Transcript
INSTRUCTOR
We have now looked individually at how actions and controls treat or mitigate risk. However, this is not the complete picture. To effectively mitigate risk, both actions and controls must be used together systematically to achieve the best outcome for an organisation.
To explain this, let's look again at the probability impact diagram, PID. As previously discussed, every risk has a place or risk level on the PID, which is a combination of its probability of occurring and its impact to the organisation. If we assess that we need to treat the risk, we can take an action that will reduce the impact of the risk, or we can take an action, which will reduce the probability of the risk.
In either case, we arrive at a new risk level that is either a low probability of the risk occurring or a lower impact if the risk should occur. We may choose to take both actions or have an action that reduces both probability and impact. In such cases, we will need to understand where the new risk level is for the combined actions.
At this stage, let's keep this simple and remember that any action gives us a new risk level. However, over time, the new risk level can erode. Changes made by the action can be reversed. And the risk level can ultimately drift back to its original position.
It is at this point where controls come into play. Controls are the repeatable activities that ensure that actions that have been implemented are sustained. Controls prevent the reversal of good practise by preventing organisations from deviating from solutions that they have created to prevent unwanted risk from occurring or reoccurring.
Let's use a real life example to illustrate this. Consider the risk of fire in your work environment, whether it be an office, shop, factory, or other location. There'll be a gross and current assessment of the risk of fire where you work. If you work in a location that holds stock or inventory, these items may alter the assessment of the fire risk.
Large quantities of certain materials will support the rapid spread of a fire with the potential to increase the overall size of the fire and the impact of that fire. The loss of large quantities of inventory in a fire could also have a cash impact on the business, especially if not all of the stock was covered by an insurance claim. A company might then, in an attempt to reduce its fire risk, set stock levels and work down access until it had reached those targets.
Alternatively, a workplace may use flammable materials in various locations. These materials will support a source of ignition that otherwise would not result in a fire. To reduce likelihood of flammable materials coming into contact with a source of ignition, the workplace management undertake, an action to review all flammable materials to see if alternatives can be used. In doing so and removing some flammable materials, the probability of fire is reduced. Both of our actions will result in a new risk level but without any controls.
If no one is monitoring the stock levels to check if they are in line with what was agreed, then these levels may increase. For example, if a large order is won, holding more stock may be one way the company chooses to meet demand. Similarly, if no one is checking the materials used in the processes, it is possible that new flammable materials are brought into the workplace, perhaps because the new materials are not achieving the desired results or insufficient design of the process has taken place.
In either case, the risk could move from what the planned actions had achieved to a new risk level, and importantly, often without the company's awareness that this has taken place. However, with controls, this situation is avoided. A stock control process, which flags when the stock levels are likely to exceed, set limits, and provide some efforts to get back in control will stop stock from exceeding set levels.
An approval-and-change process for all processes or activities carried out in the workplace controls what flammables are allowed in the workplace and defines how these are managed. We should maintain a probability of ammunition source and the flammable coming into contact and the desired level for the workplace. Hence, actions are necessary to reach the desired level of risk. But controls are equally important in ensuring that the risk remains at that set level.