Microsoft Word - 6laurent.docx CHEMICAL ENGINEERING TRANSACTIONS VOL. 36, 2014 A publication of The Italian Association of Chemical Engineering www.aidic.it/cet Guest Editors: Valerio Cozzani, Eddy de Rademaeker Copyright © 2014, AIDIC Servizi S.r.l., ISBN 978-88-95608-27-3; ISSN 2283-9216 Safety Risk Registers: Challenges and Guidance Nora Balfe*a, M. Chiara Levaa, Brian McAleerb, Michael Rockeb aCentre for Innovative Human Systems, Trinity College Dublin, Dublin 2, Ireland bESB, 27 Lower Fizwilliam St, Dublin 2, Ireland balfen@tcd.ie A risk database, or risk register, is a central tool for organisations to use to monitor and reduce risks, both those identified during initial safety assessments and those emerging during operations (Whipple and Pitblado, 2010). The risk register should contain all analysed risks and should prioritise the areas that require managerial attention. When populated with information on each risk, including risk ranking, the risk register can be analysed to present the risk profile for different aspects of the organisation (Filippin and Dreher, 2004). When reviewed and updated over time, it can also be analysed to present trends within the risk profile and focus management attention on the highest risk activities or facilities (Whipple and Pitblado, 2010). In order to successfully develop a risk registry that provides an accurate level of risk within a process, there is a requirement for real time data on risk to be input into a risk registry. Despite their place at the heart of safety management, there is relatively little guidance and research on how to construct, maintain and use a risk register. The challenges and ideas in this paper were developed during the initial phase of a case study to develop a single central risk register for an energy generation company. The case study used workshops with key stakeholders from the company to work through the issues faced in developing a single integrated risk register. Challenges faced ranged from ensuring employees contributing to the risk register had a basic understanding of risk concepts, through identification and scope of hazards to be included, to data collection and automatic population of the risk register. The challenges encountered during this project are believed to be those that many companies face, and therefore the resolutions proposed and adopted for this case study will be presented here as guidance for the implementation and management of risk registries in safety management systems. 1. Introduction Electricity generation is an inherently high energy, multiple hazard industry which can potentially be harmful to life, health, assets, and the environment. The presence of this stored energy or hazardous substances, which when released can cause damage, can take many forms including, chemical, mechanical, thermal, electrical, etc. Process safety is concerned with preventing harm to people, the environment and the plant from this uncontrolled release of energy / hazardous substances through a combination of good engineering design / practises, asset and integrity management, and through good operation and maintenance practises (Hopkins, 2009). The ESB in Ireland operates a number of electricity generation stations and has an on-going programme composed of a multiple of projects to improve process safety. In order to maintain safe operations, organisations must continuously review and monitor their risks. This means that the results of safety studies must be translated into a format that can be analysed, reviewed and acted upon, and new data about the level of risk continuously collected to keep the safety information up to date. A risk database, or risk register, is a central tool for organisations to use to monitor and reduce risks, both those identified during initial safety assessments and those emerging during operations (Whipple and Pitblado, 2010). The risk register should contain all analysed risks and should prioritise the areas that require managerial attention and typically contains information describing each risk, an assessment of the likelihood and consequences, a ranking according to a risk matrix, the risk owner, and information on the mitigations to be put in place (Filippin and Dreher, 2004). When populated with information on each risk, including risk ranking, the risk register can analysed to present the risk profile for DOI: 10.3303/CET1436096 Please cite this article as: Balfe N., Leva M.C., McAleer B., Rocke M., 2014, Safety risk registers: challenges and guidance, Chemical Engineering Transactions, 36, 571-576 DOI: 10.3303/CET1436096 571 different aspects of the organisation (Filippin and Dreher, 2004). When reviewed and updated over time, it can also be analysed to present trends within the risk profile and focus management attention on the highest risk activities or facilities (Whipple and Pitblado, 2010). In order to successfully develop a risk registry that provides an accurate level of risk within a process, there is a requirement for real time data on risk to be input into a risk registry. Risk registers are used in a variety of industries, e.g. medicine (Brown, 2004) and construction (Dunović, Radujković and Vukomanović, 2013), as well as high hazard industries such as oil and gas (Hasle et al., 2009) and electricity generation (Leonard, 1995). They are typically used either to support safe operations or to support safe and efficient project management (e.g. De Zoysa and Russell, 2003). Cooke-Davies (2002) found that the adequacy with which a visible risk register was maintained was one of the key success factors for project management. Patterson and Neailey (2002) highlight the importance of the risk register and suggest that the benefit of a risk register is as a method to enable all stakeholders to “consciously evaluate and manage the risks as part of a decision making process” (pp. 365). They also note the importance of the risk register in documenting the process of reducing risk and introducing mitigations. However, Kutsch and Hall (2010) warn of the danger of risk registers becoming ‘tick-box’ exercises when the owners and contributors do not have a real ability to influence the risks – the danger of irrelevance. Despite the clear importance of risk registers in the risk management process, there is very little guidance on their development and implementation (Dunović et al., 2013) and previous research has found that although 67% of companies use some form of risk register, the majority have developed their own format to host it (Patterson and Neailey, 2002). This paper attempts to address the gap in guidance on construction of risk registers by outlining some of the challenges and giving guidance on the development of safety risk registers. The guidance was developed through a case study development of a risk register for the generation section of an electricity supply company in Ireland. The aim of the case study was to build a single central risk register on existing risk management systems in place in the organisation, including the asset management investment process, Critical Asset Register (CAR) and risk matrix, and the quarterly business risks reports as well as any existing risk assessment processes. These reports/matrix provide an update of the risk levels within the business at a particular moment of time but do not dynamically taking account of short term emerging risks i.e. weather extremes, equipment type faults, internal or external incident investigations, etc. It is critical for a risk management that all potential hazards have been identified and assessed, that adequate control measures are put in place and that control measures remain effective in management of that risk. The objectives of the project were: • To develop a risk register data structure supporting consistent hazard identification and risk rating across different sites; • To develop equivalent severity scales for different loss types; • To develop a single frequency scale for application across the business; • To facilitate automatic population of the risk register from suitable existing inputs. During the initial phase of this case study, six major challenges emerged and these are discussed in this paper. The case study used a series of workshops with key stakeholders to define a vision for the risk register and work together to solve the challenges posed. Participants in the workshops represented individual generation stations from a safety, technical and financial point of view as well as corporate specialists in risk management, environmental, occupational, and process safety. The inclusion of this wide-ranging expertise is suggested as the first recommendation from this work. The remaining recommendations are generated on the basis of the challenges discussed in the following sections. 2. Challenges 2.1 Challenge 1: Understanding risk and hazard concepts The first challenge is to ensure a basic common understanding of the risk and hazard concepts underpinning the risk register. The on-going management of safety issues involves a wide range of company personnel, including operational, maintenance, financial, and human resources. It cannot be taken for granted that this diverse group will all have a similar understanding of the terms ‘hazard’ and ‘risk’. Even staff working regularly in the safety sphere can sometimes become confused between the terms, as they are essentially interchangeable to non-specialists. Dunović et al. (2013) found that the terminology employed in risk management is not always clear and it can be difficult for stakeholders to correctly consider risk. The easiest way to address this is to begin the work on the risk register with a brief training/revision session on basic risk concepts. In this case study, a short quiz was used in which the 572 attendees were asked to differentiate between hazards, risks, and consequences for a number of examples. Examples from every day life (e.g. differentiating between smoking as a hazard, probability of developing lung cancer as a risk, and lung cancer as a consequence) and the work domain were used (e.g. hazards of working at height and risk of falling). The quiz session finished with the definitions of hazard and risk in order to ensure clarity among the attendees. Since the risk register is an on-going process, the training (in whatever form) should be made available for new staff working in the area to ensure that the definitions and understanding continue to be consistent. 2.2 Challenge 2: Individual perspectives and corporate perspective on the risk register Risks may have different consequences depending on the viewpoint of an individual/group. For example, in the energy industry, a transformer failure would have high consequences for an individual generation station as they cannot export the electricity generated. However, it is not necessarily an issue for the business as they may be able to compensate with another station, and can even be a benefit to those other stations that will receive a higher payment for exporting more electricity. These different perspectives must be reconciled on the risk register, so it is important to identify which perspective is ‘correct’ for the risk rating. Another issue with individual perspectives is honest reporting. If funding and investment is tied to an evaluation of risk, then individual plants will have an incentive to exaggerate risks in order to secure budget for investment. Last but not least from a corporate point of view it would be highly relevant to see risk being reported in relation to the business unit strategy and specifically its top objectives: “How are the risks recorded in the risk register undermining the capacity of the unit to achieve those objectives (e.g.: regulations related uncertainty, human assets uncertainty, performance targets, etc.). Reporting will be much more meaningful if performed against objectives, and it will also have the capacity to establish a link between health and safety/technical risk and performance. The link with objectives and their KPIs presented in the business plan for each unit is therefore key to achieving this level of meaning and the risk register should identify the items that have the potential to undermine the achievement of the objectives. Those risks are normally reported at very high level but they have very seldom the capacity to be connected straight through the chain to the very base of the organisation where the real data able to substantiate them lies. At the other end, the top down process can provide a sanity check on all the risks received from bottom up processes. Three approaches are proposed to assist in the area of reconciling individual and corporate perspectives; 1. The development of a data structure (see Figure 1) for the risk register able to establish a clear link between the risk being reported and the main area of the business unit they relate to (if possible, also the link with the KPI they potentially impact). Figure 1: Proposed data structure for the rooting of the Risk Register 2. Establish and link a consistent risk matrix or risk rating method with strong supporting guidance to encourage consistency in the ranking of risks from different parts of the business. 3. The involvement of specialists who have visibility across the company in reviewing the risks entered on the risk register. These specialists can bring their knowledge and oversight of different areas to the review process and ensure that risks are treated consistently and not exaggerated. 2.3 Challenge 3: Loss Framework One of the central functions of the risk register is to help judge where money should be invested. If this decision is based only on business, then the larger plants would receive a huge share of the available 573 funds. However, it may also be important for safety and environmental reasons that the smaller plants are also maintained. Therefore, the losses covered by the risk register should go beyond financial. It order to maintain consistency (in support of Challenge 2), equivalent scales should be developed for each loss type so that the consequence ratings in each loss category are broadly equivalent. Separate scales were developed for this project covering safety, environment, financial, technical performance, and reputation and the initial scales for each are show in Table 1. Where possible, these scales align with existing scales used within the company. Table 1: Proposed Loss Categories Safety Environment Financial Technical Performance Reputational 1 Minor injury Minor impact <€1m €10k repair <24h outage Informal/local complaint 2 1-2 day lost time injury Moderate (short) impact >€1m €75k repair <1wk outage Formal complaint to company 3 Serious injury Significant impact; minor license breach >€5m €100k repair >24h shutdown Local media coverage / Formal complaint from regulator 4 1 fatality, or multiple health effects or permanent incapacity Significant, long-term impact; temporary shutdown >€20m €1m repair >1wk shutdown National coverage / Formal inspection 5 Multiple fatalities Major, permanent damage, long term shutdown >€100m €50m repair >1wk shutdown International coverage It should be possible to continue to develop these scales and modify them in accordance with changing perceptions of risk or company priorities. Therefore the risk register must have the flexibility to modify the scales used to assess risk. It is also important to give clear guidance on each category to reduce subjectivity in the application of the scales. Table 2: Hazard Categories Category Examples Technical Specific hazards relating to equipment – e.g. turbine: mechanical integrity, vibration, aging, lubrication, pressure, etc.; boiler: piping, valves and drains, burner; structural integrity, etc. Process Hazards relating to the process, e.g. leaks, explosive or flammable materials, dust emissions, flooding, high/low pressure, high/low temperature, etc. Work Activities Hazardous activities, e.g. working at height, manual handling, working with vehicles, lone working, working near water, traffic management Work Environment Hazards relating to the physical plant, e.g. ground conditions (slips, trips and falls), sharp surfaces, hot/cold surfaces, noise, confined spaces, blocked fire escapes, etc. External All external hazards, including adverse weather conditions, natural hazards (e.g. seismic activity, lightening, radiation), external accidents (adjacent plants, aircraft), terrorism, 3rd party threats, etc. Behavioural Hazards resulting from individual (inappropriate) behaviours, e.g. intoxication, inappropriate use of tools, bullying and harassment, interference with safety mechanisms, peer pressure Organisational Hazards relating to poor support from the organisation or inappropriate organisational pressures, e.g. inadequate training, poor organisational change management, mismatch of work to capabilities, lack of fatigue management, medical unfitness, poor procedures, etc. Environmental Hazards relating to the environment, e.g. spills and leaks, environmental noise, hazardous emissions, etc. Financial Hazards relating to finance, e.g. staff costs, contractor costs, taxes, material availability, stock management Project Management Hazards relating to projects, e.g. human resource availability, plant performance, project performance, stakeholder management, lifecycle management, contractor management 574 2.4 Challenge 4: Hazard Framework When starting a risk register, the temptation can be to focus on technical hazards, such as failure of equipment, particularly if there is already a wealth of information on these within the organisation. However, the risk register should also monitor non-technical hazards in order to more fully represent potential risks and in this case the organisation had an objective for the project to capture the full risk profile for the business. The risk register should therefore cover all hazard types, including non-technical hazards such as organisational risk (including skills loss and industrial relations), operational risk (including routine workarounds), and occupational risk. The generation of hazards in all these areas can be daunting, and a framework is needed to structure the identification, classification, and documentation of hazards for entry in the risk register. In this case, ISO 17776 (2002) in combination with an analysis of the hazards and risks already captured within the company was used to provide a framework of hazards within the risk register. The initial framework is shown in Table 2. This will allow the company to systematically review each hazard category and identify known hazards for each. It also provides a classification system for new and emerging hazards after the initial development is complete. As with losses, it is important that the hazard categories can be updated and revised in order to ensure they continue to match the organisation and the situations encountered during operations. Further work is needed in this area in order to develop a structured application of this framework so that hazards can be thoroughly identified and managed throughout the business. This method will link hazards to specific assets within the business in order to take advantage of the existing data captured in asset management tools. The tangibility of assets is also likely to help stakeholders in considering and managing risks. However, this approach of using company specific assets means that it will not be possible to give generic guidance at this level as the output will be very specific to the company. 2.5 Challenge 5: Inputs and Automatic Updates All information from all possible sources cannot be represented on the risk register, as it would then contain too much information to be useful. It is important that the ‘minimal picture’ of items to appear on the risk register is understood and that it captures the priorities for the organisation. Once this is defined, the information that can be used to build the risk register is still likely to be spread across various different systems that may all have their own business purpose. This may make it difficult to identify, extract and maintain the data, particularly if the ability to modify the inputs is limited. In addition, each input may be held in a different format, for example bespoke IT systems, enterprise software, excel spreadsheets, word processing documents, intranet sites, etc. This can be technically challenging to integrate. This is the most challenging issue discussed thus far. The key is to strike the right balance between automaticity of data entry versus having the correct data entered in the correct format versus manual entry or modification of data. Automatic entry is desirable as it reduces re-work for managers and makes the most of the data already available in the organisation. However, it is likely that the data sources that the information can be extracted from were designed for a different primary purpose, for example to support asset management, and therefore the ability to modify the data sources may be limited. This means that the data collected automatically may not always be in the correct format or may be incomplete for the risk register and manual modifications may be required. This creates workload for staff, and unless the changes are beneficial to them, this may reduce uptake and effectiveness of the risk register. The recommendation for tackling this challenge is to carefully map the potential inputs and rate the ‘quality’ of the data that can be obtained from each. A gap analysis can be performed to identify which inputs would require investment to provide the required data for the risk register and a cost-benefit exercise can then be undertaken to determine whether it is feasible to modify the inputs. Minimising workload is extremely important to the success of the risk register. Any requirement for additional manual data entry or analysis will increase the probability that the data essential for the risk register will not be provided, or will be of poor quality and therefore reduce the benefit of the final risk register. Any manual data entry should be carefully designed to fit easily within current tasks and priorities for the affected staff, and to provide clear benefit to those staff. 3. Conclusions This paper has outlined five challenges encountered during the initially stages of constructing a risk register in an electricity generation organisation. The guidance is based on the approach taken during this case study to overcome each challenge and these are summarised here as a series of recommendations for the development of risk registers. These are summarised as: 1. Form a project team with a range of expertise and representing all the major stakeholders in the risk register; 575 2. Develop and distribute a training/revision course to ensure that all stakeholders are familiar with the concepts of hazard, risk and consequences; 3. Develop a clear data structure for the risk register to establish a clear link between the risk being reported and the main area of the business unit they relate to, and the relevant KPIs; 4. Develop a consistent rating scheme to ensure consistent rating of risks across the organisation; 5. Involve specialists in a review of the risk entered on the risk register to ensure consistency and to manage any potential conflicts between different areas of the business; 6. Create equivalent loss scales so that risks can be rated in the most applicable manner; 7. Create a framework of hazards to ensure that the risk register covers all types of hazards that may be relevant to the business; 8. Carefully analyse available information to ensure the right balance is struck between automatic data entry and manual data entry. Following these recommendations at the outset of a risk register project will maximise the potential success of the project. Acknowledgements This work forms part of the EU FP7 funded Marie Curie Actions Initial Training Networks project titled Innovation through Human Factors in Risk Analysis and Management (InnHF; see www.innhf.eu) and the EU FP7 funded project titled Total Safety Management for Critical Activities (TOSCA; see www.toscaproject.eu) References Brown, A.S. 2004. Finding the hidden risk with medical devices: A risk profile tool. Quality in Primary Care, 22, 2, 137-140. Cooke-Davies T., 2002. The “real” success factors on projects. International Journal of Project Management, 20, 185-190. De Zoysa S., Russell A.D., 2003. Structuring of risk information to assist in knowledge-based identification of the life cycle risks of civil engineering projects. Paper presented at the 5th Construction Speciality Conference of the Canadian Society for Civil Engineering, Moncton, Canada, 4-7 June, 2003, COF- 470-1 – 10. Dunović I.B., Radujković M., Vukomanović M., 2013. Risk register development and implementation for construction projects. Gradevinar, 65, 1, 23-35. Filippin K., Dreher L., 2004. Major hazard risk assessment for existing and new facilities. Process Safety Progress, 23, 4, 237 – 243. Hasle J.R., Kjellen U., Haugerud O., 2009. Decision on oil and gas exploration in an Arctic area: Case study from the Norwegian Barents Sea. Safety Science, 47, 832-842. Hopkins A., 2009. Thinking about process safety indicators. Safety Science, 47, 4, 460-465. ISO 17776, 2002. Petroleum and natural gas industries – Offshore production installations – Guidelines on tools and techniques for hazard identification and risk assessment. International Organisation for Standardisation: Geneva. Kutsch E. Hall M., 2010. Deliberate ignorance in project risk management. International Journal of Project Management, 28, 245-255. Leonard J.B., 1995. Assessing risk systematically. Risk Management, 42, 1, 12-17. Patterson F.D., Neailey K., 2002. A risk register database system to aid the management of project risk. International Journal of Project Management, 20, 365-374. Whipple T., Pitblado R., 2010. Applied risk-based process safety: A consolidated risk register and focus on risk communication. Process Safety Progress, 29, 1, 39-46. 576