Application (and Misapplication) of Risk in Legislation and Practice Dr Edward Lewis

How many of you work in the safety area? Me and You UNSW Canberra since 1986 (School of Engineering and IT ) 30+ consultancy projects in risk management Deputy Chair Risk Engineering Society, ACT EA’s rep on Standards Australia Committee OB007 Risk management, IT12 IT Security, MB025 Security, “Expert” on IEC TC56 Dependability Research into risk management theory and techniques How many of you work in the safety area? Who has carried out a safety-related risk management activity? What are you here to hear?

Overview In 30 minutes, all I can do is to point to Better practices for managing safety-related risks in the form of Standards and their supporting Handbooks produced by Standards Australia and available from SAI Global (sooner or later) That can Defend you from accusations of non-compliance with the law Attack unsafe behaviour

Application of risk management (standards) in construction Standards provide guidance to ‘best’ (better) practice There are 1369 products on SAI Global product list mentioning risk In particular, for us … AS/NZS ISO 31000: 2009 IEC 62198: 2013 Project risk management – application guidelines AS/NZS ISO 27000+ IT security AS/NZS 5050:2010 Business continuity – managing disruption-related risk AS/NZS ISO 19600 Compliance management systems – Guidelines and for safety of machinery, concrete structures, explosive atmospheres…. Handbooks expanding (or explaining) the Standards HB436 Companion to ISO31000 HB 89: 2012 Risk management – Guidance on risk assessment techniques HB 141: 2011 Risk financing guidelines HB 327: 2010 Communicating and consulting about risk Or applying the standards HB 167: 2006 Security risk management HB 205: 2004 OHS Risk management Handbook (under revision)

The (familiar?) process for Risk Management (AS/NZS ISO/IEC 31000: 2009)

Misapplication in Practice: Wrong responsibilities Risk managers (or safety managers or project managers) are seen as the ‘whipping boy’ but “Risk is everyone’s business” Seen as something ‘special’ But from 31000: Principle b: integral part of organizational process Principle c: part of decision making So actually, risk management is decision-making (or rather, problem solving) Risk management process should be the problem-solving process

Misapplication in practice: Documentation not thinking Require What is wanted . please everybody Who – people Way – procedures With – equipment Where – location When – timing Worth – funds Handbook 470: Making Decisions with Risk … work in progresss Realize What could happened: . Anticipate drivers . Anticipate consequences Respond What should be done: . Couple for effect best for consequence . Fix up gaps . Lessen use of resources www.safetyrisk.net/toaster-is-hot

Misapplication in practice: PIGs Often used Easily understood Wrongly used Wrong results Especially here, in safety-related risk No such thing as ‘acceptable’ levels of risk

Misapplication in practice: Risk registers Often used Easily understood Wrongly used Wrong results (as for PIGs) Flat list – no multiple causes/ multiple consequences Checklists rather than thinking No evaluation of controls (then and now)

So far as is reasonably practicable: . Ensure safety and health Better Application in Practice: Guideline for use of 31000 to Safety in Australia - HB205 Handbook 205 is being rewritten now. Intended to: … to provide guidance in the application of AS/NZS ISO 31000:2009 (‘the Standard’) to managing “safety-related risk” effectively, and thereby contribute to the health and safety of workers and others. Intended to assist in interpreting the Work Health and Safety Acts So far as is reasonably practicable: . Ensure safety and health Disproportionate cost: . undefined in legislation but should be the basis for risk evaluation?

Better Application: An improved Process for Safety-related Risk (from Defence Aviation)

Better Application in practice: showing levels of risk Three point estimate of the extent of consequences, given conditions Show multiple causes down the chain Show multiple consequences up the chain

to achieve your objectives whilst ensuring everyone is safe Next … What follows are a series of presentations about Managing Safety Risks in Construction ACT Work place Health and Safety Legislation Legal Aspects facing construction practitioners Risk to Safety because of inadequate fire services With a case study to amplify their points They will all bring out examples of the application and misapplication of risk management but Just remember that there are best practice standards that can help you … Not only to comply with the law but more importantly to achieve your objectives whilst ensuring everyone is safe