Posted By Andy Brazier
I think the problem here is that risk is only an abstract concept rather than the tangible result of an equation. The idea that risk = severity x likelihood (or any other equation) helps us understand what it means, but it can't actually be calculated.

A risk assessment is only a means to an end, and not an end itself. Unfortunately people tend to dive into doing a risk assessment and fail to see the bigger picture. Actually assessment is part of risk management, and if you follow it through properly it is actually only a small part of the program.

Managing risks involves:
1. Identifying hazards - people often fail to list all the hazards, and so their assessments will inevitably be flawed.
2. Identifying risk controls
3. Assessing risks - people often assess risks associated with individual hazards which is fine, but you also need to assess the overall risk - a simple rating is usually more than enough
4. Considering whether the risks are as low as reasonably practicable (ALARP)
5. Specifying additional controls if required
6. Implementation of the risk management program

In my opinion step 4 is the critical one. It is achieved by answering two questions:
a) What additional controls could be put in place to reduce the risk?
b) For those additional controls that you are planning to NOT implement, why? This argument will either be that the risk reduction is minimal, it will result in an unacceptable transfer of risk or the cost is grossly disproportionate

To answer these questions we need to consider the hierarchy of control because this tells us how reliable controls are likely to be.

So my opinion is that how you rate risks is relatively unimportant as long as you are consistent. As long as you can demonstrate you know what your highest risks are and that you are doing something about them is enough.

Posted By JasonGould
Andy, absolutely correct

P.s. No, I am not going into the just get rid of the hazard conkers bonkers frame of mind as some risk will always have to be MANAGED. That what we do.

Regards

Jason

Posted By Hilal KINLI
Andy,

I think firstly we need to agree in the terminology of hazard and risk.

As you now, there are many definitions in many literature.

I think we may select OHSAS 18001:2007 definitions which is an international standard as an example for discussion.

In that standard, hazard is defined as:

Source, situation, or act with a potential for harm in terms of human injury or ill health or a combination of these

I agree with this definition. But I also prefer to identify "potential for harm" as "potential for risk". (I will explain the reason below)

Risk is defined as;

Combination of likelihood of an occurrence of a hazardous event or exposure(s) and the severity of injury or ill health that can be caused by the event or exposure.

I do not agree partly with this definition. In my view, "risk is probable outcome (s) of a hazard which could lead directly or after a sequential events to an injury or ilness."

Forexample, if somebody is working at height, working at height should be defined as hazard, because there is a probable outcome as fall risk. This is primary level of risk. If a person falls, then there is a probable outcome of this primary level risk as injury or death which I call as secondary level risk.

This was an example what I mean from sequential effects.

We can increase the examples for many situations.

In my view, after identifying the risk as probable outcome (s) of a hazard, we may say that magnitude or significance level of the risk depends on likelihood, severity, frequency, etc.etc. depending on the risk ratiing methodology used. (Risk rating methodologies are another subject for discussion.)

If we identify risk as, just as combination of likelihood and severity of a probable outcome, it is just flying object for me. No meaning.

Because in many literature and in our daily life, we use risk terminology for a probable outcome of an hazard. e.g. fall risk, exposure risk, electrocution risk, radiation risk, back injury risk, etc.

What I mean is that, risk has a name in our daily life and in our literature. Risk terminology is not used just as a number, or magnitude, or a significance level.

So, why don't we prefer to use that conventional name for risk and then define the magnitude of that risk, instead of identifying the risk as a flying object?

Agree or not?

Best wishes

Hilal












think the problem here is that risk is only an abstract concept rather than the tangible result of an equation. The idea that risk = severity x likelihood (or any other equation) helps us understand what it means, but it can't actually be calculated.

A risk assessment is only a means to an end, and not an end itself. Unfortunately people tend to dive into doing a risk assessment and fail to see the bigger picture. Actually assessment is part of risk management, and if you follow it through properly it is actually only a small part of the program.

Managing risks involves:
1. Identifying hazards - people often fail to list all the hazards, and so their assessments will inevitably be flawed.
2. Identifying risk controls
3. Assessing risks - people often assess risks associated with individual hazards which is fine, but you also need to assess the overall risk - a simple rating is usually more than enough
4. Considering whether the risks are as low as reasonably practicable (ALARP)
5. Specifying additional controls if required
6. Implementation of the risk management program

In my opinion step 4 is the critical one. It is achieved by answering two questions:
a) What additional controls could be put in place to reduce the risk?
b) For those additional controls that you are planning to NOT implement, why? This argument will either be that the risk reduction is minimal, it will result in an unacceptable transfer of risk or the cost is grossly disproportionate

To answer these questions we need to consider the hierarchy of control because this tells us how reliable controls are likely to be.

So my opinion is that how you rate risks is relatively unimportant as long as you are consistent. As long as you can demonstrate you know what your highest risks are and that you are doing something about them is enough

Posted By GeoffB4
Andy - your posts have been spot on.

Risk assessment should be a process that, depending on the hazards/level of risk, can generally be easily carried out with a minimum of training by people at work.

The more difficult we make this process the less likely the assessments will be carried out or to a similar standard.

A number of responses to this thread are indicating a level of proficiency way above what is generally needed - in fact it's as though it is a process that only specialists should be involved in. Ring any bells?

Risk assessment is not a complicated process so let's stop quibbling over the meaning of individual words and work together to make the whole process less of a black art and more like it was intended to be.

Posted By Chris Jerman
Dear Geoff, if you knew me personally you'd understand that making risk assessment simple - but effective has been my life's work. (I wrote and presented 3 of the IOSH certificated risk courses for 4 years)

Performing a risk assessment in my organisation is dead easy, the people who completed them did so with a minimum of instruction and no training per se at all. I did not conduct them (especially dressed in a wizard's outfit using potions and spells I can assure you) Within a year of joining my current employer, we went from having barely anything to a comprehensive set of assessments delivering value right the way up to the Board in a year. (29,000 employees) I'm perfectly happy with our methodology because we're done and dusted like everyone else should have been about 15 years ago (please anyone, no need to have the discussion "you're never finished risk assessing", it's a turn of phrase but we know which we have and which we haven't, got)

The trick is in getting the right people to contribute the right information. My assessments are literally two minute jobs to complete. However, the concepts that sit behind risk assessment, such as 'is PPE a risk control or a safety measure, does a safety harness alter the reasonably foreseeable worst case injury' are more complex. (that's complex, not complicated).

These discussion are the province of the safety professional and it may be that this thread has been mistaken for a guide on to how to conduct risk assessments. It isn't it's a philosophical debate of the finer points of language. IF you read many of the posts here, you will see that people use the same words differently in their own posts! Now if you use it differently to me - that's fine, I guess. But if you use it differently yourself, I have to question how clear one's instruction would be those trying to perform the assessments. So if you define something, stick to your own definition at least.

Sorry Geoff, I'm not meaning to be personal here, but this is a productive thread by a group of interested parties and simply saying stop making it complicated is not a helpful contribution to the debate. Someone has to design the process and to do that it needs to be structured, systematic and well thought through. We get our fair share of enforcement visits and the initial reaction is often one of surprise at our assessments. Many an 'officer' has gone away wondering why everyone else doesn't make it look this easy - that's because we are very clear on what we're doing. Wandering around aimlessly with a clipboard simply spotting hazards in a company of our size and complexity would not be effective and would certainly never produce the assurances that the Board needs. However, regardless of the size of the company, I think that we need a clear picture. If you take 5 steps, MOHSAW and the latest guide assessments from the HSE, couple that to HSG 245 and it's a wonder that anyone knows what they're doing. You could drive a coach and horses through it. So I absolutely agree with you that it needs to simple and let's get on with it - but it also needs to be clear too. And at present for a great many people, it isn't. Just read these pages every day!

I didn't take your post personally by the way, and I hope that you feel the same. The point of these pages is precisely for thrashing these things out, and this one certainly has had a good thrashing!

Best wishes

Chris Jerman

Posted By Chris Jerman
Andy, I couldn't agree more my learned friend. However, as I said, I'm not sure that this is a debate about method as much as a debate over concepts and principles.

I'm all for different methodologies, but I simply disagree with anyone who says that working up a ladder is a hazard. It's a task. There's a verb in it. Probability and possibility are two utterly different concepts. And yet we seem to use them interchangeably. I have trained thousands of people all over the World in this thinking and the results have been quite astounding. I took a team of 7 safety managers through it once, the transformation was incredible. For the first time, they told me, this actually made sense.

I'll concede that it really may not matter at all to anyone else. But it does to me. I'll have to live with that. I am in a position where I have seen this work and I have seen it fail and I know where I sit. I can see why people get in a fix and end up with pointless thousands of risk assessments, all I wish to do is share my lessons of making it work across huge and widespread multi-national companies and local corner shops.

There's more than one way to skin a cat. But if we disagree over what a cat looks like .....

Is it time for a beer yet?

CJ

Posted By Adrian Watson
Was in not Albert Einstein who said "make it as simple as it needs to be, but no simpler."

I agree much of what has been said said about risk assessment of being a means to an end and not the end in itself. The simplest risk assessment is "Can it hurt me; if so, how do I keep myself safe?"

The reason I have a bee in my bonnet about the meanings of words is that the meanings frame how people think about things.

If people understand that a hazard is "something" then taking working on a ladder as an example, the ladder, becomes the problem not the fall from height because of over-reaching, falling because the ladder is on unstable ground, electrocution from touching live wires when on a metal ladder, etc.

The real issue with risk is in risk prioritisation to decide what needs to be done first.

In respect of possibility, likelihood and probability, they are all related, but different. I put possibility at a higher level of abstraction; with likelihood being related to qualified risk assessment and probability to quantified risk assessment.

Regards Adrian