More than OH&S Definitions of Risk “Risk is virtually anything that threatens or limits the ability of a community or non-profit organisation to achieve its mission.” OR “Effect of uncertainty on objectives” Reference: AS/NZS/ISO 31000 Risk Management 2009 Definitions continued “It can be unexpected and unpredictable events such as destruction of a building, the wiping of all your computer files, loss of funds through theft or an injury to a member or visitor who trips on a slippery floor and decides to sue. Any of these or a million other things can happen, and if they do they have the potential to damage your organisation, cost you money, or in a worst case scenario, cause your organisation to close.” 5 Key steps in Risk Assessment 1. Establish the context 2. Identify risk/s 3. Analyse Risk (Likelihood and Consequence) 4. Evaluating Risk 5. Monitor and Review The Risk Management Process Establishing a context  What relationships does the organisation have and how       important are these? What laws, regulations, rules or standards apply to your organisation? What are the aims and objectives of the organisation? Who is involved with the organisation - internally and externally? What are your organisation's capabilities? What are you currently doing for risk management either formally or informally? Have you established some criteria for your organisation that defines what level of risk is acceptable? Identifying Risk Whole of organisation Brain Storm:  What is at risk and what will the effect be?  What can happen? When, where, why and how might this occur?  Who and what might be involved?  What and the effects and who is affected? What are we doing about this now? Analysing Risk  What is the likelihood of the risk occurring and what is the consequence of that outcome? High probability /Low impact High Probability /High Impact Low probability /Low impact Low Probability /High Impact  Likelihood rating  A - Frequent - Likely to occur frequently B - Probable - would occur but not frequently C - Occasional - could happen occasionally D - Remote - Rare, not likely but possible E - Improbable - Highly unlikely but still possible      Consequence/Severity rating A - Catastrophic - may result in death or loss of bodily functions B - Critical - may cause severe injury, illness C - Marginal - may cause injury or illness resulting in loss of work as an example D - Negligible - may cause minor injury or illness Evaluating Risk  It’s about “determining whether the level of risk is acceptable or unacceptable”.  It “enables priorities to be established that equate to an appropriate level of risk.”  Options include: Treating, accepting, avoiding, reducing and/or transferring the risk Monitor and Review Monitoring = “Continual assessment of what has been implemented” Review = “A periodic assessment of the effectiveness and environment” E – Extreme risk – detailed action plan required H - High risk – needs senior management attention M – Medium risk – specify management responsibility L – Low risk – manage by routine procedures High or Extreme risks must be reported to Senior Management and require detailed treatment plans to reduce the risk to Low or Medium. Probability: Insignificant Minor Moderate Major Catastrophic 1 2 3 4 5 M H H E E Historical: Is expected to occur in >1 in 10 most 5 circumstanc Almost Certain es Will probably 1 in 10 - 100 occur 4 Likely M M H H E 3 Possible L M M H E 2 Unlikely L M M H H 1 Rare L L M M H Likelihood Might occur 1 in 100 – 1,000 1 in 1,000 – 10,000 at some time in the future Could occur but doubtful May occur but only in 1 in 10,000 – exceptional 100,000 circumstanc es Consequence Injuries or ailments not People requiring medical treatment. Reputation Internal Review Minor errors in systems or Business Process & Systems processes requiring corrective action, or minor delay without impact on overall schedule. Financial Minor injury or First Aid Treatment Case. Serious injury causing Life threatening injury or hospitalisation or multiple multiple serious injuries medical treatment cases. causing hospitalisation. Scrutiny required by Scrutiny required by external internal committees or committees or ACT Auditor internal audit to prevent General’s Office, or inquest, escalation. etc. Policy procedural rule occasionally not met or services do not fully meet needs. One or more key accountability requirements not met. Inconvenient but not client welfare threatening. Death or multiple life threatening injuries. Intense public, political and Assembly inquiry or media scrutiny. Eg: front Commission of inquiry or page headlines, TV, etc. adverse national media. Strategies not consistent Critical system failure, bad with Government’s agenda. policy advice or ongoing Trends show service is non-compliance. Business degraded. severely affected. 1% of Budget 2.5% of Budget > 5% of Budget > 10% of Budget >25% of Budget or <$5K or <$50K or <$500K or <$5M or >$5M An example of risk assessment not solely focussed on OHS Identifying and Analysing Risks THE RISK SOURCE IMPACT CURRENT CONTROL STRATEGIES WHAT CAN HAPPEN? HOW CAN THIS HAPPEN FROM EVENT HAPPENING AND THEIR EFFECTIVENESS CURRENT RISK LEVEL (A) –Adequate ACCEPTABILITY (A/U) CURRENT RISK LEVEL CONSEQUENCE (I) – Indadequate LIKELIHOOD RISK REFERENCE (M) – Moderate Risk Treatment Schedule and Action Plan POTENTIAL TREATMENT OPTIONS COSTS & BENEFITS IS THE TREATMENT TO BE TARGET RISK IMPLEMENTED RESPONSIBLE PERSON LEVEL (Y/N) TIMETABLE MONITORING For strategies to implementation measure TARGET LEVEL CONSEQUENCE Treatments LIKELIHOOD RISK REFERENCE effectiveness of Risk