Applying risk management tools

Dice

In the environmental, health and safety industry, emphasis is placed on reducing job-related incidents and increasing the level of workplace safety and compliance. Anything that jeopardizes those priorities needs to be contained and prevented from happening again. Risk management tools provide a systematic method for handling such events with consistency and objectivity.

Using a risk matrix – a tool that quantifies hazards based on severity and frequency – is the first step in that systematic process. A risk matrix defines numerical scales for the frequency and severity of possible incidents to determine how large of a risk that event is. For example, if something has high severity and high frequency, it is considered high risk. If something is low in both of those areas, it is considered low risk. This information helps EHS professionals make decisions across a number of areas.

Applying risk management to EHS organizations

Although the risks will be different for every organization, some applications of risk management are beneficial to all EHS organizations.

Incident management: EHS systems need to track any adverse incidents such as injuries, illnesses and chemical spills, among others. Documenting incidents and collecting data helps you contain the effects, get back into compliance and ensure the incidents do not happen again. Using a risk management tool such as a risk matrix helps prioritize these critical issues. It provides a systematic process to follow, which makes it easier to make decisions about handling the situation.

Job safety analysis: Risk management provides a benchmark for JSA, breaking down the individual pieces of a job description and analyzing them with the same methods as an adverse event. Once potential hazards are revealed, the organization can take steps to prevent or decrease the risk through protective equipment or safety regulations specific to the job. Knowing what incidents could possibly occur leads to prevention, which decreases the chance of the incident actually happening.

Corrective action: EHS systems can also apply risk to the corrective action process to determine if a corrective action was effective. The risk values of an incident after the corrective action measures the residual risk to see if the corrective action worked. This can be repeated as many times as necessary, until the risk has been reduced to an acceptable level.

Enterprise reporting: Having an automated EHS system that collects data is not enough. You need a tool that reports the data in a comprehensive manner, determining general trends and overall impacts. Risk management tools give executives fuel to make informed decisions and changes with support from data. They can connect the root causes of incidents that happen in different departments and look at the EHS enterprise as a whole.

There’s more

Risk management tools are invaluable for EHS professionals in other areas: emissions tracking, energy management, Safety Data Sheets, aspects, objectives and targets, and crisis management – just to name a few. Incorporating risk management tools to all of your EHS operations will help you make informed decisions and get on a path of constant improvement.

What is Risk Management? And Why Should you Care?

149746_481c_2

Risk management is the process of identifying, assessing and controlling threats to an organization’s capital and earnings. These threats, or risks, could stem from a wide variety of sources, including financial uncertainty, legal liabilities, strategic management errors, accidents and natural disasters. IT security threats and data-related risks, and the risk management strategies to alleviate them, have become a top priority for digitized companies. As a result, a risk management plan increasingly includes companies’ processes for identifying and controlling threats to its digital assets, including proprietary corporate data, a customer’s personally identifiable information and intellectual property.

Risk management standards

Since the early 2000s, several industry and government bodies have expanded regulatory compliance rules that scrutinize companies’ risk management plans, policies and procedures. In an increasing number of industries, boards of directors are required to review and report on the adequacy of enterprise risk management processes. As a result, risk analysis, internal audits and other means of risk assessment have become major components of business strategy.

Risk management standards have been developed by several organizations, including the National Institute of Standards and Technology and the ISO. These standards are designed to help organizations identify specific threats, assess unique vulnerabilities to determine their risk, identify ways to reduce these risks and then implement risk reduction efforts according to organizational strategy.

The ISO 31000 principles, for example, provide frameworks for risk management process improvements that can be used by companies, regardless of the organization’s size or target sector. The ISO 31000 is designed to “increase the likelihood of achieving objectives, improve the identification of opportunities and threats, and effectively allocate and use resources for risk treatment,” according to the ISO website.  Although ISO 31000 cannot be used for certification purposes, it can help provide guidance for internal or external risk audit, and it allows organizations to compare their risk management practices with the internationally recognized benchmarks.

The ISO recommended the following target areas, or principles, should be part of the overall risk management process:

  • The process should create value for the organization.
  • It should be an integral part of the overall organizational process.
  • It should factor into the company’s overall decision-making process.
  • It must explicitly address any uncertainty.
  • It should be systematic and structured.
  • It should be based on the best available information.
  • It should be tailored to the project.
  • It must take into account human factors, including potential errors.
  • It should be transparent and all-inclusive.
  • It should be adaptable to change.
  • It should be continuously monitored and improved upon.

The ISO standards and others like it have been developed worldwide to help organizations systematically implement risk management best practices. The ultimate goal for these standards is to establish common frameworks and processes to effectively implement risk management strategies.

These standards are often recognized by international regulatory bodies, or by target industry groups. They are also regularly supplemented and updated to reflect rapidly changing sources of business risk. Although following these standards is usually voluntary, adherence may be required by industry regulators or through business contracts.

Risk management strategies and processes

All risk management plans follow the same steps that combine to make up the overall risk management process:

  • Risk identification. The company identifies and defines potential risks that may negatively influence a specific company process or project.
  • Risk analysis. Once specific types of risk are identified, the company then determines the odds of it occurring, as well as its consequences. The goal of the analysis is to further understand each specific instance of risk, and how it could influence the company’s projects and objectives.
  • Risk assessment and evaluation. The risk is then further evaluated after determining the risk’s overall likelihood of occurrence combined with its overall consequence. The company can then make decisions on whether the risk is acceptable and whether the company is willing to take it on based on its risk appetite.
  • Risk mitigation. During this step, companies assess their highest-ranked risks and develop a plan to alleviate them using specific risk controls. These plans include risk mitigation processes, risk prevention tactics and contingency plans in the event the risk comes to fruition.
  • Risk monitoring. Part of the mitigation plan includes following up on both the risks and the overall plan to continuously monitor and track new and existing risks. The overall risk management process should also be reviewed and updated accordingly.

Risk management approaches

After the company’s specific risks are identified and the risk management process has been implemented, there are several different strategies companies can take in regard to different types of risk:

  • Risk avoidance. While the complete elimination of all risk is rarely possible, a risk avoidance strategy is designed to deflect as many threats as possible in order to avoid the costly and disruptive consequences of a damaging event.
  • Risk reduction. Companies are sometimes able to reduce the amount of effect certain risks can have on company processes. This is achieved by adjusting certain aspects of an overall project plan or company process, or by reducing its scope.
  • Risk sharing. Sometimes, the consequences of a risk is shared, or distributed among several of the project’s participants or business departments. The risk could also be shared with a third party, such as a vendor or business partner.
  • Risk retaining. Sometimes, companies decide a risk is worth it from a business standpoint, and decide to retain the risk and deal with any potential fallout. Companies will often retain a certain level of risk a project’s anticipated profit is greater than the costs of its potential risk.