First let’s start off with a simple question: Why is Risk Management important? This may be a simple question but often the response may not be as easy.

Risk Management is important as some risk-taking is inevitable if your business is to achieve its objectives. Those businesses that are more risk aware, appreciate that actively managing not only potential problems but also potential opportunities provides them with a competitive advantage. Taking and managing risk is the very essence of business survival and growth.

So what is the risk management process? Put simply it is a process that systematically applies management policies, procedures, and practices to a set of activities intended to establish the context, communicate and consult with stakeholders, and identify, analyse, evaluate, treat, monitor, and review risk.

To recognise a risk it is important to know what a risk is. While some risks may apply to everyone, some will be specific to your business and to identify and deal with them you need to establish a base to work from.  This base is the context from where your risk analysis begins.

According to ISO 31000, to establish the context means:  “to define the external and internal parameters that organisations must consider when they manage risk. “

ISO 31000 expects that you consider your organisation’s context when you:

• define the scope of your risk management program,
• formulate your risk management policy and
• establish your risk criteria.

Setting the context involves taking into account your business goals and capabilities as well as external factors, such as the changing legal environment and shifting social standards. In other words, you need to set the context to identify where your risks come from.

This is important because:

• risk management occurs within the context of endeavouring to achieve goals and objectives,
• failure to achieve the objectives is one set of risks that need to be managed, and
• the goals and strategies assist to define whether a risk is acceptable or unacceptable.

This context sets the scope for your businesses’ risk management process.

So what do we need to look at when we are setting our context?

First your business will need to undertake a self-analysis which could include:

• Defining roles & responsibilities;
• Defining its goals and objectives;
• Defining the risk assessment methodologies;
• Defining the way performance is evaluated in the management of risks;
• Identifying and specifying the decisions that have to be made; and
• Defining the Governance and reporting process to be undertaken.

Secondly, your business will need an understanding of both the internal and external context in which it operates to enable it to better understand where its risks will come from.

The Internal Context  takes into account all the internal considerations and factors that influence how you manage risk and try to achieve your business objectives. These could be things like, your products, services, competition, financial, technology, customer segments and internal stakeholders.

The External Context takes into account all the external considerations and factors, these could include, external stakeholders, political climate, legal & regulatory constraints, environmental and cultural factors.

Any changes to either the internal and/or external context will be a trigger for your business to review its risks in light of those changes.

The importance of setting the correct context in which to start identifying business risks cannot be understated. The better and more thorough this is done the better and more thorough the resulting risks analysis will be, as setting the wrong context is in itself a risk.

The 304m Baiyoke tower where in incident occurred is a distinctive feature of the Thai capital’s skyline and demonstrative of Thailand’s emerging economy. So, multiple themes spring to mind when reading about this tragic event.

New and unencountered issues of Safety are rapidly confronting countries such as Thailand, and these require a new kind of thinking. Those involved can no longer rely on past knowledge of a local nature but instead must re-orientate to the wider world and find new solutions to new problems.

More specifically, emergent countries need to gain a much deeper understanding of the fundamental concepts of Safety; the nature of hazards, the limitations and imperfections of the controls and therefore the necessity for layers of defence.  These are the lessons that the developed world has painfully learnt. Emergent countries can be positioned to use our knowledge effectively and leapfrog their understanding and everyday practises of Safety. The IT industry comes to mind when considering how knowledge that was developed over time in the Western world can be rapidly absorbed and breathtakingly integrated to create new ideas, new solutions and even new markets. Emerging economies such as China have demonstrated this capability well.

So our challenge is to tackle beliefs, understanding and mindsets in the way that Safety is approached as we interact with the emergent world. Hopefully, we can facilitate yet another leapfrog event.

In order to ensure the content was correct, a pilot program was trialled with all of the risk managers from around Australia. With their guidance, the content was redeveloped and will be presented to all of those who lead a team in Sydney, Melbourne, Perth and Adelaide. This includes all team leaders through to state managers.

The content of the program includes:

• Finding a personal why to safety
• Understanding and impacting safety culture
• Leading safety
• Communication
• Understanding legal responsibilities

The feedback from the program has been extremely positive and includes this quote from Hayley:

If there is one thing I learnt yesterday at the Leading Safety Course was we need to “change the culture” which starts at the top and trickles its way down to the workers.  To help this change I deciphered and took note of three key elements…  We need to change the “behavior” by adjusting their attitudes, supporting their personalities and updating the environment.  If we succeed in all three then I reckon it’s the right step towards making “safety” second nature (kind of like getting dressed everyday).  Ultimately what we want is for a worker to automatically pick up that steel strapping on the footpath and throw it in the bin instead of stepping over it and keep on walking.”

QUBE have identified that to successfully improve a safety culture it is essential to provide the right skills and knowledge to the leaders in the business and encourage them to engage people in the safety discussion every day.

• To define the body of knowledge that an OHS Professional should have
• To establish a course accreditation process for universities providing education in OHS
• To develop a professional certification process.

Sally Bennett from Enhance Solutions has been the Project Manager for this project, working closely with Pam Pryor and the Technical Panel (Susanne Tepe, David Borys, Wendy Macdonald, Leo Ruschena, Jodi Oakman and Mike Capra).  The process of developing and structuring the main content of this document was managed by a Technical Panel with representation from Victorian universities that teach OHS and from the Safety Institute of Australia, which is the main professional body for generalist OHS professionals in Australia. The Panel developed an initial conceptual framework which was then amended in accord with feedback received from OHS tertiary-level educators throughout Australia and the wider OHS profession. Specialist authors were invited to contribute chapters, which were then subjected to peer-review and editing.

The OHS Body of Knowledge was formally launched in April 2012 at the SIA National Convention, Safety in Action.

http://www.ohsbok.org/

Everyone trips on stairs and it is calculated to occur in one in every 2,222 occasions. A resulting minor incident is calculated to occur once in every 63,000 uses whilst a painful incident is calculated to occur once in every 734,000 uses.  An incident requiring hospital attention is calculated to occur once in every 3616000 uses. (Please don’t forget the rules of probability here and remind yourself that each time stairs are used, it is an independent event and a roll of the dice in terms of probability.)

People in good shape (those who are fit) will fall more often than people in poor shape. This phenomenon is thought to be related to our capacity to bound as we travel. Women are far more likely to fall on stairs than men and this is thought to be related to usage, especially at home. A common place for a stair fall to occur is unsurprisingly, at home and 1/3 of all incidents occur on the first OR last step whilst 2/3 of all incidents occur on the first OR last three steps. Stairs with fewer than four risers are more dangerous and this is thought to inspire overconfidence by the user.

Unsurprisingly, 90% of all injuries occur during decent and a broken rhythm is the prelude to a fall because it takes the brain 190 milliseconds for reflex to kick in and assimilate that something is wrong. In that time, the stair user has on average descended 20cm or more, making a graceful recovery unlikely!

The most important message here is about the controls used on stairs. Outside of good design, the most important control for the stair user is of course the hand rail and the complementary behaviour known as three point contact. We implore you to share these insights with your people in an effort to elicit control behaviour and prevent painful injuries.

If you are interested in further reading, here is a good reference point.

 J.A. Templer (1992) The Staircase: Studies of hazards, falls and safer design. MIT Press Cambridge MA 

The verdict, after a two-year trial found the former owner of the company, Eternit Fibre Cement and a major shareholder, guilty of causing an environmental disaster and failing to comply with safety regulations.

Through a network of subsidiaries and affiliates, Eternit became the largest manufacturer of asbestos cement products in the world and the company generated tremendous fortunes for their owners. But unlike Australia’s James Hardie and the US and British members of the global asbestos cartel, the Eternit companies had managed to avoid the sort of litigation that sent many of its competitors bankrupt.

The decade long criminal investigation that resulted in the verdict, accused the two men of deliberate and wilful failure to protect their employees and nearby residents from exposure to asbestos, a substance they knew could kill but concealed the fact.

The defendants were also ordered to pay 30,000 euros ($39,000) in damages to relatives of people killed by asbestos-related diseases, and 35,000 euros for every sick person, as well as other payouts set to total hundreds of millions of euros.

Barry Castleman is a US medical and legal expert who gave evidence for the prosecution.

“It’s enormous in that it’s holding personally responsible wealthy individuals who were the owners and directors of asbestos enterprises, [holding them] personally responsible for criminal acts for a wilful, negligent disaster causing thousands of deaths. This has never happened before,”

“We’re talking about stuff that went on long after it was well known in the asbestos industry that asbestos was deadly, mainly stuff that went on in the 1950s and 60s and 70s and 80s. There’s no question that the companies knew about the hazards of asbestos.”

This ground breaking case demonstrates the legal as well as the moral obligations of organisational office bearers. Justice can be pursued many years later and social norms can change. So our actions and the decisions that we make today must be made in the light of current good practise knowledge and in respect for the law.

OHS legislation is very clear about the importance of adequate information, instruction, training and supervision. It is essential that an employer has methods in place to measure competency in order to understand the level of supervision required by individual employees. In order to measure competency the aspects of a person’s tasks need to be broken down into competencies. Each person needs to be measured against the competencies and shortfalls identified. Once these have been identified training measures need to be implemented in order to provide the employee with the knowledge and skills to undertake their tasks safely.

The people undertaking the project we referred to earlier broke down the competencies for each of the tasks the apprentices needed to undertake in each area of the factory. This included the machinery and equipment, including hand tools, they needed to use for each task. The intention is to assess each of the apprentices against the competencies and arrange for training where there are gaps. They are fully aware of how vulnerable apprentices are in these situations, as they had just completed their own apprenticeships.

Employers need to be asking themselves about any assumptions they may be making about a person’s ability to undertake a task or use a piece of machinery. They need to have a method in place that systematically measures a person’s ability against the required competencies for a job and offer training to overcome any shortfalls. This needs to be recorded in an accessible manner and utilised when making decisions about who can work in what area of the business.

The key question is as an employer how do I know this person is competent to do this job?? How do you know?

The Standard goes on to say that Business Continuity Management (BCM) provides for the availability of processes and resources in order to ensure the continued achievement of critical objectives.

Business Continuity Institute (BCI) & BS 25999 defines BCM as a process that identifies potential impacts that can threaten an organisation. It provides a framework for building resilience and the capability for an effective response which safeguards the interests of its key stake holders, reputation, brand and value creating activities.

So what does this mean, simply put BCM is “Plan B”.

A by-product of BCM is that it provides a comprehensive understanding of what the business actually does, how it does it and what it needs to do it to continue doing it.

BCM has mainly seen as being in the domain of financial institutions, insurance companies, Telco’s and utilities.  But it’s not only these businesses that are impacted by outages or natural disasters.

How would you or your business react during an incident would you be able to maintain your critical business services or would business just stop?

We only need to see what the impacts of the recent natural disasters, i.e.  Floods, cyclones and bush fires are having on business and the communities they service.

This is where BCM gives business an advantage as it prepares the business and its management team to quickly respond to unanticipated incidents.

BCM should be conducted as one of the required outcomes of the risk management program (ISO31000, 5.5 Treat Risks).

It must be pointed out that BCM differs from Disaster Recover (DR), as DR’s focus is on IT.  IT systems are resources of the business just like staff and equipment and play an important role in the BCM process, but should not be mistaken as the BCM process.

Poor business continuity management practices destroy credibility and leave the organisation exposed.

It is important that a robust BCM Framework within an organisation and covers:

• Business Continuity, ( what will we do and how do we do it)
• Disaster Recovery, (getting IT back up and running)
• Crisis Management  (Roles & Responsibilities in managing the incident) &
• Communications Policy, (what do we say to stakeholders, customers and the media)

BCM’s main output is the Business Continuity Plan (BCP), which will bring together:

• All Contingency Plans (what we do);
• Disaster Recovery Plan (IT recovery) and
• Business Resumption Plan (getting back to business as usual)

All Businesses plan and part of the planning process should include a robust BCM process, as we insure against fire and theft, we should also insure in the continuity of customer service. After all, that’s what we are in business for.

This December we had the privilege to present at the lunch as they aim to invite a speaker each year to present on the topic of safety. During the presentation we explored the fact that every organisation needs to pause for a moment and reflect on their successes. The OHS Manager at the MCC, Stephen Allen, was able to clearly delineate the key wins they had achieved during the year. This included:

• The recertification of our Safety Management System against the SafetyMAP Advanced criteria (this was a full system audit against all 125 criteria).
•  No reportable incidents for the past 12 months (MCC staff or patrons)
•  A very successful internal audit and site inspection program. The audits resulted in just under 80 valuable actions to improve our systems, and the inspections have increased active participation in safety related activities

Participation in this event reminded me how important it is to measure successes using positive lead indicators and then sharing them at a significant event. Perhaps in our annual strategic plans we need to ensure that we build in time to celebrate and thank those that have contributed to our successes.

In making declarations of contravention, Justice Middleton identified a number of key facts which supported his findings.

A few of these comments included that directors:

• knew or ought to have known that the current liabilities were larger than disclosed, and that the guarantees had been granted;
• failed to properly read, understand and give sufficient attention to the content of the financial reports as they related to current liabilities and the guarantees;
• failed to make enquiry or adequate enquiry of management, the Audit Committee and other members of the Board concerning the apparent deficiencies in the reports;

The case is seen as having major implications for the way company directors do their job.

The head of ASIC, Mr Medcraft, says the ruling clarifies the duties of company directors.

“They can’t just simply delegate to management or rubber-stamp management, they are held to a high standard,” he said.

“I think today’s decision empowers directors, because what it says is, ‘I’m responsible, therefore I want to know what is going on’.”

This points to the importance of 2 things:

• Directors need to ensure that the organisation’s risk management framework and governance framework are very transparent and support them in their oversight roles
• Directors need to have in place processes to personally ensure that the reports they are being provided are accurate

Centro penalties decision

Download hydration paper

Most of the incidents involved young people – with an average age of 21 – and 70 per cent of the time the collision was fatal.

“Sixty-eight per cent were male and 67 per cent were under 30 years of age. Sixty-four of the 116 victims (55 per cent) were hit by a train. Eighty-one of the 116 collisions (70 per cent) resulted in death,”

Most of the incidents also occurred in urban areas. The researchers say the reason that most of those injured or killed were young people is because that age group has less traffic experience, is less likely to drive cars and use headphones more frequently. They say distraction and sensory deprivation are the two likely factors.

“The actual sensory deprivation that results from using headphones with electronic devices may be a unique problem in pedestrian incidents, where auditory cues can be more important than visual ones,”

The study however did not take into account near misses or possible suicidal intentions and it covered iPods, MP3 players and other musical devices but did not include mobile phones.

This study has now prompted calls for a government advertising campaign in Australia and the Pedestrian Council of Australia chair Harold Scruby says headphone-related injuries and deaths in Australia is a growing problem.

“We estimate one in 10 people are using some sort of distracting device when they cross the road – be that headphones, using an iPhone, using a mobile phone, texting or looking at a screen of some kind – but certainly the headphones are a very major factor in all this because you can’t hear traffic approaching,”

Though the study focuses on a growing social issue, Safety practitioners nevertheless need to reflect on current practises within their business around pedestrian movements to understand current risk exposure and to formulate or endorse effective controls.

More recently, we were asked by one such client to formulate and deliver what we coined, technical safety workshops, for their front line leaders and the managers who support them. The aim was to increase the general understanding of the legislative components of Safety and to explore how they in turn address these requirements in the way they conduct their day to day business.

Ultimately, it was about developing a line of sight for the front line leaders so that they could clearly and unambiguously understand the impact of their role. The program was also designed to demonstrate the helpful processes that the business has to enable the front line leaders to address these obligations through clear and directional leadership.

As is our way, the workshops were undertaken using the adult learning principles that we are renowned for. Practical exercises were well received as indeed was the homework component between each workshop that people were asked to report on, upon their return. And their newly discovered insights were fascinating learning for everyone.

The enduring relationships we enjoy with our clients enable us to explore these contextual solutions.  We savour our role in the design and enablement and we welcome such conversations…. perhaps with you too!

In partnership with Toll Domestic Forwarding the team at Enhance Solutions spoke to around 160 people across 18 sites, including OH&S representatives, drivers, forklift operators and managers.

The questions we asked included “What does safety mean to you?”, “What currently works?”, “What currently doesn’t work” and “What does good safety culture look like, feel like and sound like?”

That information was then used to develop a safety vision and a three year plan for how to achieve the vision. The next extraordinary step that TDF took clearly illustrated their commitment to the goal of ‘No Injuries’ and the development of a strong, positive safety culture. The Divisional Human Resources Manager and the Divisional Director then visited their branches across Australia and New Zealand to give everyone in the business feedback on:

• What we heard you say

• What we have done

• What we are going to do

In total they visited 29 sites in Australia and 23 sites in New Zealand. They ran a total of 90 one hour sessions which touched the lives of 2,200 employees. What an incredible effort.

As a part of the program they have had a series of powerful posters made up which most sites now have on display.

One of the key messages gained as a result of the survey was the need to skill up the leaders in the business. In order to address this Toll DF have committed to a safety leadership program for all front line staff and above. During the latter half of 2011 they had already worked with us to put 164 of their people through leadership programs. What an incredible effort!

As a part of the program participants are required to undertake a project with the intention of it being implemented.

Recently three people from the organisation based at Unanderra (Wollongong, NSW) initiated and produced a presentation called “Think Twice! – Driving Safely Values”. The concept was based on targeting and educating young drivers employed by Downer in regards to Safety Values and the appreciation of incident outcomes.

Many other Downer Unanderra employees were active participants in the development and shooting stages.

The presentation was delivered to Blue Scope Steel recently and the team were subsequently invited to enter the Project Presentation into their Living Safety Awards. On the 8^th November 2011, the Downer Unanderra team won the award for “Home and Community Safety Initiative”.

Paul Sunshine was presented with the trophy (see photo) by Mark Vassella, Chief Executive BANZ.  Even though Paul’s name appears on the trophy he respectfully announced that it was a team achievement. The team was lead byColin Wilmott, Area Manager;Ian Buick, Project Manager and Paul Sunshine, Zero Harm Advisor Sydney Illawarra.

Enhance Solutions would like to congratulate the team that won and Downer Australia – Engineering Construction & Services based inNewcastlefor their support of the Leading Zero Harm program. They have now held 13 separate programs which requires a great deal of commitment and support from the organisation.

As Risk Managers we are tasked with the objective to embed a risk management culture into an organisation, or words to that effect.  This objective seems to be posing more questions than answers currently.  To assist both ourselves, and risk managers in general, we facilitated a think tank involving a cross section of experienced risk managers across several different sectors from health to project risk.

The group grappled with a few key questions:

1.  What does a risk culture really look like?
2. What are the things that influence the risk culture?

Two further questions emerged from this:

3. What should risk champions be?
4. What do we do if we don’t have senior management buy-in?

We would like to thank those involved in the Think Tank.  This paper aims to summarise the thoughts and inputs from the group and provide some guidance for risk managers in general.

1.     What does a risk culture really look like?

For an organisation to strive towards a risk culture, it needs to have a Vision of the Future to strive towards.   So do we really know what it is we are aiming to embed in organisations?  What does it look like or feel like when there is a Risk Culture?  What do we see?

Interestingly enough, the first question triggered a completely separate question – “what is culture?”.   For the sake of completeness the following definition or description of Culture is provided.

Culture

Culture is a difficult concept to define.  We all intuitively know what we mean, however it is a very complex concept.

Some definitions include:

“A pattern of shared basic assumptions invented, discovered, or developed by a given group as it learns to cope with its problems of external adaptation and internal integration that have worked well enough to be considered valid and therefore, to be taught to new members as the correct way to perceive, think and feel in relation to those problems”   Schein, 1992.

“the specific collection of values and norms that are shared by people and groups in an organization and that control the way they interact with each other and with stakeholders outside the organization.“  Hill and Jones, 2001

The Think Tank group defined Culture as “ the acted out values and behaviours and personality of an organisation, or the way an organisation looks and feels – internally for employees and externally for clients and stakeholders.”

The challenge is how to describe the current culture of an organisation.

The Roshan Institute suggests that Culture refers to the following Ways of Life, including but not limited to:

Language : the oldest human institution and the most sophisticated medium of expression.

Thought : the ways in which people perceive, interpret, and understand the world around them.

Arts & Sciences : Most advanced expression

Spirituality : the value system expressed through language and actions.

Social activity : the shared pursuits within a cultural community

Interaction : the social aspects of human contact, including the give-and-take of socialization, negotiation, protocol, and conventions.

This definition tends to provide a more tangible set of lenses to look at a culture.

Risk Culture

Risk culture is the collection of beliefs, values and behaviours of the people within the organisation that shape risk decisions. In order for a risk culture to exist, risk management must be embedded into the organisation’s culture. It should be inclusive in the organisation’s policies, procedures, and practices, not a separate business activity. When achieved, the entire organisation has become involved in the management of risk, with risk management automatically being factored into decision making at all levels of the organisation.

How it looks and feels

As risk managers, for us to achieve this we need to have a good understanding of what this looks like, and feels like.  What we are hearing people say and what we are seeing people do.  We asked the Think Tank members to discuss this.

The key characteristics of a risk culture identified by the Think Tank group are outlined below:

1. Vision & Value
2. Strategy & Appetite
3. Organisational Structure
4. Information and Systems, and Training
5. Leadership & Communication

• People in the organisation see the value of risk management, namely how it can benefit their work as well as produce optimum outcomes for the organisation.
• People are engaged in risk management and are applying it consistently because they see the value behind managing risk.
• There is a consistent view of risk and opportunity across the organisation. People recognise that risk management is not only used to for preventing or minimising adverse outcomes but that it is used for realising gains and can help the organisation to grow.
• The organisation welcomes external audits and recommendations for continuous improvement.
• In a risk culture, risk management is incorporated into the organisation’s strategy. It is a part of the vision, mission and values of an organisation.
• Risk management is incorporated into the business planning cycle, starting with the strategic plan and then cascading through to operational and team plans.
• The risk appetite is clearly defined and expressed in the organisation and is aligned with the organisation’s strategy.
• The organisational structure is set up to enable escalation of risks to the right level.
• Risk management roles and responsibilities for each level of the organisation are clearly defined and acted out. Each level of the organisation is well integrated with the next level above or below, for example, there is a harmonious connection between the board, executive and operations.
• Key performance indicators include risk management for each level of the organisation.
• Processes would be used that enable people to make and act on decisions quickly and efficiently with positive flow-on effects.  As more people in the organisation begin to see the benefit of using the processes, adoption of such processes is likely to become more widespread.
• The system is set up to allow managers and staff to report and document risks, and to treat risks.
• There is a strong and active risk framework, including risk management policies and procedures together with an active and transparent risk register.
• There are appropriate tools for risk management, for example, user guides, risk assessment forms, risk treatment forms, etc.
• Induction training and role specific training exists to support the risk framework and language.
• The ‘tone at top’ is strong and positive and management lead by example with executives actively engaged in the risk management process and applying it to their work.
• There is ownership of risk throughout the organisation, including at Board, Executive, Management and staff level. Risk leadership is evident at each level of the organisation and people are self driven and willing to take ownership of risks.  This leads to better decision making at all levels.
• Risk management language is used consistently throughout the organisation and is understood. This includes a harmonious connection between all levels, and between operational, project and strategic levels.
• There is a focus on learning and continuous improvement.

The Architecture

In a risk culture there will be artefacts such as documents, reports, procedures and tools that define how the organisation should work, and then there will be less visible and tangible things happening which are indications of how the organisation really works.  In a strong risk culture these will work well together and complement each other.

There are various elements that make up a risk culture. The degree to which the culture thrives depends heavily on how well these elements work together.

2.      What can influence a risk culture?

The group provided insights into both things that could positively influence and drive a risk culture and barriers or negative influencers.

Risk Champions

The terminology “Risk Champion” is becoming common place, however it seems that organisations interpret this role differently.  So what are the pros and cons of risk champions?

When implementing a risk language and culture through an organisation there are often more questions than answers.  As an organisations’ leaders and employees are starting to try new practices, someone needs to be there to coach them, answer their questions and guide them through the confusion.  In most organisations there are not enough Risk Managers available to do this, therefore having Risk Champions scattered through the organisation with more in depth knowledge initially can really help to get and maintain momentum.

On the downside, some organisations focus their training on Risk Champions alone, sending a clear message to the organisation that risk is the role of the Risk Champions.  This approach can have the effect of letting the management team off the hook.

Risk Champions need to be set up as a resource and a coach to support the role of the leadership within the organisation.

Senior management buy-in

It almost goes without saying that the biggest hurdle or barrier to success is getting Senior Leadership support and buy-in.  So one of the key questions asked was what hints or tricks help to get senior buy-in if you don’t already?  The overwhelming hint was that senior leaders need to see value.  As a Risk Manager, you need to paint an overwhelming need for change, and create a sense of urgency.  The tactics for doing this were varied, however part of it tended to be dependent on the decision making style of the senior leaders.  Are they motivated by information and data, or motivated by feelings.

The hints and tips were:

• Benchmark
• Conduct a hard document review
• Use specific risks
• Do it with people & use a tool to engage
• Think BIG but start small – work with a few key operations people
• Get quick wins – celebrate & communicate
• Honesty and integrity
• Flexible approach
• Build relationships
• Stealth
• Creative engagement

And the final hint or tip that was provide was

• Just keep going….

The three biggest characteristics required of a Risk Manager are the 3P’s

PATIENCE

PERSEVERANCE

PASSION

Good luck to you all on the journey!

This article discusses the method for conducting a team-based risk assessment, also known as a generative risk analysis or vulnerability analysis.

Team based risk assessment

Team based risk assessment provides:

• A gathering of relevant ideas and issues from key stakeholders
• Alignment of the team on risks and issues.

The analysis is a facilitated team based process to ensure all relevant aspects of the prospective business opportunity, project or project phase have been examined and assessed. This process requires input from all interested stakeholders so that there is a balanced contribution to the overall analysis. Stakeholders offer pertinent and important information related to the business prospect under examination.

The process is made up of the following components:

• Team Selection
• Context/Scope
• Risk Characterisation
• Vulnerability Analysis
• Risk Assessment
• Verification & Review

Step 1             Selection of Team Members

The first step is the selection of a team of stakeholders and if necessary experts for the assessment. The key is to select the necessary and correct members. They should consist of a minimum number of specialists and key stakeholders in the process. Team size will affect the output of the analysis – usually less is better.

Step 2             Define the Context/Scope

Risk and uncertainty are inherent in the development of all businesses. The proper identification of risk and a structured approach to analysis and monitoring are essential if a proactive approach is to be taken to recognise and overcome the challenges that arise in each phase of the business. The context of the assessment is the primary foundation on which the rest of the analysis will be built. It is typically defined by management as the first step in initiating an analysis. The descriptive definition of the context ensures we have a clear understanding of what is to be included as subject to analysis.

Step 3             Conduct a Vulnerability Workshop

So far, we have developed our context, set our objectives, and developed agreed risk characterisations and criteria. It is now time to conduct our vulnerability analysis.

The central concept to a vulnerability analysis is that it is a method of obtaining consensus on the relative importance of vulnerabilities, risk characterisation, control options and the creation of action plans in a workshop with relevant stakeholders. It is a team-based generative risk analysis. The vulnerability technique can be used in different circumstances and phases. Vulnerabilities can be grouped under headings such as people, production, and external factors, and then matched against critical success factors.

Step 4             Conduct a Risk Assessment

Using agreed risk criteria, we are now able to build a risk register, which represents the risks arising from each vulnerability. Our register will explicitly define:

• The identified vulnerabilities
• The risk arising from those vulnerabilities
• Any influencing factors or existing controls
• An allocation of consequence, likelihood and risk rating
• Strategies, or control options, which will mitigate or eliminate the impact of our risks
• Assigned responsibilities and review timeframes

Our completed analysis will now consist of 3 parts:

1. Our Context document, including risk characterisation
2. Vulnerability Table
3. Risk Register

If you would like more information on vulnerability analysis, please contact Simon Hart at Enhance Solutions.

Acknowledgement

Enhance Solutions acknowledges the work of R2a in risk and reliability management and is grateful to R2a for permission to reproduce text and diagrams from the publication “Risk and Reliability – An Introductory Text” by Richard M. Robinson, Kevin J. Anderson, et. al