Risk Assessment and Risk Treatment
Risk Assessment and Risk Treatment
This domain tests structured risk decisions: how likelihood and severity are combined, how risk is evaluated against criteria, and how treatment is selected and verified.
Core rules
- ISO 31000 provides the process: establish context, identify, analyze, evaluate, treat, communicate, monitor, and review.
- Risk is usually analyzed as consequence and likelihood. A risk matrix must have defined scales and decision rules; otherwise the same score means different things to different assessors.
- Evaluation compares risk to criteria such as tolerable, ALARP, or corporate thresholds. ALARP means risk is reduced as far as reasonably practicable, not to zero.
- Treatment follows the hierarchy of controls. The chosen option must address the dominant contributor, not just the easiest item on the list.
- Residual risk is documented after treatment and accepted by an accountable manager.
- Monitoring includes whether the treatment was implemented and whether it worked.
Worked example
A press has a severity of 4 (major injury) and likelihood of 3 (possible), giving 12 on a 5x5 matrix, above the site's tolerable limit of 8. An interlock guard reduces likelihood to 1, giving 4. A procedural change alone would reduce likelihood only to 2, giving 8, technically tolerable but still dependent on behavior. The engineering control is selected because it removes the exposure rather than relying on compliance, and the residual score of 4 is recorded with a verification check that the interlock cannot be defeated.
Traps
- Multiplying ordinal matrix scores and treating the result as a cardinal number.
- Applying risk scores without documenting assumptions and exposure duration.
- Assuming residual risk is zero after a control is added.
- Choosing administrative controls because they are cheaper when engineering controls are feasible.