Training objective
The objective of this video is to give you an understanding of the risk management process that is commonly applied in organizations.
What you’ll learn
Identify uncertainties linked to objectives, be able to use a bow tie to help you analyze what you need to do to succeed and achieve your objective, be able to assess the completeness and effectiveness of controls, and use the risk management process in your ongoing decision-making processes.
Transcript
[Slide 3] Risk is the effect of uncertainty on objectives
Let’s set the context for our case study to illustrate how the risk management process can be applied especially in dealing with our chaotic and uncertain times. Whether at work or at home, we are constantly managing risks and seizing opportunities to succeed.
You are planning a road trip in two days. Unfortunately, heavy rain has been forecasted. There is a likelihood of a 90 percent chance of heavy rain. There is also a potential for flash floods in the location that you are planning to drive to.
Your objective for the road trip is safe arrival. Heavy rain and flash floods are uncertainties affecting your proposed road trip. The roads that you will be traveling on can be very wet and slippery.
The effect of uncertainties of heavy rain and flash floods on your objective of safe arrival is losing control over your vehicle, which is a risk to you. This risk is an actionable event that you can do something about before your road trip.
You have now completed your risk identification.
[Slide 4] A bow tie diagram
Let’s use a bow tie diagram to help you analyze what you need to do to succeed and achieve your objective.
A bow tie diagram is used to graphically show the pathways from the causes of an event or risk to its consequences. It’s a simple qualitative diagram that helps you identify where new or enhanced controls may be required.
The logical flow of a bow tie diagram also provides a very effective means of illustrating the factors concerning a risk. But when situations are more complex, there may be other quantification tools to use.
Usually, the focal point for a bow tie analysis is a single risk event. At the center of the bow tie is the risk event. The event may occur because of the sources of risk that could impact your objective.
The left and right sides of the bow tie are larger than the center because many causes might lead to a single risk event. That single event might lead to many consequences or outcomes.
As an effective communication and monitoring tool, a bow tie can be used for recording information about a risk that does not fit the simple linear representation of a risk register.
[Slide 5] Likelihood and consequence controls
On the left-hand side of the bow-tie knot, likelihood controls are measures put in place to reduce the likelihood of negative risk events or to increase the likelihood of positive events.
These measures could be either be physical or procedural barriers. Examples of physical barriers include firewalls and handrails. Examples of procedural barriers include policies and procedures, safe work practices and training, or any conceptual modification of likelihood such as those suggested by the hierarchy of controls.
Controls can either be existing controls or future treatments. A control includes any process, policy, device, practice, or other actions that are currently modifying the event. Whereas, treatment is a process to modify the event.
Future treatments are additional measures implemented if existing controls are not effective.
The most effective likelihood controls address the causes of an event. As the cause can either be a threat or an opportunity to you, likelihood controls can also be a preventative control or an optimization control. You can either take action to prevent a threat or optimize an opportunity.
Collectively, the left-hand side of the bow tie knot is managed by likelihood management.
On the right-hand side of the bow-tie knot, consequence controls are measures put in place to change the event’s consequences when they do occur. These are technical, operational, and organizational measures that modify the consequences arising from an event.
The most effective consequence controls provide appropriate responses to consequences being felt or create barriers to the consequences developing. As the consequence can either be a loss or a benefit to you, consequence controls can also be either a recovery control or an exploitation control. You can either take action to recover from a loss or exploit a benefit or an opportunity.
Collectively, the right-hand side of the bow tie knot is managed by consequence management.
[Slide 6] Risk assessment
Going back to our example of a proposed road trip, it has been established that losing control over your vehicle is a risk to you. This is the effect of uncertainties of heavy rain and flash floods on your objective of safe arrival.
A bow tie can be used to assess the completeness and effectiveness of controls, to check that each pathway from cause to event and event to consequence has effective controls, and to identify factors that could cause controls to fail and potential control gaps.
Moving from risk identification to risk assessment as part of the risk management process, you have identified one existing preventative control that can address the causes of the risk. This preventative control is defensive driving. You are currently skilled in defensive driving because you have recently attended a defensive driving course. This control should reduce the likelihood of roadside distraction, poor visibility, and slippery road conditions.
You have also identified one existing recovery control that can change the consequence of the risk. This recovery control is wearing a seatbelt. This control should reduce the consequence of a vehicle crash.
[Slide 7] Rating the risk
Given these two existing controls, it’s time to assess the effectiveness of each control. You do so by asking two questions, ‘Is the control designed well or could it work?”, and “Is the control implemented well or does it work?’
In this case study, you have evaluated the effectiveness of the two existing controls as ineffective. For you, the risk rating for the event of losing control over the vehicle is considered as high, even with these two existing controls in place.
Risk is often expressed in terms of a combination of the consequences of an event and the associated likelihood of occurrence. This is where a customized risk matrix can be used to rank a risk using defined ranges for consequence and likelihood.
[Slide 8] Risk treatment
You are now thinking about other potential risk treatments for enhancing existing controls, improving their effectiveness, or filling control gaps. After you have selected the preferred options, you evaluate the advantages and disadvantages of each option, agree on the options to be pursued, and develop implementation plans.
Your appetite for risk-taking or opportunity-seeking plays a big part in deciding whether you will proceed on your road trip.
As a risk-averse person, you are not comfortable with such high risk and will not embark on the road trip.
If you want to continue with this road trip, you need to implement new controls. These are future treatments that reduce the level of risk to a more comfortable or acceptable level.
Therefore, to reduce the risk rating from high to medium, you implement a new preventative treatment by adjusting your driving schedule. Options include delaying your departure time or postponing your road trip. In this instance, you plan to delay your departure time by two hours.
You are also planning to acquire more information on how to escape a submerged car if the floodwater increases. This is your new recovery treatment or contingency plan.
All these existing controls and future treatments form part of your hypothesis to reduce the level of risk.
You are hoping that by implementing these two new treatments in addition to the two existing controls, the level of risk can be reduced from high to medium.
Being comfortable with this lower risk of potentially losing control over your vehicle, your road trip can proceed. This is despite the effect of uncertainties of heavy rain and flash floods on your objective of safe arrival.
What you have done in this everyday example is to apply a risk management process. You may not have called it ‘risk management’, but you have certainly used it to achieve your objective.
The risk management process enables you to increase the likelihood and extend of your success by making better-informed decisions and taking the right risks and opportunities.
Risk management is success management.
Template
Bow tie risk and controls assessment template