Organisational Risk Profiling by Consequences – a Failed Approach
By Goran Prvulovic from www.riskwisesolutions.com.au
Reactive Risk Profiling
It is interesting to note that when it comes to organisational risk profiling involving health, safety, environment and material risks, so many companies still heavily rely on the outcomes of negative events to guide them towards identification of critical risks. This reactive, number driven view of risks starts from the supervisor’s shift report, mandatory project or site operational end of month report and eventually finishes with corporate end of financial year costs and performance review process.
This is a time consuming process and conversations are always the same.
· How did we perform in critical areas?
· What did we learn from all the injuries?
· Which processes have failed?
· What types of injuries, incidents or failures are most common?
· Where do they occur most often and how?
· What are plant and equipment damage statistics?
· How much money did we lose of the bottom line?
Although those questions are good in terms of preventing losses and creating business savings, it is often a little too late. The ship has already sailed as losses have already occurred, at least for that financial year. The mechanics involved in causation of this reactive method are indeed very interesting.
Organisations spend large amount of resources putting in place electronic event management systems in place to accumulate and decipher data resulting from incidents, injuries and losses. This is done in an attempt to produce one key benefit – creation of an overall organisational learning culture. Having those systems in place is a great way of tracking critical information; however their existence can also create problems. Decision makers and custodians of those systems can easily become too reliant on reactive feedback those systems provide and can lose focus of what is most important – a proactive risk identification and treatment.
Over time, this process can easily become a normalised part of profiling risks, mostly by studies of negative consequences. People condition themselves to reactive thinking by waiting for automated system reports and data to ‘show them the way’ in terms of identifying common trends, injuries, type of process failures and many other useful, and not so useful feedback. In a way, this dependency on reactive information about losses can be described as a culture of ‘let’s see where we went wrong last month’. This creates a specific effect of being continuously left behind in time and trying to address issues whose causes may no longer be there, or at least are much more difficult to identify. Needless to say, this is not a good thing. For example, if this principle was to be applied in quality involved in production of electronics, automotive or aviation industry products, many companies would cease to exist due to financial losses and liability. Proactive functionality build into various types of electronic event management software used today is often very limited and underutilised. The main reasons for this are our own limitations in the way we think about and understand risks. It truly is a case of garbage in, garbage out, principle at its best.
Essentially, organisational risk profiling by study of negative consequences is of very limited value. Past issues do not always predict future performance, although they should continue to be considered as an overall part of risk identification processes. To prevent, or significantly reduce negative consequences of risk and associated losses, organisational risk profiling approaches need to move much more upstream. Organisations really needed to be aware of information, feedback, signals, communications and many other methods of identifying risks, long before issues begin to arise so that appropriate remedies can be applied proactively. Organisations need to have solid understanding of their specific risk profile and effectiveness of risks controls. This can be done by several predictive and validation strategies. Some organisations do this well, but they seem to be in minority. The question is why?
One of the most dangerous assumptions made in organisations is that problems and risks are static. Just like many other business factors, they are not a static phenomenon. They can evolve, escalate, change and move laterally and vertically if they are not addressed in a timely manner. This is especially true in cases of leadership and cultural issues. Lack of their identification can cause tremendous damage; no organisation wants to learn of those issues in a reactive way. Sadly, they often do.
Another common issue is the cost. Proactive risk studies, analysis, and risk identification workshops involving subject matter experts are often seen as unnecessary and simply too expensive. Decision makers can often have an extremely optimistic risk view, often driven more by internal risk perceptions rather than any specific analytical approach. Tangible nature of costs involved in proactive risk identification versus the intangible and uncertain nature of operational risks and their consequences often heavily influence decision making, sometimes with major negative business impacts. Humans are absolute masters in persuading ourselves that something will, or will never happen, hence why we should use structured and analytical risk assessment processes.
In terms of existing proactive approaches, specific site or project risk registers can often be a ‘tick and flick’ affair. In some cases, workforce and even the supervision can be partially or completely excluded from the risk identification, risk treatment and update of risk registers. In those cases, very valuable opportunity is lost as those who work with risks are often the best source of information about types of risks and system failures, likelihood of occurrences and causative mechanisms of individual and organisational accidents.
Proactive Risk Identification and Mapping
The best risk identification, mapping and treatment strategies involve a carefully planned, collaborative and consultative approach by creating risk workshops. Simply put, organisation can relatively easily identify the most common types of their business risks, key subject experts and members of the workforce. The group (or groups) than brainstorms various scenarios involving process, human, systemic and organisational failures, and works on risk identification and validation of existing controls, under careful facilitation of an experienced risk management professional. The facilitator is usually an external person which adds to neutrality and promotes the flow and accuracy of information. The workshop environment is declared as ‘safe’ in terms of promoting a culture of openness and transparency with limited presence, inputs or interference from the senior management. Identified risks are grouped, contextualised in terms of mechanics of occurrences and risks assessed by various cause – consequence, fault three analysis or other technical risk models. Existing controls are identified and evaluated for their effectiveness and new, additional ones are added as required.
This process is well established in some high risk industries operating under safety case regime. In Western Australian resources industry, this process is mostly known as a Catastrophic Risk Profiling, Major Hazard or Critical Risk Program however other names are also used. It has been applied by some organisations mostly as a response to legislative and regulatory attention; however it has produced some great overall organisational benefits. Main emphasis of those programs was placed on identification and treatment of top layer of risks however the same approach can easily be implemented for any risk level.
Although usually initiated by safety concerns, proactive risk analysis of this kind also deliver separate, extremely valuable side benefit. Apart from risks, they also identify critical quality, systemic, leadership and organisational issues, specifically production bottlenecks and barriers for continuous improvement. They also provide opportunities for brainstorming and generation of business improvement ideas, at the levels which are often the most valuable and easily missed – the front line leadership and the workforce. Business savings or production improvements generated from suggestions and ideas created in risk profiling workshops can often be substantial and can in some cases easily fund the entire proactive risk profiling program. Such is the power of collective thinking.
Organisations can either apply proactive risk profiling methods or continue to perform organisational risk profiling by consequences. The smart money is on proactive, which does require some financial investment in order to work however they do not need to be large. It is amazing what can be done on a small budget and with some creative thinking. The alternative is bound to continue to generate business losses and human costs, as a true reflection of the old saying, there is never enough money to do it right, but always enough money to do it again.
Goran Prvulovic
Latest posts by Goran Prvulovic (see all)
- Impacts of Cognitive Dissonance in the Workplace - June 25, 2023
- Safety Manager – an Ultimate Scapegoat - September 5, 2016
- HSE Performance – Back to Basics - May 28, 2015
- Organisational Risk Profiling by Consequences – a Failed Approach - March 30, 2015
- Are Our Front Line Leaders Ready? - March 8, 2015
Do you have any thoughts? Please share them below