I was at a conference recently and went to a session about risk tolerance. The idea of risk tolerance is not new but the presentation piqued my interest.
Risk is not something we can do away with entirely. The first and easiest way to manage risk is to transfer the risk to someone else. This can take the form of insurance, or subcontractor. Insurance would transfer some of the risk but getting someone else to perform the work can transfer the risk entirely. If the company undertakes the work or operation, then it can use the second method, which is mitigate the risk using a standard methodology.
Interestingly enough, the type of risk really does not matter all that much. Financial and operational risk can be identified and mitigated in much the same way as what we often term safety risk. These two ways to manage risk are the most common and most widely discussed.
However, there is a third way in which corporations manage risk. They accept it. This is often called residual risk or acceptable risk. This is where we see the term risk tolerance used. How much risk will a company or workplace accept?
In terms of insurance it means setting the deductible on the policy along with the upper limits. We do much the same with car insurance. The cost for the insurance is based on the probability of you having an incident based on research by insurance companies, but another function of the cost is the deductible. A high deductible will get you a much cheaper policy. The insurance rate will vary on your individual performance just as it does for a company, whether that is property insurance or workers’ compensation insurance rates.
When it comes to safety, the impression often is that there is no acceptable risk but that really is not right. Decisions are made every day to accept risk. So when it comes to risk tolerance, the question often is, “Do we understand the risk?”
Risk is a function of the frequency of exposure, probability of an incident and potential severity of the outcome. We recognize hazards, and assess the risk using these criteria.
Obviously any high-rated risks will get dealt with first. But as we work down the scale, when does a risk become acceptable? That depends on the organization and its risk tolerance.
On an individual level there also is a risk tolerance. Workers really are very good at spotting hazards. In fact, most incidents are not all that surprising to the workers in the area, as they knew the hazard existed. Some may say they just thought the risk was “acceptable.”
Maybe we are over-thinking this a little.
In safety, risk is mitigated using the hierarchy of controls. It has been around a long time and almost anyone in the safety profession knows what it is:
- Elimination. Most effective
- Substitution. Using a different method, process or products
- Engineering. Design out the hazard, or separate it from workers
- Administrative. Procedures, policies or checklists
- Personal protective equipment (PPE). Least effective.
Many people who have been to a construction site will be familiar with the belief that “be careful” is an effective control. Many personal or group hazard assessments contain this phrase as do many the job hazard analysis. So is using “be careful” demonstrating that workers have a high risk tolerance or just that they have no clear idea of how to control those hazards?
Workers do their job in the workplace provided by their employer. The employer is charged with keeping them safe and determining what controls are required to mitigate known hazards. The only tangible portion of that process for the employee is the PPE that the employer requires them to wear. Workers have some control over the final and most ineffective of all the controls (PPE) but not the others – those are controlled by the employer.
How many companies have a process for workers to suggest or request engineering controls or administrative controls? What about substitution or eliminations? As we move up the hierarchy, time and resources required to implement those controls also tends to rise.
Have we left our workers with only two choices – be careful and/or wear PPE? A good example is the one you would see on any construction or industrial site. Workers must move across uneven ground. Assuming that there is adequate lighting, what must a worker do to mitigate this hazard? The outcome could be a fall or a twisted ankle but the company has deemed the risk acceptable. This is where we often see “be careful” listed as the control.
More appropriately, we would use a hazard reporting process if the ground became very uneven or slippery to ensure action was taken. Still, the most effective control is for the worker to wear boots with 6-inch uppers to provide ankle support (they must be laced up and tied, of course) to mitigate the hazard as we know it is inevitable a worker will roll their foot and possibly twist their ankle.
Now, many safety people reading this are thinking they would never do that. Well, when incidents are investigated the most common corrective actions usually revolve around training or retraining and PPE. Other action items are to follow existing processes or to continue to be more careful. This hardly is an effective approach.
A recent article in the February issue of Professional Safety found that higher order controls seldom are recommended in incident investigations. Clearly, when looking to mitigate risk, we must start at the top of the hierarchy and work our way down.
Safety personnel can be under pressure to show quick results or quick action after an incident. PPE quickly is available and distributed. Retraining ensures the worker is trained but implies the training was ineffective the first time or the supervisor was ineffective; perhaps both may apply. Engineering out a problem can be both costly and time consuming.
If we are frustrated by workers who think being careful is what it takes to keep them safe, does that mean they must live in fear of an incident? It seems they are not highly risk-tolerant but perhaps lack access to the control mechanisms and methodology. If there is no way for workers to influence the control methods or risk mitigation in the workplace more directly, that probably means we only have left them with PPE and “being careful.”
Branding workers as having a high risk tolerance is over complicating things. They are great at identifying the hazards but really are in the dark about hierarchy of controls. Are we giving them the knowledge and means to reduce risk or just asking them to be careful – and wear that PPE?
About the author: Dave Rebbitt is a long-practicing safety professional with over 25 years of experience. Since leaving a senior post at the Canadian Department of National Defence after 22 years of military service, he has held senior positions in various companies. Dave is an experienced speaker and has spoken at conferences and to industry groups on various topics. He holds CRSP and CHSC designations as well as a CET technical designation. Dave also holds an MBA from Athabasca University and has instructed in the University of Alberta OHS Diploma Program. Dave currently is president and owner of Rarebit Consulting, a safety and management consulting firm.