Risk Management and Education

Thierry Meyer, Genserik Reniers, Valerio Cozzani

• Publisher: De Gruyter
• Year: 2019
• Print ISBN:
  9783110344561
• eBook ISBN:
  9783110383775
• Topic: Technology & Engineering
• Subtopic: Business General
• Index: Technology & Engineering

Risk and Safety Management are crucial aspects in chemical industry and academic laboratories. From their rich experience in academic education and industrial practice, the authors present options for professional training addressing engineers and scientists at different career levels. The book informs about existing norms (OHSAS, ISO, etc.) and discusses examples from several countries.

1Introduction to risk management (RM)

Trying to define what is a risk is generally compartmentalized based upon whether the risk is in the context of business continuity, project management, security, engineering, industrial processes, financial portfolios, actuarial assessments, or health and safety. The potential list is finite, but is certainly overwhelming. Risks could be described as disruptions resulting from the unpredictability of the future caused by accidental derogation possibilities of planned targets. Therefore, talking about risks also means the dispersion around an expected value.

The authors want to emphasize that this book is concerned with operational risks and not with financial ones. The latter refer to a company’s ability to manage its debt and financial leverage. It can also be seen as the probability of loss (or profit) inherent in financing methods that may impair the ability to provide adequate return, or like any risk that comes from giving money to another person or entity. For example, if one lends money, one carries the financial risk that the borrower will not repay it. A venture capital firm carries the financial risk that its investments will never become profitable. Likewise, an investor who purchases an asset carries the financial risk that he/she will be unable to resell it.

Operational risk is the risk not inherent in financial, systematic, or market-wide risk. It is the prospect of loss resulting from inadequate or failed procedures, systems, or policies, such as

–employee errors;

–systems failures;

–fraud or other criminal activity;

–any event that disrupts business processes;

–reputation problems.

Most organizations accept that their people and processes will inherently incur errors and contribute to ineffective operations. In evaluating operational risk, practical remedial steps should be emphasized in order to eliminate exposures and ensure successful responses.

Risk is part of all our lives. As an individual, we daily take risks even if we are not aware of it. If you went to work this morning, you took a risk. If you rode your bicycle, used public transportation, walked, or drove a car, you took a risk. If you put your money in a bank, in stocks, or under a mattress, you took other types of risk. If you bought a lottery ticket, you were involving an element of chance – something intimately connected with risk. The latter example implies that in specific domains, in particular, when dealing with financial or technological opportunities, risk not always has a negative accent, but may be interpreted as an uncertainty affecting the achievement of a given objective.

This also explains why, at another scale, as a society, we need to take risks to grow and develop. From energy to infrastructure, supply chains to transportation security, hospitals to housing, effectively managed risks help societies achieve growth and development. In our fast-paced world, the risks we have to manage evolve quickly, nowadays, even quicker. We need to make sure we manage risks so that we minimize their threats and maximize their potential.

In their book Engineering Risk Management, Meyer and Reniers [1] depicted risk management (RM) with an engineering perspective. RM involves understanding, analyzing, and addressing risk to make sure organizations achieve their objectives. So it must be proportionate to the complexity and type of organization involved. RM is an integrated and joined up approach to managing risk across an organization and its interrelations with the extended networks. It must be analyzed using a systemic concept. Because risk is inherent in everything we do, it could address diverse topics such as health and safety, engineering, planning, finance, insurance, banking, business continuity, financial services, politics, and many more.

Being risk sensitive is not the same as being paranoid. One can realize that there are risks associated with everything. There is a need to take a deliberate and methodical approach to dealing with risk, while at the same time being realistic. The central idea of risk is that there is uncertainty involved. If compared with life [2], the only certainty in life is death, and the uncertainty lies in when and how death will occur. People strive to delay the final outcome of life and try to improve the quality of life in the interim. Threats to these interim objectives involve risks, some natural, some man-made, some completely beyond our control, but most of them are controllable and manageable.

Risk appetite is the amount of risk, on a broad level, an organization is willing to accept in pursuit of value. Each organization pursues various objectives to add value, and should broadly understand the risk it is willing to undertake in doing so [3]. No organization can achieve its objectives without taking risks, but the level and amount of risks an organization has to take cannot be clearly specified. The biggest challenge is to recognize the risks and to manage them continuously. It should be remarked that risk is not static, but has an inherently dynamic feature, since it is often affected by a huge number of external factors likely to evolve in time.

RM is not limited to catastrophic failures of assets or processes. To be effective, RM must acknowledge that risks take many forms and that all must be clearly understood and effectively managed. Finally, RM is multidimensional and requires the direct support of most business and plant functions, as well as the entire workforce of an organization.

1.1The RM process

What does RM mean? Is it just identification, assessment, and planning and controlling social, economic, and/or physical threats to an organization? Is the concept only about transferring the risk or reduce its negative effects? With no doubt, the answers for the above questions is “no.”

The process of RM is not only restricted to controlling the threats or reducing their negative effects. It is a much deeper concept that also involves risk avoiding as well as risk taking. Every work involves some kinds of risk. Sometimes you avoid, sometimes you control the phenomenon, and sometimes you simply let it come.

We will focus on the engineering approach for the RM process. The International Organization for Standardization (ISO) in ISO 31000:2018 [4] identifies the following principles of RM:

–Organizations of all types and sizes face external and internal factors and influences that make it uncertain whether they will achieve their objectives.

–Managing risk is iterative and assists organizations in setting strategy, achieving objectives, and making informed decisions.

–Managing risk is part of governance and leadership, and is fundamental to how the organization is managed at all levels. It contributes to the improvement of management systems.

–Managing risk is part of all activities associated with an organization and includes interaction with stakeholders.

–Managing risk considers the external and internal context of the organization, including human behavior and cultural factors.

The process could be divided into seven main steps as follows:

Step 1 – RM objectives: In order to effectively identify risk, a company should first at least define strategic, operational, reporting, and compliance objectives. The purpose of establishing the scope, context, and criteria is to customize the RM process, enabling effective risk assessment and appropriate risk treatment. Scope, context, and criteria involve defining the scope of the process, and understanding the external and internal context.

Step 2 – Risk identification: Recognize and describe risks that might affect the project or its outcomes. What is the extent of risk faced? What are the available options? How large, and how immediate are the outcomes resulting from the impact of risk? Can the risk be controlled, reversed, or avoided? How do individuals and groups conceptualize risk? What aspects of the problem seem most relevant?

Step 3 – Risk analysis: Once risks are identified, they should be quantified or at least estimated in terms of likelihood and severity (damages). Develop an understanding of the nature of the risk and of its potential to affect project goals and objectives.

Step 4 – Risk evaluation: Evaluate and/or rank the risk by determining the risk magnitude, which is the combination of likelihood and consequence (being the simplest model). You make decisions about whether the risk is acceptable or whether it is serious enough to warrant treatment. Companies must first prioritize risks to identify and limit them and then further prioritize and address the rest of the risks based on the needs of the organization.

Step 5 – Risk treatment: Selecting the most appropriate risk treatment option(s) involves balancing the potential benefits derived in relation to the achievement of the objectives against costs, effort, or disadvantages of implementation. During this step, assess the highest ranked risks and set out a plan to treat or modify these risks to achieve acceptable risk levels. How can the probability of the negative risks be minimized, as well as the opportunities that go hand in hand with those risks be enhanced? Create risk mitigation strategies, preventive plans, and contingency plans in this step.

Step 6 – Monitor and Review the risk: The purpose of monitoring and review is to assure and improve the quality and effectiveness of process design, implementation, and outcomes. Ongoing monitoring and periodic review of the RM process and its outcomes should be a planned part of the RM process, with responsibilities clearly defined.

Monitoring and review should take place in all stages of the process. Monitoring and review includes planning, gathering and analyzing information, recording results, and providing feedback. The results of monitoring and review should be incorporated throughout the organization’s performance management, measurement, and reporting activities.

Step 7– Recording and reporting: The RM process and its outcomes should be documented and reported through appropriate mechanisms.

To create effective RM, appropriate controls or countermeasures to measure each risk must be selected. Risk mitigation needs to be approved by the appropriate level of management. For example, a risk concerning the image of the organization should have top management decisions behind it. If it is a technical issue, for example, a fire safety device, the risk could be mitigated by acquiring the adequate equipment depending on the fire department or engineering facilities.

A further element is that risk should not be intended as a static, but as a dynamic concept. Changes in risk may derive from updates in the system or in the procedures adopted, in the facilities, and in the training of workers. Moreover, new knowledge or new awareness may become available, for example, due to scientific research or due to lessons learnt from past events, leading to the identification of new risks that need to be controlled. Thus, the above procedure needs to be repeated in time, periodically updating the risks to be controlled and the RM system.

RM should propose applicable and effective safety and security controls for managing the risks. It should contain a schedule for control implementation and responsible persons for those actions.

Therefore, the last rule or step would be to use the Japanese Kaizen approach [5]: measure the effects of y...

Table of contents

• Cover
• Title Page
• Copyright
• Preface
• Contents
• 1 Introduction to risk management (RM)
• 2 The need for engineering risk management (ERM) education
• 3 Education profiles for ERM
• 4 Learning characteristics and outcomes
• 5 Example of safety or ERM education programs, courses and contents
• 6 Conclusions and perspectives
• Acronyms
• Index