HSE Professionals Series

3.) Risk Management (Part III).

Mohamed Shalaby
Risk Management Techniques
As discussed in Risk Management (Part II) that there are many
techniques to Assess the Risk; below guideline for common ones and
applicability over lifecycle of both project and operations phases.
Lifecycle
Identify Project Project Operate &
Techniques Modification Decommissioning
Scope Preparation Execution Monitor

HAZOP X M M M M S
HAZID M S X X S S
WHAT IF S M M M M M
Check List S M M M M M
Audit M M M M M M

Key: M Most Suitable , S Suitable, X Not Suitable

Risk Management Techniques
As discussed in Risk Management (Part II) that there are many
techniques to Assess the Risk; below guideline for common ones and
applicability over lifecycle of both project and operations phases.
Lifecycle
Identify Projection Project Operate &
Techniques Modification Decommissioning
Scope Definition Execution Monitor

FMEA S M M M M M
JSA X M M M M M
BOW TIE S S M M M M
Key: M Most Suitable , S Suitable, X Not Suitable
Risk Management Techniques
Probability and Impact Matrix.

Old favorite one is the probability and

impact matrix. It might be known this
by a different name, but you have
come across it before.

At its simplest, it’s a grid with

probability on one side and impact on
the other. You rate each risk against a
standard scale (commonly 1-5). Then
you plot the risk on the matrix.
Probability and Impact Matrix
This is a very simple tool, but it allows
you to track risks over time. You can add
arrows to the chart to show the direction
of movement for each risk, noting those
that are increasing in probability and
impact.

This is a good tool to use for

communicating with senior stakeholders
– in Group meetings, for example.
 Probability and Impact Matrix

To ensure proper Risk Assessment, below is the sequence of the

main process:
3. RA process include:
A. Task Identification
B. Identify the hazards.
2. Site C. Evaluation of the risk.
1. Forming RA team.
visit. D. Clarify additional Control Measures.
E. Assign action party.
F. Approve RA.
G. Document RA.
Probability and Impact Matrix
1. Forming Risk Assessment team.
Selecting the right team with the right knowledge and experience is
vital for risk assessment. The team of risk assessment shall include at
least:
 Team Leader (preferred to be Area Authority).
 Task supervisor (team member).
 HSE personnel (team member).
Forming the team may require involvement of workers' representative
to ensure proper involvement of workers in risk assessment.
It also might require –if necessary- the involvement of an expert in the
work being assessed to ensure proper covering of all work aspect with
avoiding the tunnel vision.
Probability and Impact Matrix
RA Team Leader is the focal point to manage RA process as
below:
 Lead the team in performing the Risk Assessment.
 Take responsibility for maintaining the quality of the RA.
 Ensure that all members of the RA team have a full opportunity
to contribute and that the details of the assessment are agreed
by all team members.
 Ensure all required documentation is present e.g. equipment
manufacturer manual.
 Ensure sufficient time is allocated to allow rational decisions to
be reached.
 Ensure each team member agrees that the risks have been
reduced to ALARP and the overall risk ranking before submitting
for approval.
What else?
Probability and Impact Matrix
2. Site Visit
 It’s important to conduct site to ensure full understanding of
the site, equipment and processes where the work will be being
done.
 Site visit will highly help in identify any additional hazard that
related to work location or even the employees who will
perform the task.
 Site visit shall have sufficient time to ensure RA team have an
overview that help them to conduct proper and effective RA.
 Through site visit there are many factors shall considered as
layout, integrity condition, SIMOPS, materials and equipment
and associated hazard. Etc. (think about other factors)
Probability and Impact Matrix
3. RA process:
A. Task Identification
 A good approach for a successful RA is to divide the whole
job into small tasks.
 Conduct the risk assessment for each individual task.
B. Identify the hazards
 Hazard identification is a vital part for proper RA.
 There are many sources of hazards (like chemical, physical
electrical, mechanical.…etc.) thus, RA team shall consider
it.
 RA team shall list all hazard identified associated to the
tasks.
Probability and Impact Matrix
C. Evaluate the Risk.
RISK = Severity * Probability
Possible effect.
 For each hazard, RA team identify the effect of worst credible
possible outcome (based on many factors including theory
experience, historical data, complains, prosecutions…etc.).
 This will be used in evaluating the initial and residual risk
ranking.
One hazard may have multiple effects on people, assets and
environment.
Existing control measures.
RA team to clarify existing control measures (identified through
site visit) in place for each hazard which can control/mitigate it.
Probability and Impact Matrix
Initial Risk Ranking
 After identifying each hazard, stating its effect and identifying
the control measures in place, RA team then starts to rank the
risk initially using the risk matrix (considering existing control
measures).
 Risk ranking is a combination of both hazard effect (severity) and
probability of occurrence (likelihood).
 Note: To decide the probability, RA team shall use company
historical data and background about this hazard across the
whole industry and other industries as well.
 After risk ranking, the risk will fall in one of the following
categories, Low, Medium and High.
This will give the team a view on the needs & importance of
additional control measures against each hazard.
Probability and Impact Matrix
RISK MATRIX
A risk matrix is a matrix that is used during risk assessment to define the
level of risk by considering the category of probability or likelihood
against the category of consequence severity. This is a simple mechanism
to increase visibility of risks and assist management decision making

RISK = Severity * Probability

Probability and Impact Matrix
RISK MATRIX
A risk matrix customized according to company context and
management decision; some company use 3 by 3 Matrix, other
companies use 5 by 5 Matrix.

3 by 3 means: 3 grades for probability and 3 for severity, and so on

for 5 by 5.

Companies consider many factors to decide which type they will

use; like company profile, manpower size, type of activity, hazard
associated to work...etc.
In all cases RA Matrix must be approved by organization TOP
MANAGEMENT for implementation
Probability and Impact Matrix
Probability: is the likelihood of an event occurring.
The likelihood can be expressed in both a qualitative and
quantitative manner.
When discussing probability in a qualitative manner, terms such as
frequent, possible, rare etc. are used.
It is also possible to describe the probability in a numerical manner.
This can be done using scores, percentages and frequencies defined
by the organizations dependent on the relative description.
Probability grades normally vary from Rare (unlikely to occur) to
Common (high probability).
Probability and Impact Matrix
Probability
Table show an example on how an organization can define the
ranking for the likelihood of risks. The table shows the ranking in
both a relative and numerical manner and a description of the
ranking is given.
Probability Scale

Likelihood
Description
Relative Numerical

Very Low ≥1 time in same field of work Highly unlikely to occur.

Low ≥1 time in similar organization Will most likely not occur

Moderate 1/year inside organization Possible to occur

High ≤ 3 times/year inside organization Likely to occur

Very High > 3 times/year inside organization Highly likely to occur

Probability and Impact Matrix
Severity: the most likely consequence/effect of a
particular hazard occurrence.
 These consequences can be defined in both a qualitative and
quantitative manner.
 These consequences could have effects on health, safety ,
environmental, cost, schedule, quality, scope, etc. which called
“objective”.
 Dependent on the objective, the scales are given a description of
what the impact entails .
 One risk event can affect more than one objective.
 The Impact scale can vary, but the most common scale is the
five-point scale.
Probability and Impact Matrix
Severity
Table show an example on how an organization can define the
ranking for the severity of hazard. The table shows the ranking in
both a relative and numerical manner and a description of the
ranking is given.
Severity Scale
Objective Minor (1) Low (2) Moderate (3) Critical (4) Catastrophic (5)
First Aid, Medical Restricted Work Permanent
People Treatment Injury
Lost Time Injury
treatment/Disability
Fatality

Noticed Localized
Slight Impact Major Impact Extensive Impact
Environment (spill <1 bbl.)
Impact Impact
Spill <50 bbl. Spill ≥100 bbl.
spill <5 bbl. Spill <10 bbl.

In addition Occupational illness shall be considered according to

scope of work of the organization.
How to Use the Risk Assessment Matrix
The risk Values are determined by multiplying the scores for the
Probability and Severity values together.
The higher the risk assessment, the greater the overall risk for the
project.
This method helps balance the weight of severity and probability.
Additional Control Measures
 Determine the Additional Controls Required
• Based on the concept of ALARP “AS LOW AS REASONABLY
PRACTICAL” and after initial risk ranking; if the Risk Rank
exceed certain value (as per company Risk profile) additional
control measure shall be considered.
• There are two types of control measures that will be identified:
• Prerequisite: are those which must be in place prior to start.
• Supplementary: are those which have to be applied during
job.
• RA team decide additional control measures based on their
level of authority and they can’t write actions beyond
their authority or something can’t actually implemented.
• Selecting additional control measures shall be based on
General Hierarchy of control measures (ERICPD).
Allocating Responsibilities for Actions
Once the additional control measures have been identified,
each control should be allocated to, where possible, both a
position and a person.

Residual Risk Ranking

 Same concept as described before in “Initial risk ranking”, RA
team re-evaluate the risk again with considering the additional
control measures.
 If the residual risk falls in the critical zone, the risk is not
acceptable and the work shall not start.
Residual Risk Ranking
If Residual Risk Rank in moderate area:
 Further safeguards or controls are required which can be
practically implemented.
 Have all necessary control measures been fully and
effectively identified.
 Is there a need for engineering change to eliminate or reduce
risk.
 Is there a need to shut down the plant or process (Removal
from Service).
Only at this point can the team judges whether they reached
the ALARP for residual risk or not.
RA Approval
 After do risk assessment for whole job, RA team member will
sign the Risk Assessment.
 Second level of approvals is concerned department Manager to
ensure that Risk Rank value in safe zone to start work.
 For tasks where residual risk still in critical zone; line managers
carry out complete evaluation for the job to decide
alternatives or other resources which might reduce the risk.
Document RA
 Record of Risk Assessment should be retained for a period
as per document control system of the organization
(usually 1 year) for future reference, internal audit and
external audit.
 Where a Risk Assessment is being re-used, it must be fully
reviewed by the New Team to ensure it is relevant to the
New Task
Keep Safe for you family
Thanks