Quality, Safety, and Risk Management
The Quality, Safety, and Risk Management domain tests whether you can build quality into engineering processes, eliminate or control safety hazards, and manage risk systematically rather than reactively.
Core rules and concepts
- A quality management system such as ISO 9001 covers quality planning, assurance, and control. Quality assurance governs the process; quality control inspects and tests the output. Both need records.
- Independent checking, design verification, and peer review are core engineering controls. Check calculations, assumptions, interfaces, and constructability before issuance.
- Apply the hierarchy of controls in order: elimination, substitution, engineering controls, administrative controls, then personal protective equipment. PPE is the last line, not the first.
- Risk = likelihood x consequence. Use a risk matrix with defined bands, assign an owner, record triggers and responses, and reassess after controls. ALARP means reducing risk as low as reasonably practicable, with residual risk communicated.
- Safety in design requires identifying hazards early, eliminating them where possible, and passing residual risks to constructors and operators through drawings, specifications, and O&M information.
- Use structured techniques such as HAZID, HAZOP, and FMEA for complex systems. Investigate incidents for root and systemic causes, not just individual blame.
- Professional indemnity and general liability insurance transfer some financial consequences but do not replace risk control.
Worked example
A workshop task has likelihood 4 and consequence 5 on a 5x5 matrix, giving a risk score of 20 (high). Installing a fixed extraction system is an engineering control that reduces likelihood to 2, giving a score of 10 (medium). The residual risk is documented, the risk owner is assigned, and operators receive training and monitoring. Issuing respirators alone would be PPE and would not satisfy the hierarchy of controls.
Traps that cost marks
Treating PPE as the primary control; confusing quality assurance with inspection; leaving the risk register static after controls; failing to communicate residual risk; blaming an individual without examining system causes; ignoring construction and maintenance safety interfaces.