circumstances, the risk evaluation can lead to a decision to undertake further analysis. The risk evaluation can also lead to a decision not to treat the risk in any way other than maintaining existing controls. This decision will be influenced by the organization's risk attitude and the risk criteria that have been established.

Risk treatment

Risk treatment involves selecting one or more options for modifying risks, and implementing those options. Once implemented, treatments provide or modify the controls.

Risk treatment involves a cyclical process of :

• Assessing a risk treatment.
• Deciding whether residual risk levels are tolerable.
• If not tolerable, generating a new risk treatment.
• Assessing the effectiveness of that treatment.

a) Selection of risk treatment options

Selecting the most appropriate risk treatment option involves balancing the costs and efforts of implementation against the benefits derived, with regard to legal, regulatory, and other requirements such as social responsibility and the protection of the natural environment. Decisions should also take into account risks which can warrant risk treatment that is not justifiable on economic grounds, e.g. severe (high negative consequence) but rare (low likelihood) risks.

b) Preparing and implementing risk treatment plans

The purpose of risk treatment plant is to document how the chosen  treatment options will be implemented the information provided in treatment plans should include :

• The reasons for selection of treatment options, including expected benefits to be gained.
• Those who are accountable for approving the plan and those responsible for implementing the plan.
• Proposed actions.
• Resource requirements including contingencies.
• Performance measures and constraints.
• Reporting and monitoring requirements; and
• Timing and schedule.

Treatment plans should be integrated with the management processes of the organization and discussed with appropriate stakeholders. Decision makers and other stakeholders should be aware of the nature and extent of the residual risk after risk treatment. The residual risk should be documented and subjected to monitoring, review and, where appropriate, further treatment.

c) Monitoring and Review

Both monitoring and review should be a planned part of the risk management process and involve regular checking or surveillance. It can be periodic or ad hoc.

d) Recording the risk management process

Risk management activities should be traceable. In the risk management process, records provide the foundation for improvement in methods and tools, as well as in the overall process.

Risk Assessment and Risk Control

RISK ASSESSMENT AND RISK CONTROL

Bayu Nurwinanto

Basic Concepts

What is Risk ?

Risk is something that we as individuals live with on a day to day basis. People are constantly making decisions based on risk. Simple decision in daily life such as driving, crossing the  road and money investment all imply an acceptance risk. Risk is the combination of the  likelihood and severity of a specified hazardous event occurring. In mathematical term, risk can be calculated by the equation.

Risk=Likelihood X Serverity

Where,

Likelihood is an event likely to occur within the specific period or in specified circumustances.

Severity is outcome from an event such as severity of injury or health of people, or damage to property, or insult to environment, or any combination of those caused by the event.

Planning and Conducting Risk Assessment

The purpose of risk assessment

The purpose of risk assessment are as follows :

• To identify all the factors that may cause harm to employees and others (the hazards). 
• To consider what the chances are of that harm actually be falling anyone in the circumstances of a particular case and the possible severity that could come from it (the risks).
• To enable employers to plan, introduce and monitor preventive measures to ensure that the risks are adequately controlled at all times.

Planning of Risk Assessment Activities

Risk activities shall be plan and conducted.

a) For situation

• where hazard appear to pose significant threat.
• uncertain whether existing controls are adequate; or/and
• before implementing corrective or preventive measures.

b) By organization intending to continuously improve OSH Management System.

It should be the duty of the employer to assign a trained personnel to lead a team of employees associated with one particular process or activity to conduct risk assessment.

Process of risk Assessment

Process of risk Assessment requires 4 simple steps :

1. Classify work activities.
2. Identify hazard.
3. Conduct risk assessment (analyze and estimate risk from each hazards), by calculating or estimating (1. Likelihood of occurrence 2. Severity of hazard)
4. Decide if risk is tolerable and apply control measures (if necessary).

FLOWCHART OF RISK ASSESSMENT PROCESS

Classify work activities

Classify work activities

Classify work activities in accordance with their similarity, such as :

• geographical or physical areas within/outside premises.
• stages in production/service process.
• not too big e.g. building a car.
• not too small e.g. fixing a nut; or.
• defined task  e.g. loading, packing, mixing, fixing the door.

Safety Hazards

A safety hazard is any force strong enough to cause injury, or damage to property.  An injury caused by a safety hazard is usually obvious.  For example, a worker may be badly cut.  Safety hazards cause harm when workplace controls are not adequate.

Some examples of safety hazards include, but are not limited to :

• slipping/tripping hazards (such as wires run across floors).
• fire hazards (from flammable materials).
• moving parts of machinery, tools and equipment (such as pinch and nip points).
• work at height (such as work done on scaffolds).
• ejection of material (such as from molding).
• pressure systems.
• vehicles (such as forklifts and trucks).
• lifting and other manual handling operations.
• working alone.

Health hazards

An occupational health hazard is any agent that can cause illness to an individual.  A health hazard may produce serious and immediate (acute) affects, or may cause long-term (chronic) problems.  All or part of the body may be affected.  Someone with an occupational illness may not recognize the symptoms immediately.  For example, noise-induced hearing loss is often difficult for the affected individual to detect until it is well advanced.  Health  hazards include chemicals (such as battery acid and solvents), biological hazards (such as bacteria, viruses, dusts and molds), physical agents (energy sources strong enough to harm the body, such as electric currents, heat, light, vibration, noise and radiation) and work design (ergonomic) hazards.

Environmental hazards

An environmental hazard is a release to the environment that may cause harm or deleterious effects.  An environmental release may not be obvious.  For example, a worker who drains a glycol system and releases the liquid to a storm sewer may not be aware, of the effect on the environment.  Environmental hazards cause harm when controls and work procedures are not followed.

Hazard identification technique

• The employer shall develop a hazard identification and assessment methodology. taking into account the following documents and information.
• any hazardous occurrence investigation reports.
• first aid records and minor injury records.
• work place health protection programs.
• any results of work place inspections.
• any employee complaints and comments.
• any government or employer reports, studies and tests concerning the health and safety of employees.
• the record of hazardous substances.
• any other relevant information.

The hazard identification and assessment methodology
The hazard identification and assessment methodology shall include:

• Step and time frame for identifying and assessing the hazards.
• The keeping of a record of the hazards.
• A time frame for reviewing and, if necessary, revising the methodolog.

To complete hazard identification, one can use techniques to identify hazards. Some examples of techniques include, but are not limited to :

• work place inspections
• task safety analysis or job hazard analysis.
• preliminary investigations.
• potential accident factors.
• failure analysis.
• accident and incident investigations.

It is in your interest to adopt your own process and your own identification techniques so that they match oner management procedures and the size of business. In fact, the identification method may vary depending on the size of the work place.

Table indicates likelihood using the following values

Likelihood (L)	Example	Rating
Most likely	The most likely result of the hazard / event being realized	5
Possible	Has a good chance of occurring and is not unusual	4
Conceivable	Might be occur at sometime in future	3
Remote	Has not been known to occur after many years.	2
Inconceivable	Is practically impossible and has never occurred).	1

Severity of hazard

Severity can be divided into five categories. Severity are based upon an increasing level of severity to an individual’s health, the environment, or to property. Table  indicates severity by using the following table.

Severity (S)	Example	Rating
Catastrophic	Numerous fatalities, irrecoverable property damage and productivity.	5
Fatal	Approximately one single fatality major property damage if hazard is realized.	4
Serious	Non-fatal injury, permanent disability.	3
Minor	Disabling but not permanent injury.	2
Negligible	Minor abrasions, bruises, cuts, first aid type injury.	1

The relative risk value can be used to prioritize necessary actions to effectively manage work place hazards. Table determines priority based on the following ranges :

Risk	Description	Action
15-25	HIGH	A HIGH risk requires immediate action to control the hazard as detailed in the hierarchy of control. Actions taken must be documented on the risk assessment form including date for completion.
5-12	MEDIUM	A MEDIUM risk requires a planned approach to controlling the hazard and applies temporary measure if required. Actions taken must be documented on the risk assessment form including date for completion.
1-4	LOW	A risk identified as LOW may be considered as acceptable and further reduction may not be necessary. However, if the risk can be resolved quickly and efficiently, control measures should be implemented and recorded.