Why manage risks + key ingredients

What goal do you want to achieve in the risk control? You want to control, for example, financial risk, health and safety risk, environment risk and security risk. In terms of what aspects, think of general enterprise risk, project risk, product risk and process risk. The ‘goal’ and ‘aspect’ will help you think: where are the uncertainties? And what is the effect of those uncertainties?

Triplet of risk

The following definition of risk contains three components of risk. Definition of Risk (Kaplan and Garrick, 1981)

“Risk is equal to the triplet (_, _, _), where _ is the ^ℎ scenario, _ is the probability of that scenario, and _ is the consequence of the ^ℎ scenario, i = 1, 2, . . . , N”

If you mention risk, think about where is the risk located? That is in the scenario. Then the probability of the scenario determines the uncertainty. And the consequence of the scenario means the effect of the uncertainty. The figure below shows the triplet of risk and if you want to assess the risk: the combination of the likelihood of the scenario and the severity of the consequence in this scenario.

There are multiple ways to do risk assessment. However, a good risk assessment meets the needs of risk managers for decision making. Scenario thinking is important because it is proactive.

Risk Scenario, control & management

Now we understand the concept of risk, think about the chemical plant. Are those risks in control? To know, we need to answer the three basic questions. Those three questions can help us understand how to control the risk.

1. Do you understand what can go wrong?
2. Do you know what systems prevent this from happening?
3. Do you have information to assure they are working effectively?

Answering question 1 – do you understand what can go wrong?

Mapping out risk scenarios can help you answer the first question. Risk scenarios should be pragmatic and constructive; therefore, you need to develop it based on the accident sequence.

Before the accident, there is the ‘normal condition’ of the business process. Then, there is a deviation: ‘lack of control’. Because of ‘lack of control’ your business is experiencing the ‘initial phase’ of the risk. If there is a ‘loss of control’, the business becomes worse and enters to the ‘concluding phase’ which probably experiences incidents or some other loss. When this energy in your process is exposed, then you enter the ‘injury phase’: unwanted, unplanned event(s).

There are many methods that can help us to identify risks, creating scenarios, even identifying controls. For example, HAZOP/FMEA are widely used to register hazards and analyze risks. Fault Tree Analysis (FTA) are also commonly used for risk analysis. Fishbone also can be used to analyze accidents and causes. So, there are many methods and techniques that can be used to create such kind of ‘accident sequence scenario’ of the risks.

The downside of these methods is that they are not made to visualize risk scenarios. Also, it is not possible to visualize reference data around this risk scenario.

Answering question 2 – do you know what systems prevent this from happening?

In the first step, you develop the risk scenario to understand what the risk is. In the second step you want to know what systems can prevent them from happening.

There are different types of controls which can be used in the different phases of the accident sequence. At the ‘normal condition’ you can start to design some preventive measures, that allow you to control the deviation. that have a ‘control’ function. In the last stage, injury phase, you can put some mitigation or protection measures.

Answering question 3 – do you have information to assure they are working effectively?

The first step gives you insight on the risk you are dealing with. The second step gives you information about the controls or barriers that you are putting in place. Having only this information is not sufficient, because you are not assured if those barriers function well in the risk scenario.

To get this information, you need management information around barriers or controls. For instance, who is responsible for a control that you have put into place? What are the risk management activities that are associated with the performance of this control? How are your barriers functioning in practice?

Learn more

Are you interested in learning more about a method that allows you to map out risk scenarios, taking the accident sequence into account while doing so, and visualize how you are dealing with risks? Learn more.

© CGE Risk. 2021 – The copyright of the content of this blog belongs to CGE Risk Management Solutions B.V.