Risk Management
Core concepts
Risk management is the systematic process of identifying, analyzing, evaluating, treating, and monitoring risk. Anchor yourself in ISO 31000: risk is the effect of uncertainty on objectives, expressed as a combination of likelihood and consequence. The process includes communication and consultation, establishing scope and criteria, risk assessment, risk treatment, monitoring and review, and recording and reporting.
Tools. Preliminary hazard analysis, HAZOP for process deviations, FMEA for failure modes, fault tree for combinations of causes, event tree for consequences, bow-tie for linking prevention and mitigation barriers, and LOPA for testing whether a layer is truly independent.
Concepts to separate.
- Risk appetite (how much risk the organization wants to pursue) versus risk tolerance (the limit it will accept).
- Inherent risk (before controls) versus residual risk (after controls).
- ALARP: reduce risk as low as reasonably practicable, judged by the cost of further reduction against the benefit gained - not by the fact that something was already done.
Traps. Matrix scores are ordinal, not cardinal: a 20 is not twice a 10, and multiplying ranks across categories is arbitrary. A control that depends on human vigilance is not an independent protection layer, and common-cause failure can invalidate two nominally independent layers.
Worked example
A task rates likelihood 4 and severity 5 on a 5x5 matrix, giving 20 (high). After a guard and an interlock, likelihood falls to 2 and severity to 2, giving 4 (low). Document the residual risk and the basis for accepting it.