Learning from incidents
Analyzing incidents using a barrier based philosophy is a common occurrence. Learning from individual incidents is becoming more ubiquitous, we know roughly how to do it. The challenge is to learn from many incidents.
In the area of risk assessment, the same barrier philosophy can be applied. The bowtie method is the most advanced barrier-based methodology for risk assessment.
Both of these methods, incident analysis, and risk assessments are used in their respective areas; one is reactive, the other is proactive. Both follow the same barrier-based philosophy, which makes the two compatible to exchange information. Merging the information from these two approaches can have tremendous benefits. Using the findings from incidents to update a risk assessment can help in aggregating and seeing patterns emerge across incidents.
Some of the advantages are; combining several near misses to see the potential for looming future incidents; extrapolating the failed controls from one scenario to another; uncovering and updating the risk assessments with information from incidents; using the risk assessments as a final quality check on the incident analysis.
