5.1    Introducing the scope to the team
5.2    Reviewing the selected system
5.3    Identifying the hazards
5.4    Identifying the potential unwanted events
5.5    Analysing the risks
5.6    Evaluating the risk acceptability
5.7    Considering existing controls or barriers
5.8    Identifying new controls or barriers
5.9    Closing the risk assessment
5.10  Summary of the Risk Management Process for Common Situations
5.11  Generic 6-Stage Hazard Study Process

Most risk assessment projects will require some form of facilitated team exercise. Some risk assessments, or parts thereof, may involve work by individuals outside the team. For example, individuals may gather information on the system, hazards, probabilities or other areas that will be considered in the overall assessment.

Since the vast majority of projects involve team exercises this Section will focus on the quality of that approach and, specifically, the process of facilitating a team exercise.

The process of facilitating a Risk Assessment requires several important ingredients.

A facilitator is a person whose role in a risk assessment is to drive the risk assessment process, as outlined in this Section of the Guideline. He/she leads the team through a specific risk assessment method, focussing on the quality of the process. The facilitator does not provide technical input on the system, hazards, risks or controls. That is the role of the team. 

The facilitator may challenge or question the team by suggesting risk management principals or concepts in the process. For example, the team may not discuss a relevant type of hazard or underestimate the consequences of an event. In this type of situation the facilitator must suggest to the team that they revisit or rethink the issue. 

Facilitation is a skill and, as such, the more complex the risk assessment the more important the skill.

For example, to explore more information on various Facilitation Skills approaches try:

The facilitator is often directly involved in preparing the Scope with the client for the risk assessment. As previously outlined, this is a very important step.

Once the Team exercise has been scheduled, it remains for the facilitator to lead the session. An agenda for the session may include, depending on the specific risk assessment method, the following items.

This information should be presented to the team before the exercise commences.    

back to top

 The next step should involve a discussion about the system, project or topic being reviewed by the risk assessment process. The purpose of this step is to ensure that all team members have an adequate understanding of the system and the boundaries of the system before starting to identify hazards.

Depending on the Risk Identification tool and the exercise complexity this step may involve one or more of the following:

As previously mentioned, the quality of a risk assessment greatly depends on the recognition that:

The Scope may provide a Hazard Inventory Table to the team. This table would outline the hazard types and clarify any uncertainties about any specific hazard (see  Section 4.1.3 Identifying and understanding potential hazards). If available the facilitator should review the table to ensure that the team understand the type, nature and magnitude of the hazards that are to be considered when the system is reviewed.

If the Hazard Inventory Table is not supplied in the Scope, the facilitator should lead the team in a discussion identifying the types of hazards, their nature and magnitude. If any hazard is unclear that uncertainty must either be clarified or the facilitator must define the uncertainty and gather information from the team to document the assumptions made about the hazard. THIS IS A KEY ISSUE. Failure to clarify assumptions about the nature or magnitude of a hazard can lead to inadequate controls and the assumption of unacceptable risk.

In some cases it may be necessary to do Consequence Analysis before a Risk Assessment exercise so that the team is clear on the potential outcomes of an event.

The facilitator should ensure that the team members understand the types of hazards being considered in the exercise before proceeding.

back to top

Sometimes analysing risk is not part of the exercise. For example, Job Safety or Hazard Analysis, and HAZOP, do not usually involve formal Risk Analysis. In JSA and HAZOP, unwanted events are identified and then controls or barriers are discussed. If this applies the facilitator should skip the next two sections.

In most cases some form of Risk Analysis is applied, whether it be qualitative, semi-quantitative or quantitative. The Facilitator and the team should know the method of analysing risk before starting this step from the Introduction at the beginning of the exercise.

The selection of the Risk Analysis method should have been part of the Scoping process (see Section 4.1.5 Selecting the risk analysis method - the means of calculating and examining the level of risk).

It is important with some methods to identify whether the Risk Analysis is done considering existing controls or barriers. For example, is the likelihood and consequences of an electrical contact while using a hand tool to be estimated considering that there is a current well established, procedure to inspect the tool before use, or should the risk be estimated considering the event without the procedure?

Like many areas of Risk Management there is no set answer to this question. It is determined by the design or Scope of the project, considering the Objective and the degree to which the team will be comfortable with the method. 

However, the following basic examples may help clarify the issue:

The selected Risk Analysis method for the team exercise may indicate risk acceptability levels as part of design. Often Risk Analysis methods are included corporate procedures for Risk Management or Risk Assessment. Therefore, the facilitator should know the relevant risk acceptability criteria before the exercise and, subsequently, ensure that the team understands the information.

In qualitative and semi-quantitative Risk Analysis methods the intent usually involves ordering the unwanted events by level of risk. Acceptability criteria may be illustrated in the method by a "green" or specific low risk rank level. In this case the acceptability criteria simply identify the lowest priority risks. Normally, qualitative and semi-qualitative methods are not used to determine acceptability but rather to focus discussion on higher priority risks. There are, of course, exceptions for some specific methods such as in Control Rating Code method, applied to increase the accuracy of the Risk Analysis.

If a quantitative technique has been applied, there may be defined acceptability criteria such as a probability. For example, the figure, .00001 fatalities per year (as discussed in Section 4.1.5.2), is considered to be an acceptable fatality rate for workplace risks.

The facilitator will often lead the discussion on acceptability as part of the previous risk analysis step. Whatever the case, the facilitator must try to ensure that no unwanted event, with or without controls, is unacceptably deemed to be an acceptable risk therefore not requiring improved controls. THIS IS A KEY ISSUE.

Existing controls may have been identified before or after the Risk Analysis method was applied, as previously discussed.

Independent of the timing or the specific Risk Identification tool, the facilitator should help the team identify existing controls. To prompt the teams' generation of existing controls that facilitator might use the Hierarchy of Controls list. Note that effectiveness decreases from top to bottom of the list. 

It is sometimes easiest for the facilitator to start the discussion of controls by referring to the highest risk event and proceeding down the list to the lowest risk or the predefined acceptability criteria. This focuses the teams' energy on the highest risks and also controls for higher risks often affect moderate risk events too.

Deciding whether controls are adequate for the risk level can often be subjective even when attempting to apply quantitative risk analysis techniques. 

To determine whether controls are adequate the facilitator should consider the following options. THIS IS A KEY ISSUE.

If an unacceptable risk remains after existing controls are considered, the facilitator should lead the team through a discussion of possible new controls or barriers to reduce the risk further.

Again the Hierarchy of Control and the 3 adequacy considerations listed above should be considered.

This guideline offers a brief overview of Risk/Cost Benefit Analysis. Risk/Cost Benefit Analysis can be used to select the best controls from suggested options. It may or may not be part of the Scope.

Minimally, the facilitator should ensure that all unacceptable risks are addressed with existing or new controls until the residual risk is considered to be acceptable.

back to top

5.9 Closing the risk assessment

The final step in the exercise requires the facilitator to close the exercise by checking that the Scope has been fulfilled, expressing appreciation for the contribution of the team, and communicating the expected future actions from the Scope to the team.

Note that the facilitator may also be responsible for documentation of the Risk Assessment exercise.

back to top

Figure 5.1: Hazard management process steps

Existing Operations The intent of the Guideline is that all existing operations should conduct initial detailed hazard studies and then conduct hazard study reviews on a five-year cycle. In some countries this is a legislative requirement. 

Some sites may never have undertaken any form of hazard study review. For these, the high-level facility review should be a priority. This will allow them to set priorities for further detailed studies in a way that does not overly stretch resources. For newer sites that have had comprehensive studies applied during the design process, the cyclic review process need only be applied.

Changes to Existing Operations
Change management should be a central component of any site health and safety management system. The intent is to ensure that well meant changes - whether temporary, permanent or of an emergency nature - do not have adverse impacts on the integrity of the operation or its protection and prevention systems. Changes to be controlled include mine planning, mining methods, management structures, operating procedures and labour arrangements - in short, any change that could impact on health and safety.

New Projects
For new projects, including expansions to existing operations, formal hazard studies applied throughout the project life are proven and widely accepted ways of maximising inherent safety and minimising risk. Additional benefits include reduced commissioning time, increased operational availability and fewer plant outages.

Acquisitions & Divestments
For acquisitions, the intent of the Guideline is to ensure that there is an appropriate level of health, safety and environment assessment before the final decision is made to purchase. The objective is to ensure that the company does not purchase unknown problems. The results may be used to influence the decision to acquire, to influence the purchase price, or ensure appropriate allowance for remedial works post-purchase.

A similar intent implies to divestments. In many countries, responsibility for environmental clean up does not pass to the purchaser. Similarly, responsibility for poorly designed operations may stay with the previous owner. Appropriate hazard studies and investigations prior to selling an asset can help the company manage exposure and provide a level of assurance for prospective purchasers.

Table 5.2 - Step 1 Establish The Framework

Select Methodology The methodology chosen should be appropriate to the risk level associated with the plant or facility. The hazard study leader should be instrumental in choosing or vetting the methodology. Higher risk facilities should have rigorous team based methods applied, such as HAZOP or What-If. / Checklist reviews may be more appropriate for low risk facilities. 

The method should also vary depending on the type of system being studied. HAZOP is appropriate for complex processing systems, but JSA may be more appropriate for examining a specific task or operation. Combinations of methods should also be considered when appropriate.
Refer to the chapter on Risk Assessment for information on how risk matrices may be used to help guide selection of appropriate methodologies.

Define Parameters
Setting boundaries and identifying a clear purpose are essential to any study. The consequences of interest should also be defined - is the study focusing only on safety, or also on environment and operations? What will be the threshold risk level, below which no action will be taken? 

Identify Information
Once the information requirements have been defined, the required documents need to be gathered. It is usually sufficient for one copy to be available to the team, often in the hands of the most appropriate discipline engineer or operations representative. 

The key study documents, for example P&ID's or mine plans, should be available in large print for all to see, or in sufficient number. If multiple sets are provided, one should be marked as the master set for any markups made during the study.

Select the Team
The team should include appropriate discipline engineers (mechanical, process, electrical, mining, control, etc) where they are relevant to the facility. Representatives of operations supervision and operations/maintenance technicians should also be included. Usually one of the team also fulfils the role of scribe.

Technology suppliers and equipment vendors should be included when appropriate. Other outside stakeholders may be included, although the general rule is that they should add value to the study, not be passive spectators.

Table 5.3 - Scope The Risk Assessment

Prepare
The bulk of the preparation will be done by the hazard study leader and the study sponsor. Others can prepare be ensuring that they understand the reasons for the study, the project background and how the operation being studied works. The leader or sponsor may circulate relevant information, such as past incident reports, to team members to get them thinking about how things might go wrong.

Conduct
The hazard study leader will be primarily responsible for the conduct of the study. His or her role will be to ensure that the method is applied appropriately, any changes to established methods are justified and documented, and that appropriately detailed minutes are produced. All team members can assist by keeping to schedule with start and break times and minimising interruptions. Hazards are initially identified by ignoring existing or already proposed controls and safeguards. 

Recommend Controls
The primary aim of the study is to identify and clearly define (document) hazards, not necessarily to identify solutions and controls. However, once a hazard has been identified and the existing/already proposed controls assessed as inadequate, appropriate controls will often be readily apparent and can be defined by the team during the study. For controls that need to be defined after the study, appropriate mechanisms should be in place to ensure that they are appropriate to the hazard and do not introduce new hazards. 

Document
For team based studies, the primary documentation will be the minutes of the meetings. These should be supplemented by clear notes and memos detailing work done in following up identified hazards. 

A report should be prepared covering the issues outlined in the table for Element 3. Sites should establish a standard format and content for such reports. In some countries, hazard study reports for new projects or cyclic reviews must be submitted to statutory authorities and so must comply with their requirements.

Table 5.4 - Conduct The Studies

Set Priorities
Risk assessment can be used to assist with setting priorities - refer to the chapter on Risk Assessment for further information. Other factors that may be important in setting priorities and timeframes include: need for a shutdown; capital cost versus capital available; technical feasibility of solution.

In situations where the consequences of a hazard can be expressed readily in financial terms, a cost-benefit analysis may be useful. Note that while cost-benefit analysis is attractive to insurers, it does not take into account the cost of human suffering and should not be used as a primary decision criterion for safety or health related hazards. For further details on cost-benefit, refer to the chapter on Risk Assessment.

Implement
Once the priorities are set implementation should proceed accordingly. Some actions or recommendations will require further studies or will be projects in their own right. Others will require the study sponsor to manage them and ensure that they are completed.

Part of the implementation should include:

Table 5.5 - Implement The Controls

Study Follow-up
Thorough follow up of hazard studies to ensure that actions are implemented fully and in a timely manner is essential. The best hazard study is useless unless the recommended actions are implemented.

For small studies, it may be appropriate to keep track of the relatively small number of actions informally until they are mostly complete. A formal review meeting should then be held and the actual actions taken noted. The review meeting should consist of a representative sample of the original study and should ensure that the implemented action meets the intent of the study and does not introduce any new hazards. The formal review meeting should be documented and the report/minutes filed with the hazard study report.

For larger studies, a number of formal review meetings may be appropriate. Each should review progress of outstanding actions and review actions completed since the last review. Completed actions should be reviewed to ensure that they meet the intent of the original hazard study and do not introduce new hazards. Each meeting should be documented and they should continue until all actions are completed.

Hazard Study Audit
This can be done internally. The auditor should be a senior person within the organisation with hazard study leadership expertise. Management systems should ensure that findings from the audit are acted upon so that the process is improved.

System Audit
As part of overall external auditing of the site's safety program, an audit of the entire hazard study system should be undertaken. The auditor should have credibility in hazard studies and should be tasked with finding opportunities for improvement in the system, rather than simply trying to find non-compliant hazard studies.

Improvement
To ensure that the audits and review lead to an overall improvement in the quality and efficiency of hazard studies, there should be a mechanism in place to track all improvement suggestions. This should be reviewed at a senior level regularly.

Table 5.6 - Audit The Outcomes And Processes

Table 5.7 Example 1 - New Project On Major Upgrade
Table 5.8 Example 2 - Existing Mine
Table 5.9 Example 3 - Changes On An Existing Facility

5.11: Generic 6-Stage Hazard Study Process

This section is a discussion on a project process for ensuring hazards are identified and managed at all appropriate stages of the project. It is taken from the chemical/oil industry where it is used in various versions and has been successfully translated into the mining industry. It was originally developed by ICI in the UK. 

Introduction
It is apparent from the study of many disasters that a major contributing element was either a failure to identify the hazards or a failure to act when hazards were identified. In the former category there is Flixborough (explosion), BHP mine (explosion), Bhopal (toxic gas), Coode Island (fire) and "Herald of Free Enterprise" (sinking). In the latter category is London Underground (collision), Piper Alpha platform (fire, explosion), Phillips (fire, explosion), and Challenger ("O' ring failure). These are the spectacular front page headline grabbing incidents, there are many others that result in a disaster, only the scale is different. All, without exception, were avoidable.

Another feature of all these incidents was a lack of any systematic approach to risk management. None of the facilities had a functioning safety management system in place. If there had been functioning systems, of which hazard studies are but a part, it is likely that the disasters would not have happened.

By using a systematic process for hazard identification and minimisation at all stages of a project, such failures can be avoided. A Hazard Study process will help to ensure that a project progresses from preliminary feasibility study through to beneficial operation with the minimum of hazards built-in and clearly defined safety management requirements. By identifying issues early, a sound Hazard Study process ensures that the design, construction and commissioning of the facility progress with minimal delay and rework. At the end, the Hazard Study process provides a detailed safety dossier for the facility with an auditable trail of the decision making process.

The Hazard Study process is of itself simple; the application requires management commitment and multi-disciplinary skills of a high order, along with a long term commitment to ensuring all activities are carried out with minimum and managed risk.


The Hazard Study Process
To ensure all hazards are identified and adequately managed it is necessary to have a very practical design process that forces the issues to be addressed. The following is an outline of such a process that uses multi-disciplinary team skills integrated into the process. There is a need for a corporate long term commitment to ensuring all activities involving hazards are carried out with minimum and managed risk. Although there is clearly a cost involved in following such a process, it is demonstrable that facilities designed using such a process cost less overall than those not using such a process. The savings come from imposing design requirements early, identifying potential problems early, having a trouble free startup of the facility and ongoing significant operational efficiencies. Comparisons suggest a full cost recovery within six months of startup and recurring significant savings over the life of the facility that would not otherwise be achieved.

In addition to all the typical design procedures that would be applicable to a new facility or upgrading/modifying an existing facility, risk management strategy requires close attention to the control of hazards, preferably by elimination. This is done by the application of an integrated group of distinct formal studies and reviews, initiated at the very early stages of project development and carried through to beneficial operation. The scope and extent of the studies and reviews is dependant on the hazardous nature, complexity, and size of the project involved. That is, the studies are tailored to suit.

In the following text, the Hazard Studies are described in relation to a new facility. With little change except scale, they can be applied to any modification on an existing facility. Further, by applying these studies in retrospect to an existing facility a clear measure of the shortfall between what is required and what exists can be derived, allowing suitable action plans to be developed and implemented in coordination with budgetary restraints.

It should be noted that this paper outlines a generic process. The scope of any studies for a specific project need to be appropriate to the complexity and probable hazards of the project

The timing of the hazard studies is shown in Figure 5.10. The studies are discussed below.


Hazard Study 1
This first study is carried out during the initial feasibility study phase and its purpose is to ensure that the understanding of the project, the process, and the materials involved is sufficient to enable all health, safety and environment (HSE) issues to be properly assessed. Where information is found to be lacking, the study initiates further work to obtain the required data. It contributes to key policy decisions and ensures that contacts are established with all parties, internal and external to the company, who may contribute to or impose constraints on the development of the project.

The study is carried out by a multi-disciplined team, usually including a representative of the business group (owner), project manager, site representative, process engineer, occupational hygienist, environmental specialist and possibly technical specialists as appropriate. The team is lead by an independent, trained and experienced study leader who is responsible for the quality of the study and the report.

This study identifies all the applicable regulations, legislation, and company standards. It should be initiated and driven by the owner (Project Leader).

The study will generally consider:

Hazard Study 3
This study is carried out to review the facility design and procedures to identify any hazards or obstacles to operability which could arise, particularly through deviations from the design intent. This is usually carried out towards the end of the front-end engineering. The consequences of deviations are identified and where necessary appropriate corrective actions initiated (hardware and/or software).

The team for this study is similar to that used in Hazard Study 2 plus any specialists required.

The study includes: